browser hijack and spyware

Question

Logfile of HijackThis v1.97.7Scan saved at 11:14:38 PM, on 8/7/2004Platform: Windows XP  (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\drivers\Digigram\Mixer\DigiWMix.exeC:\WINDOWS\System32\w32sup.exeC:\WINDOWS\jushed32.exeC:\PROGRA~1\PicoZip\PicoZipTray.exeC:\Program Files\AIM95\aim.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Spyware\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://thenewsearch.com/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.searchweb.cc/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://thenewsearch.com/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://thenewsearch.com/search.htmlR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://thenewsearch.com/thenewsearch.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://thenewsearch.com/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://thenewsearch.com/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://thenewsearch.com/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://thenewsearch.com/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.searchweb.cc/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://thenewsearch.com/thenewsearch.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://thenewsearch.com/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://thenewsearch.com/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://thenewsearch.com/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://thenewsearch.com/search.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://thenewsearch.com/search.htmlR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://web-g.kontiki.com/zodiac/servlet/zodiac?template=secure,Uninstall.vm&node=8CEJqhd0i88XK3HeIsZmzH9B8%2fCqI1lTG14Y7PZAh8WycXq67n8ySpCVas8HuVgB&version=2.10.30418.1R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://thenewsearch.com/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://thenewsearch.com/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\PROGRA~1\Toolbar	oolbar.dll/saR3 - URLSearchHook: (no name) - {FDE3577A-6254-181C-4E11-339E4F746BD3} - (no file)O1 - Hosts file is located at: C:\WINDOWS
sdb\hostsO1 - Hosts: 81.211.105.69 lender-search.comO1 - Hosts: 81.211.105.68 hot-searches.comO1 - Hosts: 69.50.173.250 auto.search.msn.comO1 - Hosts: 69.50.173.250 auto.search.msn.comO2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dllO3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [DigiWMix] C:\WINDOWS\system32\drivers\Digigram\Mixer\DigiWMix.exe /hideO4 - HKLM\..\Run: [w32sup] C:\WINDOWS\System32\w32sup.exeO4 - HKLM\..\Run: [winupd] C:\WINDOWS\System32\winupd.exeO4 - HKCU\..\Run: [PicoZip] C:\PROGRA~1\PicoZip\PicoZipTray.exeO4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odlO9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: AIM (HKLM)O9 - Extra button: Related (HKLM)O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)O9 - Extra button: Real.com (HKLM)O9 - Extra button: MoneySide (HKLM)O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38188.8085300926O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll

jwatt · Answer

daggermickjagger,

You may wish to register at TomCoyote.org and post your log in the Virus and Trojan Removals board at TomCoyote.org for review by certified volunteer experts. Be sure describe the problem you're experiencing.

Other forums specializing in assisting with spyware/malware problems:

SpywareInfo.com
Net-Integration.net

See this post by ChrisRLG for more information.

Jim

msgale · Answer

Looking at your post it appears you have not applied SP1 or SP1a, you have no virus checking software running, and I can only guess that you may not have loaded any security/critical updates.  Also the current version of Hijack this is 1.98.2 not 1.97.7

cghost · Answer

http://www.russelltexas.com/malware/cwsinfection.htm Try texruss's instructions in the link above.

Virus & Spyware

browser hijack and spyware

Was this post helpful?