Options

omegasearch (hanasuke) pls help

Unknown
edited June 2004 in Spyware & Virus Removal
hi,this omega seach thingy is driving me nuts!pls help.......

here s my hjt log in normal mode after running adaware and spybot-search and destroy and following the instructions on using hijack this.

the bottom toolbar and redirection page is still there!!! :rant:

Logfile of HijackThis v1.97.7
Scan saved at 09:52:49, on 03/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fujitsu\IndicatorUtility\IndicatorUty.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\デスクトップ\Hijack This\HijackThis.exe

F0 - syst>m.ini: Shell=
F0 - R >ystem.ini: Shel>=
F0 - R >ystem.ini: UserInit=
O1 - Hosts: 172.16.0.111 ser00
O1 - Hosts: 172.16.0.112 ser01
O1 - Hosts: 172.16.0.113 ser02
O1 - Hosts: 172.16.0.114 ser03
O1 - Hosts: 172.16.0.122 ser05
O1 - Hosts: 172.16.0.123 ser06
O1 - Hosts: 172.31.0.101 SV02N
O1 - Hosts: 172.28.0.100 SV01S
O1 - Hosts: 172.27.0.100 SV01SS
O1 - Hosts: 172.29.0.2 TTC09
O1 - Hosts: 172.29.0.10 TTC10
O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\IndicatorUtility\IndicatorUty.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [imjpmig] C:\Program Files\Common Files\Microsoft Shared\IME\IMJP\imjpmig.exe /RemAdvDef /AIMEREG /Migration /SetPreload
O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ara-key] C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd323467.exe -StartUp
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: NTUSER.DAT
O4 - Startup: ntuser.dat.LOG
O4 - Startup: ntuser.ini
O4 - Global Startup: NTUSER.DAT
O4 - Global Startup: NTUSER.DAT.LOG
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: ICQ Lite (HKLM)
O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.fmworld.net/biz/index.html
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://cs.chat.yahoo.co.jp/v45/yacscom.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10497be59b7623c58915/netzip/RdxIE601_ja.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

thanks

Comments

  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    To be honest, I don't see anything in the log that jumps out at me. Have you previously removed any of the entries with hijackthis?
  • hanasuke
    edited June 2004
    yeha i removed most suspicious stuff with hijackthis but i still get the bottom omegasearch bar and http://omegasearch.com/passthrough/...p://about_:blankhttp://omegasearch.com/passthrough/...p://about_:blank redirection.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited June 2004
    Welcome to short-media.

    Get rid of the following:

    F0 - syst>m.ini: Shell=
    F0 - R >ystem.ini: Shel>=
    F0 - R >ystem.ini: UserInit=
    O1 - Hosts: 172.16.0.111 ser00
    O1 - Hosts: 172.16.0.112 ser01
    O1 - Hosts: 172.16.0.113 ser02
    O1 - Hosts: 172.16.0.114 ser03
    O1 - Hosts: 172.16.0.122 ser05
    O1 - Hosts: 172.16.0.123 ser06
    O1 - Hosts: 172.31.0.101 SV02N
    O1 - Hosts: 172.28.0.100 SV01S
    O1 - Hosts: 172.27.0.100 SV01SS
    O1 - Hosts: 172.29.0.2 TTC09
    O1 - Hosts: 172.29.0.10 TTC10
    O4 - Startup: NTUSER.DAT
    O4 - Startup: ntuser.dat.LOG
    O4 - Startup: ntuser.ini
    O4 - Global Startup: NTUSER.DAT
    O4 - Global Startup: NTUSER.DAT.LOG
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O14 - IERESET.INF: START_PAGE_URL=http://www.fmworld.net/biz/index.html


    This looks suspicious: I've been using adobe products for years and years, and I've never seen anything like this: I'd get rid of it:

    O4 - HKLM\..\Run: [ara-key] C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd323467.exe -StartUp
  • tophericetopherice Oak Ridge, TN
    edited June 2004
    You can also get rid of

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ara-key] C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd323467.exe -StartUp
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  • hanasuke
    edited June 2004
    nope didnt work

    this is the new log
    Logfile of HijackThis v1.97.7
    Scan saved at 12:36:18, on 03/06/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\Tablet.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Fujitsu\IndicatorUtility\IndicatorUty.exe
    C:\WINDOWS\System32\igfxtray.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\LTSMMSG.exe
    C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
    C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\WINDOWS\system32\WTablet\TabUserW.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Administrator\デスクトップ\Hijack This\HijackThis.exe

