Options

Omegasearch has a gun to my head...

Unknown
edited October 2004 in Spyware & Virus Removal
Well, not quite, but they have hijacked my computer. :\

How can rid myself of their accursed toolbar and hijacking? Any help?
:\

Thanks.

Comments

  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited October 2004
    Hi :)

    I'm moving this thread into our SVT forum so that you can be properly helped.

    http://www.short-media.com/forum/showthread.php?t=14915

    read that first :)
  • Shadowdancer
    edited October 2004
    primesuspect wrote:
    Hi :)

    I'm moving this thread into our SVT forum so that you can be properly helped.

    http://www.short-media.com/forum/showthread.php?t=14915

    read that first :)

    I have read that. I did the following already:

    1. Disabled System Restore.
    2. Booted in safe mode.
    3. Ran Hijack This - couldn't find the files I was told to look for. :\
    4. Rebooted normally...
    5. Found that IE is still hijacked. :\



    This is my log file from HijackThis:

    Logfile of HijackThis v1.98.2
    Scan saved at 12:38:46 AM, on 10/1/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Winamp3\winampa.exe
    C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\System32\RUNDLL32.EXE
    C:\Program Files\AIM\aim.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wdfmgr.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Documents and Settings\Mike\Desktop\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://web.dzwgselcnpyudkcg.biz/0JPDHIyl9xwkvX4qTjRvXsh0EdvR0UxRSm6ixSXke_PY2yj4rlif/WL6vtO6ncSw.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {74C3B2BB-E9E7-D20B-7A66-ECEF97861BE5} - C:\PROGRA~1\SETUPI~1\bind mapi.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
    O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: NeoTrace It! - {9885224C-1217-4c5f-83C2-00002E6CEF2B} - C:\PROGRA~1\NEOTRA~1\NTXtoolbar.htm (HKCU)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: http://members.freewebs.com
    O15 - Trusted Zone: http://www.freewebs.com
    O15 - Trusted Zone: http://www.neveron.com
    O15 - Trusted Zone: http://www3.neveron.com
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
    O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

    Here is an image of the toolbar I'm stuck with:

    http://www.runescapehaven.com/Shadowdancer/hijacked.PNG

    What do I do to rid myself of this?
  • Shadowdancer
    edited October 2004
    Oh, and the page to download your OmegakillerSM program remover thing doesn't work. It gives me "access denied".
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited October 2004
    try downloading it again. Make sure you type in the validation code exactly as you see it. Pay special attention to l and 1 and o and 0
  • Shadowdancer
    edited October 2004
    I get no code when prompted. I just get a "blank" image. :\

    I'm looking over the HijackThis log right now. Are there any suspicious things there that should be gone?
  • Shadowdancer
    edited October 2004
    Will www.spybouncer.com get rid of it, perchance?

    Please respond.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited October 2004
    No! Do NOT download spybouncer!

    Check this list:

    http://www.spywarewarrior.com/rogue_anti-spyware.htm

    We'll be able to help you, but you'll have to be slightly patient since we are so busy in here. Someone WILL be able to help you. :)
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited October 2004
    So, wait.... you click this link. and then what do you get?
  • Shadowdancer
    edited October 2004
    Hey, that link gave me the code finally.

    I downloaded it and ran it. My taskbar vanished for a sec then came back.

    I will reload IE and see if that got rid of it.
  • Shadowdancer
    edited October 2004
    That seems to have done the trick.

    I wish to be directed to a donations page please.
  • Shadowdancer
    edited October 2004
    ...it seems to still be here?

    This is the log from OmegaKiller's sweep of my system:

    - This is an automatically created log of OmegaKillers output
    - Please visit http://www.short-media.com/forum/forumdisplay.php?f=57
    - for further assistance.


    Running pass number: 1

    - enumerating modules
    - scanning bookmarks
    - scanning desktop icons
    - scanning and deleting browser hijacks

    - scanning running processes..
    - infection in memory: c:\progra~1\cdromb~1\kindidol.exe
    - process terminated.
    - file removed.
    - removing process startup key
    - scanning startup processes
    - scanning executable variants

    - scanning BHO's
    - scanning toolbars

    - adding host entries


    Running pass number: 2

    - killing Internet Explorer

    - enumerating modules
    - scanning bookmarks
    - scanning desktop icons
    - scanning and deleting browser hijacks

    - scanning running processes..
    - infection in memory: c:\progra~1\cdromb~1\kindidol.exe
    - process terminated.
    - file removed.
    - removing process startup key
    - scanning startup processes
    - scanning executable variants

    - scanning BHO's
    - scanning toolbars

    - adding host entries


    Running pass number: 3

    - killing Internet Explorer

    - enumerating modules
    - scanning bookmarks
    - scanning desktop icons
    - scanning and deleting browser hijacks

