I've been hijacked..Please help

Which version of cwshredder are you using rescan with the lastest cwshredder http://www.spywareinfo.com/~merijn/downloads.html

How to guard against CoolWebSearch

http://www.spywareinfo.com/~merijn/cwschronicles.html
http://www.mvps.org/sramesh2k/Defend_CWS.htm
http://www.mvps.org/inetexplorer/data/coolwebsearch.htm

I would suggest keeping another browser handy(and cant be hijacked so easily) so you aint stuck if "IE" goes down

get opera www.opera.com

http://www.mozilla.org/products/firefox/

Resetting Internet Explorer Web settings
If you installed another Web browser after installing Internet Explorer

and Internet Tools, some of your Internet Explorer settings may have

changed. You can reset your Internet Explorer settings to their

original defaults, including your home page and search pages, and

choice of default browser, without changing your other browser's

settings.

On the Tools menu, click Internet Options.
Click the Programs tab.
Click the Reset Web Settings button.

How to Reset the Internet Explorer 6.0 Security Settings and Verify the Encryption Settings
http://support.earthlink.net/mu/1/psc/img/walkthroughs/windows_9x_nt/browsers/ie_6.0/8455.psc.html

tigger5,

There are two malicious .dll files on you computer. One is visible and can be easily deleted. The other is HIDDEN. The hidden .dll regenerates the viewable .dll if it is deleted or changed. The hidden file is the problem.

To rid your self of the hidden .dll, which is the core of the problem, do the following.

Download two free programs and install them.

1. Taskinfo

2. CWSShredder

http://www.iarsn.com/taskinfo.html (trial version works for this)

http://www.spywareinfo.com/~merijn/downloads.html

Open Internet Explorer with the about:blank page.

Then open taskinfo program.

Look for “Internet Explorer” on the left side and highlight it.

On the right side, open the “Modules” tab.

You will see a list of .dll files.

Sort the files by Company.

You should see a few .dll files that don't belong to any company or don’t have any description. In the list should be both the malicious secondary .dll (you may not have this one if you just ran cwshredder to remove it) that is generated by the malicious core .dll AND the malicious core dll. Again, they should not have any legitimate company name or description.

Copy the file names down for your reply.

Run CWSShredder. It will delete the secondary .dll that is generated by the hidden core .dll and all associated registry entries.

Post back with the name of the suspect files from Taskinfo and the path. 

After posting, Please install the recovery console for your PC.  Instructions follow:

If you have your windows cd put it in the cd drive and go to start/run paste this on the line:

d:\i386\winnt32.exe /cmdcons

change d if necessary to your cd rom drive.

If you only have recovery cds from your computer manufacturer, then search for winnt32.exe on your system.

Then write down the path that you find in the search results.

Example If you find the winnt32.exe file in this location -> C:\WINDOWS\I386\WINNT32.EXE

Then you go to start/run and paste this line C:\WINDOWS\I386\WINNT32.EXE /cmdcons in the run box and click OK to start the install

In either case Walk through that and that will install the recovery console.

Thereafter, you'll see an option for the RC on the startup menu.

Instructions if needed are here: http://www.winnetmag.com/Windows/Article/A...1538/21538.html

I will review the information that you posted and have further instructions for you.

After you have posted back with that info I will give you some further instructions.

Thanks Yellowhammer.  I will try this tonite.  I had trouble accessing this forum from my troubled compter, I think it had to do with the virus.  I will try your suggestions tonight and post my results.  Thanks for your time!

i downloaded taskinfo.  found IE on left bottom side and highlighted, there was no "module"tab on right side. opened "driver" tab and found the following dll files:

bootvid.dll

hal.dll

ialmdd5.dll

ialmdev5.dll

ialmdnt5.dll

ialmrnt5.dll

ntdll.dll

KDCOM.dll

Is this correct?

Lets try another method of identifying the file.

Go here and download Find-All.zip
http://www10.brinkster.com/expl0iter/freeatlast/pvtool.htm
Extract it.
Double click on Find-All.bat. It will produce a file named output.txt.

