Options

Newbie Needing Help on Search Assistent, Search Extender, Shopping Wizard, and ...

Unknown
edited October 2004 in Spyware & Virus Removal
I have Home Search Assistent, Search Extender, Shopping Wizard, and a New Button on my Browser (a red Exclamation point thats says it helps remove spyware) on my computer. Ive downloaded and ran Spybot S&D, AD-Aware Personal SE, Norton Antivirus Scan, HJT, and HSRemover. All the programs are stil on my computer but i can actually use my AIM now... I tried to go through the removal guide but im totaly clueless on how to do alot of the end of the post stuff. I do not have a printer so i cant print-out the hjt log. Ill post the log i saved below [I deleted everything on the log].

Logfile of HijackThis v1.98.2
Scan saved at 2:54:23 AM, on 10/10/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\AntiVirus.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Justin Evans\My Documents\filelib\highjackthis\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

Comments

  • Paradox
    edited October 2004
    This is the whole log as of today...

    Logfile of HijackThis v1.98.2
    Scan saved at 5:50:57 PM, on 10/10/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\AntiVirus.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\PROGRA~1\Cacheman\Cacheman.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\AIM\aim.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Justin Evans\My Documents\filelib\highjackthis\HijackThis.exe

    O4 - HKLM\..\Run: [Microsoft Update] AntiVirus.exe
    O4 - HKLM\..\RunServices: [Microsoft Update] AntiVirus.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Microsoft Update] AntiVirus.exe
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Your PC is infected with Spyware - click here to fix your PC - {FB74C951-ACA1-4e33-A94C-A9261EB2CCB7} - https://www.spydeleter.com/order2.php?KBID=1063 (file missing)
  • SpywareShooterSpywareShooter 127.0.0.1
    edited October 2004
    Have you rebooted since you posted that log? If you have, please post a new one. I need to give you precise removal instructions and rebooting will void them.
  • Paradox
    edited October 2004
    Logfile of HijackThis v1.98.2
    Scan saved at 3:32:56 AM, on 10/13/2004
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\AIM\aim.exe
    C:\WINDOWS\System32\AntiVirus.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Cacheman\Cacheman.exe
    C:\Program Files\Common Files\Symantec Shared\NMain.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\Justin Evans\My Documents\filelib\highjackthis\HijackThis.exe

    O4 - HKLM\..\Run: [Microsoft Update] AntiVirus.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\RunServices: [Microsoft Update] AntiVirus.exe
    O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
    O4 - HKCU\..\Run: [Microsoft Update] AntiVirus.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Your PC is infected with Spyware - click here to fix your PC - {FB74C951-ACA1-4e33-A94C-A9261EB2CCB7} - https://www.spydeleter.com/order2.php?KBID=1063 (file missing)

    This is the new log, someone rebooted my computer yesturday.. now my windows wont go in the toolbar and i cant open links.
  • SpywareShooterSpywareShooter 127.0.0.1
    edited October 2004
    O4 - HKLM\..\Run: [Microsoft Update] AntiVirus.exe
    O4 - HKLM\..\RunServices: [Microsoft Update] AntiVirus.exe
    O4 - HKCU\..\Run: [Microsoft Update] AntiVirus.exe
    O9 - Extra button: Your PC is infected with Spyware - click here to fix your PC - {FB74C951-ACA1-4e33-A94C-A9261EB2CCB7} - https://www.spydeleter.com/order2.php?KBID=1063 (file missing)

    Fix those entries then find and delete AntiVirus.exe, reboot and post a new log.
  • Paradox
    edited October 2004
    Ok i fixed those things, but the button came back and I can't find antivirus.exe anywhere on my comp. It still wont let me click certain things (like the search files and folders option) but i seared documents then checked search hidden files and folders so it did the whole search... i think. My windows still wont show up on the startbar.
  • Paradox
    edited October 2004
    .... ill just clear reboot my comp for the 5th time then.
  • DexterDexter Vancouver, BC Canada
    edited October 2004
    Did you find one of the known bad services as described in Step 4 of the Removal Guide?

    If not, please click here and follow the instructions in that post to run the program "Get Active Services." Run that, and when it opens a report in Notepad, copy the report of your active services, and post it here.

    Dexter...
Sign In or Register to comment.