Browser hijack, home search assistant program and missing shell.dll

Comments

• shwaip bluffin' with my muffin Icrontian

  July 2004 edited July 2004

  Hi!
  
  Please try about:buster here:
  
  http://www.majorgeeks.com/download4289.html
  
  Try running it twice, if it doesn't work the first time. If it stll doesn't work, post a new hijackthis log, and we'll take a look at it.

  0
• dch

  July 2004 edited July 2004

  Hi!
  
  Thanks a lot for your quick reply! I downloaded and ran about:buster a couple of times and IE now seems to be displaying the correct home page. However, the Home Search Assistent program still appears in the add/remove programs window and can't seem to be uninstalled and there is still the same problem with the shell.dll file. I did another HJT scan for which the log is below:
  
  Logfile of HijackThis v1.98.0
  Scan saved at 16:02:45, on 31/07/2004
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\WINDOWS\wanmpsvc.exe
  C:\WINDOWS\addkg32.exe
  C:\WINDOWS\System32\carpserv.exe
  C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  C:\PROGRA~1\NORTON~1\navapw32.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\Program Files\FBM Software\ZeroSpyware Lite\NetGuard Lite.exe
  C:\WINDOWS\system32\ntvdm.exe
  C:\Program Files\AOL 8.0\waol.exe
  C:\Program Files\AOL 8.0\shellmon.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\WINDOWS\system32\atloe32.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\hijackthis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/2Q00CPT/040C/bF8.asp
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=040c&s=search&ap=b204
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - Default URLSearchHook is missing
  O2 - BHO: (no name) - {054044FE-E0A6-6008-C7FF-18707D5058A2} - C:\WINDOWS\apiyk32.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [Watch] C:\PROGRA~1\Minitel\Watch.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
  O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
  O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
  O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
  O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [atloe32.exe] C:\WINDOWS\system32\atloe32.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
  O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKCU\..\Run: [NetGuard Lite] "C:\Program Files\FBM Software\ZeroSpyware Lite\NetGuard Lite.exe" -STARTUP
  O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: AOL 8.0 Icône AOL.lnk = C:\Program Files\AOL 8.0\aoltray.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
  O9 - Extra button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
  O9 - Extra 'Tools' menuitem: Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{3A15E907-A652-4F5A-8AAB-E3D54E9D7185}: NameServer = 205.188.146.146
  
  
  Are you able to suggest something else I could try?
  Thanks a lot for your time.
  Dch

  0
• shwaip bluffin' with my muffin Icrontian

  July 2004 edited July 2004

  Sure. Boot into safe mode and remove the following entries with hijackthis:

  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe
  R3 - Default URLSearchHook is missing
  O2 - BHO: (no name) - {054044FE-E0A6-6008-C7FF-18707D5058A2} - C:\WINDOWS\apiyk32.dll
  O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - HKLM\..\Run: [atloe32.exe] C:\WINDOWS\system32\atloe32.exe
  O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
  O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
  O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
  O9 - Extra button: Sites Perso - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)
  O9 - Extra 'Tools' menuitem: Compaq France - {06FE5D05-8F11-11d2-804F-00105A133818} - http://compaqnet.ifrance.com/heberg/accueil (file missing)

  
  to fix the shell.dll problem:

  Search for shell.dll in one of these three folders.
  -System32 folder
  -System folder
  -System32\dllcache folder.
  It should be in all 3, if not, copy it from one to the other

  
  to remove the add/remove programs entry:

  http://support.microsoft.com/default.aspx?kbid=247501
  or use Easy Cleaner and choose Add/Remove cleaner

  0
• dch

  July 2004 edited July 2004

  Hi
  
  Thanks for the advice. I booted in safe mode and removed the entries with hijackthis as you suggested.
  
  I then tried to remove the add/remove programs entry ("Home Search Assistent") but found another two suspicious ones in the registry ("Shopping Wizard" and "Search Extender" - both gave me the same error message when I tried to uninstall them). I deleted all 3 entries in the registry and when I checked on the add/remove programs list, they were no longer there!
  
  But...
  
  I just signed on again and, when I launched IE, I found that the homepage had been set to "res://sthpb.dll/index.html#37049" and that all 3 programs listed above were again on the add/remove program list... :banghead: Please help!!! I felt this was starting to make some sense to me but now I'm completely lost again!!!
  