Copy and paste the contents of output.txt in your next reply.

After Posting that reply please do the following: (Note that you may have done this part already from the previous instructions)

Install the recovery console for your PC.  Instructions follow:

If you have your windows cd put it in the cd drive and go to start/run paste this on the line:

d:\i386\winnt32.exe /cmdcons change d if necessary to your cd rom drive.

If you only have recovery cds from your computer manufacturer, then search for winnt32.exe on your system.

Then write down the path that you find in the search results.

Example If you find the winnt32.exe file in this location -> C:\WINDOWS\I386\WINNT32.EXE

Then you go to start/run and paste this line C:\WINDOWS\I386\WINNT32.EXE /cmdcons in the run box and click OK to start the install

The important thing is to find the location of the Winnt32.exe file on your system so you put the correct command in the run box.

In either case it will install the recovery console.

Thereafter, you'll see an option for the RC on the startup menu.

Instructions if needed are here: http://www.winnetmag.com/Windows/Article/A...1538/21538.html

After I have seen the results of the output.txt file I will give you further directions.  You will be deleting the hidden file using the recovery console (I hope)

Use the windows operating system cd.

Next question, should I use the Dell Drivers and Utilities resource CD or the WindowsXP Operating system CD?  I don't have a Recovery CD per se.

Copy the contents between the lines to Notepad. Name the file fix.reg
Save as type All Files. Save on the desktop.

-----------------------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

 ----------------------------------------------------------------------------------

After you have The Recovery Console installed, Reboot. You will get a menu. Choose Recovery Console. To do that use the arrow keys to move through the menu and when Recovery Console is highlighted, press enter. You'll be asked which Install you want to repair. Select your Windows XP. You will be asked for a password. Press enter if you didn't set up an Administrator Password when you installed. That will get you in.

If you did set up a password type it in and press enter.

Once the Recovery Console has loaded you are going to delete one file.

Here are those directions:

Type this and press enter: attrib -s -h -r C:\WINDOWS\System32\RESCBFJ.DLL  Note that there is a space between each command until you reach the path name.

Type this and press enter: Del C:\WINDOWS\System32\RESCBFJ.DLL Note that there is a space between DEL and the Pathname.

Let it do the delete.

Type Exit to restart.
---------------------------------

When you get back into Windows
Double click on fix.reg to remove extra registry entries.
Run CWShredder and Ad-Aware.

Run HijackThs and post you new log here in your next reply.

Also run Double click on Find-All.bat again. See if there is a mention of a file error again. If not you are in good shape.

 

Here is the output.txt file:

Possible bad file(s) found... (locked)
\\?\C:\WINDOWS\System32\RESCBFJ.DLL +++ File read error
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{227B8AA8-DAF2-4892-BD1D-73F568BCB24E}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

REGEDIT4

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter]

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/hta]
"CLSID"="{D962EF38-5FB0-4761-8638-C86F085E25E6}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/octet-stream]
"CLSID"="{6585E5B4-4D2A-4A1D-A219-4102C64BA999}"
"CLSID_"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/x-complus]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\application/x-msdownload]
"CLSID"="{1E66F26B-79EE-11D2-8710-00C04F79ED0D}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\Class Install Handler]
@="AP Class Install Handler filter"
"CLSID"="{32B533BB-EDAE-11d0-BD5A-00AA00B92AF1}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\deflate]
@="AP Deflate Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\gzip]
@="AP GZIP Encoding/Decoding Filter "
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\lzdhtml]
@="AP lzdhtml encoding/decoding Filter"
"CLSID"="{8f6b0360-b80d-11d0-a9b3-006097942311}"

[HKEY_CLASSES_ROOT\PROTOCOLS\Filter\text/webviewhtml]
@="WebView MIME Filter"
"CLSID"="{733AC4CB-F1A4-11d0-B951-00A0C90312E1}"

 

I will do this tonite when I get home from work.  Since I have not inserted the Windows operating CD yet, Do I still need to do this step from yesterday's post:

Install the recovery console for your PC.  Instructions follow:

If you have your windows cd put it in the cd drive and go to start/run paste this on the line:

d:\i386\winnt32.exe /cmdcons change d if necessary to your cd rom drive.

