CWS Search Assistant Removal

Comments

• Jess-

  August 2005 edited August 2005

  Bumping this up. Can anyone PLEASE help?

  0
• Dexter Vancouver, BC Canada

  August 2005 edited August 2005

  Sorry for the long delay in replying, the staff have been having trouble keeping up with the demand lately.
  
  I do not see any signs of HSA in your log, but there are a couple of items you can clean up. Are you having any specific problems or just wanting confirmation that the problem is gone?
  
  If you are not sure how to do some of the things I tell you, check the links I provide for instructions. You may want to print these instructions out for easy reference, or copy and paste to Notepad. Do not leave your browser open while performing these fixes.
  
  
  Set your system to Show Hidden Files and folders.
  
  For Windows XP or ME, Disable System Restore.
  
  
  
  PULL THE POWER PLUG ON YOUR COMPUTER. Do not use the Start menu or the front power switch to shut your computer down. This step is called a HARD BOOT, and prevents bad files from renaming themselves during a reboot or a soft-shutdown.
  
  Wait a few seconds, and plug the power cord back in. When it starts up, boot into Safe Mode.
  
  
  Make sure that all Internet Explorer or any other browser windows or internet applications are closed. Do not have any other unnecessary programs running.
  
  
  Run Hijack This. FIX THE FOLLOWING (place a checkmark beside the entries, and then press the Fix Checked button) :
  
  **************
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
  
  (These are just left over from the HSRemove program, and not needed any more.)
  
  
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing)
  
  O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
  
  O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing)
  
  
  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
  
  (If you are using a free version of Incredimail, it contains adware. Remove this entry and uninstall Incredimail from your system.)
  
  
  
  O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
  
  O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
  
  O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll (file missing)
  
  
  O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)[/QUOTE]
  
  (This is a legitimate program, but the file is missing, so we will remove the entry.)
  
  
  
  
  **************
  
  Exit HJT.
  
  
  Reboot normally, check things out, and come back to let us know how it turned out. Post a fresh HJT log for review. If things looks clean, re-enable your system restore and set a new restore point.
  
  Also, you really should upgrade to Windows XP Service Pack 2, and your Internet Explorer version is outdated. This shows that you are not doing regular Windows Updates.
  Please make sure to always do regular Windows Updates. If you do not have Automatic Updates active on your computer, then please click on www.windowsupdate.com, and follow the instructions. Always install all CRITICAL UPDATES.
  
  
  Please read our article on Defeating Spyware for tips on how to improve your Internet Explorer security, or to learn how to switch to a different browser. For more general information about spyware read this page.
  
  Please install some spyware protection. From our Security Downloads Page download and install Spyware Blaster, Spybot S&D and Spyware Shooter. All 3 contain protection measures to help protect you from spyware, especially useful if you choose to stay on Internet Explorer.
  
  Finally, if you have not already done so, please take the time to find out more about Folding For a Cure, a good cause by which your computer uses it's spare power to help search for cures to diseases. We would love to have you on our Team.
  
  Please post back and let us know if you need further help.
  
  Dexter...

  0
• Jess-

  August 2005 edited August 2005

  Thanks! I deleted all of those except Incredimail - will the adaware on that hurt my computer? I really enjoy that program.
  
  Here is my new log:
  
  Logfile of HijackThis v1.99.1
  Scan saved at 9:28:22 PM, on 8/24/2005
  Platform: Windows XP (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 (6.00.2600.0000)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\System32\RUNDLL32.EXE
  C:\WINDOWS\System32\RunDll32.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Spyware Doctor\swdoctor.exe
  C:\PROGRA~1\INCRED~1\bin\IMApp.exe
  c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
  C:\WINDOWS\System32\nvsvc32.exe
  C:\WINDOWS\System32\svchost.exe
  c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\WINDOWS\System32\wuauclt.exe
  C:\HJT\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
  O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
  O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll
  O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
  O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
  O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
  O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
  O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
  O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
  O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
  O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
  O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin\npjpi150_01.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1119151679147
  O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
  O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
  O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
  O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

  0
• SpywareShooter 127.0.0.1

  August 2005 edited August 2005

  Please read this article I wrote about what may be causing those entries to appear: http://spywareshooter.com/spybot.html

  0
• Jess-

  August 2005 edited August 2005

  That worked! Thanks! I wonder why it shows up when it's actually not there?
  
  Anyways, thank you a bunch!

  0
• Dexter Vancouver, BC Canada

  August 2005 edited August 2005

  Jess! wrote:

  Thanks! I deleted all of those except Incredimail - will the adaware on that hurt my computer? I really enjoy that program.

  
  It won't "hurt" your computer. It just collects some anonymous internet usage data, and reports it back to Incredimail. It is pretty tame as far as spyware goes. Your choice.
  
  I'll close this thread, if you have other questions about this topic, please PM me.
  
  Dexter...

  0