Here is my HJT log, thanks for your help :) 200#pumpkin

Unknown · September 2004

I ran Spybot & Ad-Aware (on Windows 98) and they found nothing new.
Then I ran SpySweeper, which found a CoolWebSearch Registry Entry : HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{799a370d-5993-4887-9df7-0a4756a77d00}

Yesterday it found the CWS_NS3 Hijacker.

I noticed that Internet Explorer's search page was somehow reset, and when I clicked the search icon, I saw this message :
"Sorry, the page cannot be found. Please try one of the following: Check the Web address (URL) to make sure it is correct (capitalization and punctuation are important), and then click your browser's Refresh button. / Go to MSN Search [link] home page. / Click your browser's Back button to return to the previous page."

The forum moderator told me to delete 2 programs, winuyv32.exe and msdview32.exe. They show up in Ad-Aware's list of running processes ; but when I hit Ctrl-Alt-Delete they aren't in the list so I can't kill the processes.
Thanks again in advance for your help. Here is my HJT log :

Logfile of HijackThis v1.98.2
Scan saved at 1:08:11 PM, on 9/14/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVSYNMGR.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE FIREWALL\CPD.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSSTAT.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSHWIN32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\AVCONSOL.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE
C:\WINDOWS\SYSTEM\WINUYV32.EXE
C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\INSTANT UPDATER\RULAUNCH.EXE
C:\WINDOWS\SYSTEM\MSDVIEW32.EXE
C:\PROGRAM FILES\WEBROOT\SPY SWEEPER\SPYSWEEPER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\WINDOWS\NOTEPAD.EXE
C:\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchmiracle.com/main/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchmiracle.com/main/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmiracle.com/main/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchmiracle.com/main/sp.php
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: Class - {5646EF03-BA95-7DA5-559F-27A195BB277A} - C:\WINDOWS\SYSTEM\WINRD32.DLL (file missing)
O2 - BHO: (no name) - {0D023DA4-FC55-11D8-9BE1-0004B0E741A3} - C:\WINDOWS\SYSTEM\ANICD.DLL (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: McAfee VirusScan - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - C:\PROGRAM FILES\MCAFEE\MCAFEE VIRUSSCAN\VSCSHELLEXTENSION.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ATIGART] c:\ati\gart\atigart.exe
O4 - HKLM\..\Run: [AtiPTA] Atiptaaa.exe
O4 - HKLM\..\Run: [AtiCwd32] Aticwd32.exe
O4 - HKLM\..\Run: [AtiQiPcl] AtiQiPcl.exe
O4 - HKLM\..\Run: [McAfee Guardian] "C:\PROGRAM FILES\MCAFEE\MCAFEE SHARED COMPONENTS\GUARDIAN\CMGRDIAN.EXE" /SU
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\GRISOFT\AVG7\AVGCC.EXE /STARTUP
O4 - HKLM\..\Run: [AVG7_AMSVR] C:\PROGRA~1\GRISOFT\AVG7\AVGAMSVR.EXE
O4 - HKLM\..\Run: [SysA] C:\WINDOWS\SYSTEM\WINUYV32.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [McAfeeVirusScanService] C:\Program Files\McAfee\McAfee VirusScan\AVSYNMGR.EXE
O4 - HKLM\..\RunServices: [McAfee Firewall] "C:\PROGRAM FILES\MCAFEE\MCAFEE FIREWALL\CPD.EXE" /SERVICE
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SoundView] C:\WINDOWS\SYSTEM\msdview32.exe
O4 - HKCU\..\Run: [Forbes] C:\Program Files\Forbes\ForbesAlerts.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SPYSWEEPER.EXE" /0
O4 - Startup: EPSON Background Monitor.lnk = C:\ESM2\Stms.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll

[end of HJT log]

SpywareShooter · September 2004

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchmiracle.com/main/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.searchmiracle.com/main/sp.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchmiracle.com/main/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.searchmiracle.com/main/sp.php
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {5646EF03-BA95-7DA5-559F-27A195BB277A} - C:\WINDOWS\SYSTEM\WINRD32.DLL (file missing)
O2 - BHO: (no name) - {0D023DA4-FC55-11D8-9BE1-0004B0E741A3} - C:\WINDOWS\SYSTEM\ANICD.DLL (file missing)
O4 - HKLM\..\Run: [SysA] C:\WINDOWS\SYSTEM\WINUYV32.EXE

Have hijackThis fix those entries then delete winuyv32.exe and post a new log.

primesuspect · September 2004

Make sure you reboot before you post a new log

Here is my HJT log, thanks for your help :) 200#pumpkin

Comments