If you only have recovery cds from your computer manufacturer, then search for winnt32.exe on your system.

Then write down the path that you find in the search results.

Example If you find the winnt32.exe file in this location -> C:\WINDOWS\I386\WINNT32.EXE

Then you go to start/run and paste this line C:\WINDOWS\I386\WINNT32.EXE /cmdcons in the run box and click OK to start the install

The important thing is to find the location of the Winnt32.exe file on your system so you put the correct command in the run box.

In either case it will install the recovery console.

Thereafter, you'll see an option for the RC on the startup menu.

Instructions if needed are here: http://www.winnetmag.com/Windows/Article/A...1538/21538.html

After I have seen the results of the output.txt file I will give you further directions.  You will be deleting the hidden file using the recovery console (I hope)

Or should I skip this and go to your latest instructions?  Also, the link you provided at winnetmag is no longer active, is there anywhere else I can preview instructions before I start this?  Sorry to be tentative, but I am not an expert by any means.  Once again, I do appreciate your help and patience with me on this!

Once you have finished installing the recovery console you can do my last set of instructions.
I am repeating them again below.

Copy the contents between the lines to Notepad. Name the file fix.reg
Save as type All Files. Save on the desktop.

-----------------------------------------------------------------------

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

 ----------------------------------------------------------------------------------

After you have The Recovery Console installed, Reboot. You will get a menu. Choose Recovery Console. To do that use the arrow keys to move through the menu and when Recovery Console is highlighted, press enter. You'll be asked which Install you want to repair. Select your Windows XP. You will be asked for a password. Press enter if you didn't set up an Administrator Password when you installed. That will get you in.

If you did set up a password type it in and press enter.

Once the Recovery Console has loaded you are going to delete one file.

Here are those directions:

Type this and press enter: attrib -s -h -r C:\WINDOWS\System32\RESCBFJ.DLL  Note that there is a space between each command until you reach the path name.

Type this and press enter: Del C:\WINDOWS\System32\RESCBFJ.DLL Note that there is a space between DEL and the Pathname.

Let it do the delete.

Type Exit to restart.
---------------------------------

When you get back into Windows
Double click on fix.reg to remove extra registry entries.
Run CWShredder and Ad-Aware.

Run HijackThs and post you new log here in your next reply.

Also run Double click on Find-All.bat again. See if there is a mention of a file error again. If not you are in good shape.

Lets get the attributes one at a time:

Type this and press enter: attrib -s C:\WINDOWS\System32\RESCBFJ.DLL  Note that there is a space between each command until you reach the path name.

Type this and press enter: attrib -r C:\WINDOWS\System32\RESCBFJ.DLL  Note that there is a space between each command until you reach the path name.

Type this and press enter: attrib -h C:\WINDOWS\System32\RESCBFJ.DLL  Note that there is a space between each command until you reach the path name.

Type this and press enter: Del C:\WINDOWS\System32\RESCBFJ.DLL Note that there is a space between DEL and the Pathname.

Let it do the delete.

Ok, installed the RC, rebooted, got the RC menu immediately on reboot. Chose option1 for windows, pressed enter to pass admin, then got the c>windows prompt. I typed the script as written both with and without a space to start the script, and either way was denied for an invalid script. What did I do wrong here? Frustrating as I feel we are close to solving this thing!

Thanks, will try this again tonite.  Sorry about late postings, but this seems to restrct my access to this forum.  Will try again and post tonite, thanks.

It looks clean except for this one.  I am hoping it is only a remnant.

Close your browser and have hijackthis fix the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

Open and close your browser a couple of times and run another hijackthis log.  Hopefully it won't return.

Please let me know.