    - scanning running processes..
    - infection in memory: c:\progra~1\cdromb~1\kindidol.exe
    - process terminated.
    - file removed.
    - removing process startup key
    - scanning startup processes
    - scanning executable variants

    - scanning BHO's
    - scanning toolbars

    - adding host entries


    Running pass number: 4

    - killing Internet Explorer

    - enumerating modules
    - scanning bookmarks
    - scanning desktop icons
    - scanning and deleting browser hijacks

    - scanning running processes..
    - infection in memory: c:\progra~1\cdromb~1\kindidol.exe
    - process terminated.
    - file removed.
    - removing process startup key
    - scanning startup processes
    - scanning executable variants

    - scanning BHO's
    - scanning toolbars

    - adding host entries


    Running pass number: 5

    - killing Internet Explorer

    - enumerating modules
    - scanning bookmarks
    - scanning desktop icons
    - scanning and deleting browser hijacks

    - scanning running processes..
    - removing process startup key
    - scanning startup processes
    - scanning executable variants

    - scanning BHO's
    - scanning toolbars

    - adding host entries

    - no infections found, system clean on pass number: 5 ...
    - all done ...

    I found this KindIdol.exe hidden as an instance of Internet Explorer. So, I guess OmegaKiller can't get rid of it permanently.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited October 2004
    Post a new hijackthis log, and we'll be able to fix it for you.
  • Shadowdancer
    edited October 2004
    primesuspect wrote:
    Post a new hijackthis log, and we'll be able to fix it for you.

    Here it is:

    Logfile of HijackThis v1.98.2
    Scan saved at 11:32:58 AM, on 10/2/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Winamp3\winampa.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\Yahoo!\Messenger\ypager.exe
    C:\Program Files\Webroot\Washer\wwDisp.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Documents and Settings\Mike\Desktop\runescape.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\SCWebCam3\SCWebCam3.exe
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Mike\Desktop\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sdaxdwntakdxjkje.net/0JPDHIyl9xzABqGhZPvBvOw8CCbOCRNZhXNPhDp6A4U.asp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gttfuoxlmvoc.com/0JPDHIyl9xwkvX4qTjRvXsh0EdvR0UxRSm6ixSXke_MEum4Q0R2renL6vtO6ncSw.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/*http://www.yahoo.com
    R3 - Default URLSearchHook is missing
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: (no name) - {74C3B2BB-E9E7-D20B-7A66-ECEF97861BE5} - C:\PROGRA~1\SETUPI~1\bind mapi.exe
    O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [Live Clock] C:\PROGRA~1\CDROMB~1\KindIdol.exe
    O4 - HKLM\..\Run: [Titledefyruleup] C:\Documents and Settings\All Users\Application Data\userfiletitledefy\Cool poll.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &NeoTrace It! - C:\PROGRA~1\NEOTRA~1\NTXcontext.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O15 - Trusted Zone: http://members.freewebs.com
    O15 - Trusted Zone: http://www.freewebs.com
    O15 - Trusted Zone: http://www.neveron.com
    O15 - Trusted Zone: http://www3.neveron.com
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20030530/qtinstall.info.apple.com/bonnie/us/win/QuickTimeInstaller.exe
    O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} (Microsoft.WinRep) - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
    O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {7CF052DE-C74F-421B-B04A-3B3037EF5887} (CCMPGui Class) - http://64.124.45.181/chaincast/proxy/CCMP.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
    O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/yautocomplete.cab
    O16 - DPF: {E504EE6E-47C6-11D5-B8AB-00D0B78F3D48} (Yahoo! Webcam Viewer Wrapper) - http://chat.yahoo.com/cab/yvwrctl.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  • Shadowdancer
    edited October 2004
    I'll just hack around in my registry. If I don't reply it means I've either ruined my computer or been successful.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited October 2004
    Here are the omega search infections:

    O2 - BHO: (no name) - {74C3B2BB-E9E7-D20B-7A66-ECEF97861BE5} - C:\PROGRA~1\SETUPI~1\bind mapi.exe

    O4 - HKLM\..\Run: [Live Clock] C:\PROGRA~1\CDROMB~1\KindIdol.exe
    O4 - HKLM\..\Run: [Titledefyruleup] C:\Documents and Settings\All Users\Application Data\userfiletitledefy\Cool poll.exe

    So, what you need to do is end every single iexplore.exe process. Hit CTRL-ALT-DEL, go to task manager, go to the processes tab.

    Right click on every iexplore.exe process, click "END PROCESS TREE" - say yes to the warning.

    Once every iexplore.exe process has ended, you need to manually delete those folders:

    C:\Program Files\SETUP I something - it starts with the word setup and the next word starts with "I"

    C:\PROGRAM FILES\CDROM B something

    C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\user file title defy - delete that.

    Once those are deleted, pull the plug on your computer - do not shut it down properly.

    Once you turn it back on, post a new log and we'll get rid of the rest of your spyware (you have more than just omegasearch on there)
Sign In or Register to comment.