Options

mysearchnow.com toolbar

Unknown
edited October 2004 in Spyware & Virus Removal
hello guys.
hi i've been having this problem of having the mysearchnow.com toolbar appearing on my browser each and everytime i open it.
i've done everything from CWSshredder, SpySweeper to remove Lop, HijackThis and Spybot Search And Destroy. I still didn't manage to get the toolbar removed and its buggin the hell out of me. i've read previous threads about this problem and tried to follow through, but it seems as though i just can't remove it. anyways heres the hijackthis log;

Logfile of HijackThis v1.97.7
Scan saved at 8:47:13 AM, on 10/24/2004
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\RunDll32.exe
C:\WINNT\loadqm.exe
C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-sg\msnappau.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iRiver\iRiver Manager\Updater\Updater.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINNT\System32\LXSUPMON.EXE
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\Program Files\WinZip\WZQKPICK.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.122\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.itrpzyegjufndvpbegxfmo.com/AQW1PCnzbrdHg_OsVO9WYSxykoaLo3L0OG0BVXLt9vwFQUEQ2P9QIAXvOzKjoW8w.html
O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-sg\msnappau.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [iRiver Updater] C:\Program Files\iRiver\iRiver Manager\Updater\Updater.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LXSUPMON] C:\WINNT\System32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [JUNKACID] C:\DOCUME~1\ADMINI~1\APPLIC~1\GLOBAL~1\SUPPORT PLAY POKE.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)


I hope you guys could help me through this.

Azman. :(

Comments

  • sentenced
    edited October 2004
    anyone ? pls help :rolleyes:
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    W2K needs to have SP4 installed. You should upgrade immediately to IE6 and install service packs.
    Hijackthis is out of date. You can update within the program or download the latest version (1.98.2) from this site.
    You are running hijackthis from a temporary folder. A bad thing. Create a new folder anywhere of your choice (except in a temp folder) :) and drag and drop hijackthis.exe into it and run it from there.
    Uninstall Messenger Plus as it comes bundles with LOP. You can reinstall it without the sponsor.

    First of all could you click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', 'Lop.com', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run this uninstaller:
    http://members.rogers.com/rjmac/new_uninstall.exe

    Once done, reboot and post another log from the new hijackthis version, running in a permanent folder :).
  • sentenced
    edited October 2004
    i've done updating the IE to IE 6 and installed in service pack 1. I've removed my MSN PLUS 3. anyways here's the log; saved in another folder

    Logfile of HijackThis v1.97.7
    Scan saved at 8:07:32 PM, on 10/24/2004
    Platform: Windows 2000 (WinNT 5.00.2195)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\csrss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\system32\svchost.exe
    C:\WINNT\system32\LEXBCES.EXE
    C:\WINNT\system32\spoolsv.exe
    C:\WINNT\system32\LEXPPS.EXE
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\regsvc.exe
    C:\WINNT\system32\MSTask.exe
    C:\WINNT\System32\WBEM\WinMgmt.exe
    C:\WINNT\Explorer.exe
    C:\WINNT\System32\RunDll32.exe
    C:\WINNT\loadqm.exe
    C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-sg\msnappau.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\iRiver\iRiver Manager\Updater\Updater.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    c:\progra~1\intern~1\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Documents and Settings\Administrator\Desktop\New Folder\HijackThis.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dfgerxtuftbwx.com/AQW1PCnzbrdHg_OsVO9WYSxykoaLo3L0OG0BVXLt9vwQrEHVie_VSgXvOzKjoW8w.html
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [SiS KHooker] C:\WINNT\System32\khooker.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [LoadQM] loadqm.exe
    O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.0002.1001\zh-sg\msnappau.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [iRiver Updater] C:\Program Files\iRiver\iRiver Manager\Updater\Updater.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [LXSUPMON] C:\WINNT\System32\LXSUPMON.EXE RUN
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKCU\..\Run: [JUNKACID] C:\DOCUME~1\ADMINI~1\APPLIC~1\GLOBAL~1\SUPPORT PLAY POKE.exe
    O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O9 - Extra button: Related (HKLM)
    O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38284.2002199074
  • CrunchieCrunchie Mandurah. Western Australia. Member
    edited October 2004
    You been busy :). Did you run the uninstaller, or were there any entries I mentioned in add\remove?

    Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.dfgerxtuftbwx.com/AQW1PC...XvOzKjoW8w.html

    4 - HKCU\..\Run: [JUNKACID] C:\DOCUME~1\ADMINI~1\APPLIC~1\GLOBAL~1\SUPPORT PLAY POKE.exe

    When you next boot up, do so in safe mode, have all hidden files\folders set to show and delete;

    C:\DOCUME~1\ADMINI~1\APPLIC~1\GLOBAL~1< folder

    Then boot normally and post another log and let us know how things are.
    Those two entries above are LOP.

    EDIT. You are still running the outdated version of hijackthis too :).
Sign In or Register to comment.