  One thing also about the shell.dll file: I did a search and only found one in the System folder. I copied it into the System32 folder but couldn't find a System32\dllcache folder! Please tell me this is normal!!? Even after copying the file in the System32 folder, I tried launching a program requiring the file but I got the same error message ("Cannot find shell.dll").
  
  Any other suggestions?
  Dch

  0
• shwaip bluffin' with my muffin Icrontian

  July 2004 edited July 2004

  Type in the following for the location after you open my computer:
  %SystemRoot%/System32/dllcache/
  
  that should open up the folder. You will need to reboot after copying before windows will see the file you copied there.
  
  I am also curious...have you tried just using the add/remove programs function to remove the three items you're having trouble with. Could you try that, and then post a new log?

  w3rd.JPG 18K

  0
• dch

  July 2004 edited July 2004

  Hi, thanks for the tip. I did find the dllcache folder in the end and the shell.dll was there. I copied it into the system32 folder where it was missing (it already was in the system folder) and rebooted. However, I had the same problem trying to open a program ("Cannot find shell.dll"). When I looked in the system32 folder again, shell.dll was no longer there...
  
  One more thing re the shell.dll file: I downloaded one from the Internet and found that its size is different (and much larger) than the one I have (124kb vs. 5kb). Does it matter which one I use? Could it be that one is corrupt?
  
  I tried using the add/remove program function to remove the 3 items but when I press delete, I get the error message: "Cannot open "http://looking-for.cc/uninstall/HomeSearchAssistant.html" or "...SearchExtender" or "...ShoppingWizard".
  
  Any suggestions would be much appreciated!
  
  Here's another log as requested:
  
  Logfile of HijackThis v1.98.0
  Scan saved at 01:15:52, on 01/08/2004
  Platform: Windows XP SP1 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\system32\HPConfig.exe
  C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\WINDOWS\wanmpsvc.exe
  C:\WINDOWS\addkg32.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\carpserv.exe
  C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  C:\PROGRA~1\NORTON~1\navapw32.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  C:\Program Files\Real\RealPlayer\RealPlay.exe
  C:\WINDOWS\system32\atloe32.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\FBM Software\ZeroSpyware Lite\NetGuard Lite.exe
  C:\WINDOWS\system32\ntvdm.exe
  C:\Program Files\AOL 8.0\waol.exe
  C:\Program Files\AOL 8.0\shellmon.exe
  C:\hijackthis\HijackThis.exe
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/2Q00CPT/040C/bF8.asp
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\sthpb.dll/sp.html#37049
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://sthpb.dll/index.html#37049
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://sthpb.dll/index.html#37049
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\sthpb.dll/sp.html#37049
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.presario.net/scripts/redirectors/presario/srchredir2.dll?c=1c02&lc=040c&s=search&ap=b204
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\sthpb.dll/sp.html#37049
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://sthpb.dll/index.html#37049
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - Default URLSearchHook is missing
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
  O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O2 - BHO: (no name) - {D53C9B47-4C61-5E63-5486-F572BE0C0090} - C:\WINDOWS\appva.dll
  O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
  O4 - HKLM\..\Run: [CARPService] carpserv.exe
  O4 - HKLM\..\Run: [Watch] C:\PROGRA~1\Minitel\Watch.exe
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [PreloadApp] c:\hp\drivers\printers\photosmart\hphprld.exe c:\hp\drivers\printers\photosmart\setup.exe -d
  O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
  O4 - HKLM\..\Run: [Display Settings] C:\Program Files\HPQ\Notebook Utilities\hptasks.exe /s
  O4 - HKLM\..\Run: [QT4HPOT] C:\PROGRA~1\HPQ\ONE-TO~1\OneTouch.EXE
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
  O4 - HKLM\..\Run: [iPodManager] C:\Program Files\iPod\bin\iPodManager.exe
  O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
  O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
  O4 - HKLM\..\Run: [atloe32.exe] C:\WINDOWS\system32\atloe32.exe
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\Symantec\LIVEUP~1\SNDMon.EXE
  O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
  O4 - HKCU\..\Run: [NetGuard Lite] "C:\Program Files\FBM Software\ZeroSpyware Lite\NetGuard Lite.exe" -STARTUP
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: AOL 8.0 Icône AOL.lnk = C:\Program Files\AOL 8.0\aoltray.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
  O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
  
  Thanks!
  Dch

  0