Options

omegasearch :s

Unknown
edited June 2004 in Spyware & Virus Removal
sorry for yet another omegasearch
i can't seem to get rid of the bugger :rant:
spybot blocked it making itself my homepage (woohoo! :celebrate: ) however, i know it's still there :banghead:

i wouldn't call myself a n00b about spyware, but i'm no expert, and this 1 has me baffled. there's a few there (below) i don't wanna kill cos tehre's no info on them

also, i know you guys are doing research/etc into omegasearch. i've noticed that when i delete my temp internet files it takes longer for the thing to come back (tho i'll bet you guys knew that =p)


results of spybot:
(saved results to file then copy/pasted here. hope that was right)
(another note-i havn't imunised. i tried that like 8 months ago and my comp got buggered. lol)


Avenue A, Inc.: Tracking cookie (Internet Explorer: Dude) (Cookie, nothing done)


Advertising.com: Tracking cookie (Internet Explorer: Dude) (Cookie, nothing done)


Advertising.com: Tracking cookie (Internet Explorer: Dude) (Cookie, nothing done)


C2.lop.AproposMedia: Data (File, nothing done)
C:\WINDOWS.000\MSIMGSIZ.DAT

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-21-1202660629-1770027372-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

DSO Exploit: Data source object exploit (Registry change, nothing done)
HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004!=W=3

HotKeysHook: Keylogger library (File, nothing done)
C:\WINDOWS.000\System32\H@tKeysH@@k.DLL

MediaPlex: Tracking cookie (Internet Explorer: Dude) (Cookie, nothing done)


PeopleOnPage: Autorun settings (Registry value, nothing done)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AutoUpdater

ValueClick: Tracking cookie (Internet Explorer: Dude) (Cookie, nothing done)



--- Spybot - Search && Destroy version: 1.3 ---
2004-05-25 Includes\Cookies.sbi
2004-05-29 Includes\Dialer.sbi
2004-05-28 Includes\Hijackers.sbi
2004-05-28 Includes\Keyloggers.sbi
2004-05-12 Includes\LSP.sbi
2004-05-28 Includes\Malware.sbi
2004-05-04 Includes\Revision.sbi
2004-04-12 Includes\Security.sbi
2004-05-28 Includes\Spybots.sbi
2004-05-24 Includes\Tracks.uti
2004-05-28 Includes\Trojans.sbi



hijack this results:

Logfile of HijackThis v1.97.3
Scan saved at 12:22:24, on 06/06/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS.000\System32\smss.exe
C:\WINDOWS.000\system32\winlogon.exe
C:\WINDOWS.000\system32\services.exe
C:\WINDOWS.000\system32\lsass.exe
C:\WINDOWS.000\system32\svchost.exe
C:\WINDOWS.000\System32\svchost.exe
C:\WINDOWS.000\system32\LEXBCES.EXE
C:\WINDOWS.000\system32\spoolsv.exe
C:\WINDOWS.000\system32\LEXPPS.EXE
C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
C:\McAfee VirusScan\Avsynmgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS.000\System32\nvsvc32.exe
C:\WINDOWS.000\System32\svchost.exe
C:\WINDOWS.000\SYSTEM32\ZONELABS\vsmon.exe
C:\McAfee VirusScan\VsStat.exe
C:\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\McAfee VirusScan\Avconsol.exe
C:\WINDOWS.000\Explorer.EXE
C:\WINDOWS.000\SOUNDMAN.EXE
C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\QuickTime\qttask.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\PROGRA~1\LOGOCL~1\Proxy Admin.exe
C:\WINDOWS.000\System32\RUNDLL32.EXE
C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
H:\Spybot - Search & Destroy\TeaTimer.exe
C:\ZoneAlarm\zapro.exe
H:\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\Netropa\Multimedia Keyboard\TrayMon.exe
C:\Program Files\Netropa\Onscreen Display\OSD.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Dude\Desktop\Hijack This\HijackThis.exe

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - H:\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS.000\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\McAfee VirusScan\VSCShellExtension.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.000\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS.000\system32\NeroCheck.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "H:\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [army way] C:\PROGRA~1\LOGOCL~1\Proxy Admin.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS.000\System32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] H:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: ZoneAlarm Pro.lnk = C:\ZoneAlarm\zapro.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: InterVideo WinCinema Manager.lnk = H:\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {0191ABF4-9421-435E-9FFD-CD827A2A82D8} (SBITAX7Ctrl Class) - http://www.movie-browser.com/tl7000_certid1.dll
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Comments

  • TSR
    edited June 2004
    oh - also, i've used ad-aware and killed everything that's come up
  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited June 2004
    Welcome to Short-Media, TSR. Since you already used Ad-Aware and Spybot, we can go ahead and clean out the rest of your system. When you're finished, be sure to stick around. This place rocks, especially the Folding@Home team.

    Boot into safe mode and delete the following:

    O4 - HKLM\..\Run: [MULTIMEDIA KEYBOARD] C:\Program Files\Netropa\Multimedia Keyboard\MMKeybd.exe
    Your choice. If you use the special keys, keep it. If not, you can safely delete it to save resources.

    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS.000\system32\NeroCheck.exe
    Checks for conflicts with Nero software. If you only have one burning program on your PC, I wouldn't worry about it. I use Nero and haven't had any problems without having this file running.

    O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EXE

    O4 - HKLM\..\Run: [QuickTime Task] "C:\QuickTime\qttask.exe" -atboottime
    QuickTime updater. You can safely remove this to save resources.

    O4 - HKLM\..\Run: [army way] C:\PROGRA~1\LOGOCL~1\Proxy Admin.exe
    Omegasearch

    O16 - DPF: {0191ABF4-9421-435E-9FFD-CD827A2A82D8} (SBITAX7Ctrl Class) - http://www.movie-browser.com/tl7000_certid1.dll
    O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} -

    You may have to manually delete Proxy Admin.exe and AUTOUP~1.EXE. The first one you can easily search for. The other you might have to dig for. Check folders in Program Files that start with autoup, and look for a file that starts with autoup.

    Reboot and repost your log.
  • TSR
    edited June 2004
    hello again
    sorry it took me so long to reply. pesky work :banghead:


    punched in a search for admin.exe and got all this....which 1(s) you want me to kill?

    Proxy Admin.exe || location: C:\
    Proxy Admin.exe || location: C:\program files\logo close wipe
    dmadmin.exe || location: C:\windows.000\system32
    vssadmin.exe || location: C:\windows.000\system32
    proxy admin.exe-2dob6d60.pf || location: C:\windows.000\prefetch
    admin.exe || locatoin: C:\windows.000\servicepackfiles\i386


    i can't find any AUTOUP~1.EXE files, though. lol
  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited June 2004
    You'll want to delete the 3 below while in safe mode. How about the file that begins autoup? Make sure you get that one too.

    Proxy Admin.exe || location: C:\
    Proxy Admin.exe || location: C:\program files\logo close wipe
    proxy admin.exe-2dob6d60.pf || location: C:\windows.000\prefetch
  • TSR
    edited June 2004
    i was unable to find any autoup files

    thanks for those 3 though =)
Sign In or Register to comment.