    F0 - syst>m.ini: Shell=
    F0 - R >ystem.ini: Shel>=
    F0 - R >ystem.ini: UserInit=
    O1 - Hosts: 172.16.0.111 ser00
    O1 - Hosts: 172.16.0.112 ser01
    O1 - Hosts: 172.16.0.113 ser02
    O1 - Hosts: 172.16.0.114 ser03
    O1 - Hosts: 172.16.0.122 ser05
    O1 - Hosts: 172.16.0.123 ser06
    O1 - Hosts: 172.31.0.101 SV02N
    O1 - Hosts: 172.28.0.100 SV01S
    O1 - Hosts: 172.27.0.100 SV01SS
    O1 - Hosts: 172.29.0.2 TTC09
    O1 - Hosts: 172.29.0.10 TTC10
    O4 - HKLM\..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\IndicatorUtility\IndicatorUty.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
    O4 - HKLM\..\Run: [imjpmig] C:\Program Files\Common Files\Microsoft Shared\IME\IMJP\imjpmig.exe /RemAdvDef /AIMEREG /Migration /SetPreload
    O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
    O4 - Startup: NTUSER.DAT
    O4 - Startup: ntuser.dat.LOG
    O4 - Startup: ntuser.ini
    O4 - Global Startup: NTUSER.DAT
    O4 - Global Startup: NTUSER.DAT.LOG
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: Microsoft Excel にエクスポート(&X) - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: ICQ Lite (HKLM)
    O9 - Extra 'Tools' menuitem: ICQ Lite (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
    O14 - IERESET.INF: START_PAGE_URL=http://www.fmworld.net/biz/index.html
    O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://cs.chat.yahoo.co.jp/v45/yacscom.cab
    O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10497be59b7623c58915/netzip/RdxIE601_ja.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78E} (SassCln Object) - http://www.microsoft.com/security/controls/SassCln.CAB
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab


    do u guys think i should really delete this one
    O14 - IERESET.INF: START_PAGE_URL=http://www.fmworld.net/biz/index.html
    cos i think its only a redirection to my default laptop website.

    and as for
    F0 - syst>m.ini: Shell=
    F0 - R >ystem.ini: Shel>=
    F0 - R >ystem.ini: UserInit=
    O1 - Hosts: 172.16.0.111 ser00
    O1 - Hosts: 172.16.0.112 ser01
    O1 - Hosts: 172.16.0.113 ser02
    O1 - Hosts: 172.16.0.114 ser03
    O1 - Hosts: 172.16.0.122 ser05
    O1 - Hosts: 172.16.0.123 ser06
    O1 - Hosts: 172.31.0.101 SV02N
    O1 - Hosts: 172.28.0.100 SV01S
    O1 - Hosts: 172.27.0.100 SV01SS
    O1 - Hosts: 172.29.0.2 TTC09
    O1 - Hosts: 172.29.0.10 TTC10

    think these are my school network connections.

    and one more thing all the fixes i done so far i didnt find anything to delete from my program folder after i reboot after running hijackthis.
    what s the problem?

    help...if this goes on i ll lose all my hair
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited June 2004
    Are you using the Japanese input method editor?
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    When you removed the entries the first time, did you do it in safe mode?
    Are you using the Japanese input method editor?

    I'm pretty sure he is...looking at the homepage, as well as one of the directory names.
  • hanasuke
    edited June 2004
    YES YES YES the problems fixed!!!!! thanks people!!
    yes prime suspect,i am using xp japanese edition.
    not sure what i did but fixed the f0 entries and also reset the value of
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
    and it s back and running.
    thanks a lot people.
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    haha, glad to help.

    be sure to browse the rest of the forums, especially the folding forum...
    http://www.short-media.com/forum/forumdisplay.php?f=14
  • hanasuke
    edited June 2004
    one more thing,what about post-omegasearch actions other than the ones posted on the deafeat spyware guide?

    anyone know bout what other spyware protectors around that will prevent this sort of thing from happening again?

    and another thing adaware and search and destroy doesnt do auto-protect do they?

    time to shift to netscape and mozilla,people
  • shwaipshwaip bluffin' with my muffin Icrontian
    edited June 2004
    spybot S&D has some immunization functions built in. I have run the Immunize function on my laptop, and have never had any problems with really bad infections, however, I don't really do questionable things that might lead to an infection. Just be careful about what you click on, and run adaware/spybot regularly, and it shouldn't be a big deal.
  • DexterDexter Vancouver, BC Canada
    edited June 2004
    Spyware Blaster, also available on our Security downloads page, can immunize your browser against many known spyware / adware problems. See the link in my signature (Or Shwaip's) for the download page.

    Dexter...
  • hanasuke
    edited June 2004
    ok thanks
    sorry for being the shady character hehehe
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited June 2004
    We don't think you're shady just because you've been victimized by scummy marketing companies :) But if you joined our folding team, that would make you a hero in our eyes :)
Sign In or Register to comment.