NEW VARIANT? Can't detect?

Question

Got huge problem with my 2 month old Dimension 4600.  Tired many spyware program but still I have the same problem.  Even the provider of spyware I bought say its a new variant, but Why did I bought this software for, if it won't work? Can't go to internet, my systems shuts down (only when I'm online) from RPC.  Lot's of Website shortcut on my desktop.. :-( Please anyone, take a look at my hijackthis log.  HELP ME PLEASE!! Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exec:\PROGRA~1\mcafee.com\vso\mcvsrte.exeC:\WINDOWS\System32\explored.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\Explorer.EXEc:\PROGRA~1\mcafee.com\vso\mcshield.exeC:\WINDOWS\System32\hkcmd.exeC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\system32\dla	fswctrl.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\PROGRA~1\mcafee.com\agent\McUpdate.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\PROGRA~1\mcafee.com\vso\mcvsshld.exeC:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXEC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exec:\progra~1\mcafee.com\vso\mcvsescn.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\Program Files\QuickTime\qttask.exeC:\windows\msbb.exeC:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exeC:\WINDOWS\wdskctl.exeC:\WINDOWS\dl.exeC:\WINDOWS\dlm.exeC:\WINDOWS\system32\config\services.exeC:\Program Files\Aluria Software\EPS\eps.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\WINDOWS\svchost.exeC:\Program Files\Microsoft Money\System\mnyexpr.exeC:\Program Files\AOL 9.0\aoltray.exeC:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exeC:\Program Files\Aluria Software\ASE\ASE Scheduler.exeC:\Software Download\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://freednshost.info/page/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://freednshost.info/page/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://freednshost.info/page/R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://freednshost.infoR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freednshost.infoR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://freednshost.info/page/R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://213.159.118.226/sp.phpR1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://213.159.118.226/sp.phpR1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://freednshost.info/page/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://freednshost.infoR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://freednshost.info/page/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://freednshost.info/page/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://freednshost.infoR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://freednshost.info/page/R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://213.159.118.226/sp.phpO1 - Hosts: 213.159.118.226 1-se.comO1 - Hosts: 213.159.118.226 58q.comO1 - Hosts: 213.159.118.226 aifind.ccO1 - Hosts: 213.159.118.226 aifind.infoO1 - Hosts: 213.159.118.226 allneedsearch.comO1 - Hosts: 213.159.118.226 approvedlinks.comO1 - Hosts: 213.159.118.226 auto.ie.searchforge.comO1 - Hosts: 213.159.118.226 awebfind.bizO1 - Hosts: 213.159.118.226 best.royalsearch.netO1 - Hosts: 213.159.118.226 cracks.amO1 - Hosts: 213.159.118.226 default-homepage-network.comO1 - Hosts: 213.159.118.226 find.microgirls.comO1 - Hosts: 213.159.118.226 find4u.netO1 - Hosts: 213.159.118.226 freshvideogals.comO1 - Hosts: 213.159.118.226 i-lookup.comO1 - Hosts: 213.159.118.226 ie-search.comO1 - Hosts: 213.159.118.226 in.webcounter.ccO1 - Hosts: 213.159.118.226 itseasy.usO1 - Hosts: 213.159.118.226 just.find-itnow.comO1 - Hosts: 213.159.118.226 link.startmake.comO1 - Hosts: 213.159.118.226 mysearchnow.comO1 - Hosts: 213.159.118.226 nativehardcore.comO1 - Hosts: 213.159.118.226 qwertysearch123.bizO1 - Hosts: 213.159.118.226 search.ieplugin.comO1 - Hosts: 213.159.118.226 search.psn.cnO1 - Hosts: 213.159.118.226 searchbar.findthewebsiteyouneed.comO1 - Hosts: 213.159.118.226 searchcentrix.comO1 - Hosts: 213.159.118.226 searchmyrequest.comO1 - Hosts: 213.159.118.226 super-spider.comO1 - Hosts: 213.159.118.226 t.rack.ccO1 - Hosts: 213.159.118.226 teen-biz.comO1 - Hosts: 213.159.118.226 teenhqpics.comO1 - Hosts: 213.159.118.226 t its.hardcore4ever.netO1 - Hosts: 213.159.118.226 webcoolsearch.comO1 - Hosts: 213.159.118.226 wmmse.comO1 - Hosts: 213.159.118.226 www.008i.comO1 - Hosts: 213.159.118.226 www.2fastsearch.netO1 - Hosts: 213.159.118.226 www.8095.comO1 - Hosts: 213.159.118.226 www.alfa-search.comO1 - Hosts: 213.159.118.226 www.boredlife.comO1 - Hosts: 213.159.118.226 www.couldnotfind.comO1 - Hosts: 213.159.118.226 www.cracks.amO1 - Hosts: 213.159.118.226 www.daum.netO1 - Hosts: 213.159.118.226 www.dreamwiz.comO1 - Hosts: 213.159.118.226 www.find-itnow.comO1 - Hosts: 213.159.118.226 www.find-itnow.comO1 - Hosts: 213.159.118.226 www.find4u.netO1 - Hosts: 213.159.118.226 www.firstbookmark.comO1 - Hosts: 213.159.118.226 www.gajai.comO1 - Hosts: 213.159.118.226 www.hand-book.comO1 - Hosts: 213.159.118.226 www.hao123.comO1 - Hosts: 213.159.118.226 www.hotsearchbox.comO1 - Hosts: 213.159.118.226 www.hotwebsearch.comO1 - Hosts: 213.159.118.226 www.hugesearch.netO1 - Hosts: 213.159.118.226 www.iquicksearch.comO1 - Hosts: 213.159.118.226 www.lookfor.ccO1 - Hosts: 213.159.118.226 www.maxxxhosters.comO1 - Hosts: 213.159.118.226 www.naver.comO1 - Hosts: 213.159.118.226 www.nkvd.usO1 - Hosts: 213.159.118.226 www.novaf u c k.comO1 - Hosts: 213.159.118.226 www.ohcorea.comO1 - Hosts: 213.159.118.226 www.omega-search.comO1 - Hosts: 213.159.118.226 www.onet.plO1 - Hosts: 213.159.118.226 www.power-search.infoO1 - Hosts: 213.159.118.226 www.rightfinder.netO1 - Hosts: 213.159.118.226 www.search-1.netO1 - Hosts: 213.159.118.226 www.search-and-go.comO1 - Hosts: 213.159.118.226 www.search-dot.comO1 - Hosts: 213.159.118.226 www.search-space.comO1 - Hosts: 213.159.118.226 www.searchforge.comO1 - Hosts: 213.159.118.226 www.searching-the-net.comO1 - Hosts: 213.159.118.226 www.searchv.comO1 - Hosts: 213.159.118.226 www.searchxl.comO1 - Hosts: 213.159.118.226 www.seznam.czO1 - Hosts: 213.159.118.226 www.slotch.comO1 - Hosts: 213.159.118.226 www.spidersearch.comO1 - Hosts: 213.159.118.226 www.startium.comO1 - Hosts: 213.159.118.226 www.therealsearch.comO1 - Hosts: 213.159.118.226 www.ttjj.comO1 - Hosts: 213.159.118.226 www.viewpornkey.comO1 - Hosts: 213.159.118.226 www.wazzupnet.comO1 - Hosts: 213.159.118.226 www.websearch.comO1 - Hosts: 213.159.118.226 www.windowws.ccO1 - Hosts: 213.159.118.226 www.xgmm.comO1 - Hosts: 213.159.118.226 xwebsearch.bizO1 - Hosts: 213.159.118.226 yourbookmarks.wsO2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dllO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dllO2 - BHO: Support Software - {85A702BA-EA8F-4B83-AA07-07A5186ACD7E} - C:\Program Files\Support Software\SS2.DLLO2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dllO3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dllO3 - Toolbar: (no name) - {69135BDE-5FDC-4B61-98AA-82AD2091BCCC} - (no file)O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exeO4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktaskO4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exeO4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exeO4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exeO4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe'O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXEO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exeO4 - HKLM\..\Run: [msbb] c:\windows\msbb.exeO4 - HKLM\..\Run: [wdskctl] C:\WINDOWS\wdskctl.exeO4 - HKLM\..\Run: [lqvmlix] C:\WINDOWS\lqvmlix.exeO4 - HKLM\..\Run: [tcvenuz] C:\WINDOWS	cvenuz.exeO4 - HKLM\..\Run: [Dial32] C:\WINDOWS\dl.exeO4 - HKLM\..\Run: [Dial33] C:\WINDOWS\dlm.exeO4 - HKLM\..\Run: [Services Process] C:\WINDOWS\system32\config\services.exeO4 - HKLM\..\Run: [Windows Login] explored.exeO4 - HKLM\..\Run: [vurmz] C:\WINDOWS\vurmz.exeO4 - HKLM\..\Run: [Aluria's Pop-Up Stopper] C:\Program Files\Aluria Software\EPS\eps.exeO4 - HKLM\..\Run: [hux] C:\WINDOWS\hux.exeO4 - HKLM\..\Run: [dyf] C:\WINDOWS\dyf.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [Network Service] C:\WINDOWS\svchost.exe -sr -0O4 - HKLM\..\RunServices: [Windows Login] explored.exeO4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quietO4 - HKCU\..\Run: [MoneyAgent] 'C:\Program Files\Microsoft Money\System\mnyexpr.exe'O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [Network Service] C:\WINDOWS\svchost.exe -sr -0O4 - Startup: ASE Scheduler.lnk = C:\Program Files\Aluria Software\ASE\ASE Scheduler.exeO4 - Startup: PowerReg Scheduler V3.exeO4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: Debt Solutions - http://213.159.118.226/tools.php?qq=Debt+SolutionsO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000O8 - Extra context menu item: Party Poker - http://213.159.118.226/tools.php?qq=Party+PokerO8 - Extra context menu item: Party Poker.com - http://213.159.118.226/tools.php?qq=Party+Poker.comO8 - Extra context menu item: Sell Future Payment - http://213.159.118.226/tools.php?qq=Sell+Future+PaymentO8 - Extra context menu item: Time Clock - http://213.159.118.226/tools.php?qq=Time+ClockO8 - Extra context menu item: Tramadol - http://213.159.118.226/tools.php?qq=TramadolO8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htmO8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htmO9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra 'Tools' menuitem: Time Clock (HKLM)O9 - Extra 'Tools' menuitem: Tramadol (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)O9 - Extra button: Real.com (HKLM)O9 - Extra 'Tools' menuitem: Sell Future Payment (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O13 - DefaultPrefix: http://freednshost.info/page/O13 - WWW Prefix: http://freednshost.info/page/O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.comO14 - IERESET.INF: MS_START_PAGE_URL=http://www.yahoo.comO16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cabO16 - DPF: {11111111-1111-1111-1111-111111111123} - ms-its:mhtml:file://C:\ss.MHT!http://little-flowers-p ussy.com/ebook.chm::/loader.exeO16 - DPF: {11111111-1111-1111-1111-111111111147} - file://C:\Program Files\Internet Explorer\2516.exeO16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:
osuch.mht!http://hard-virgins.com/dl/vlad/x.chm::/load.exeO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cabO16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CABO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,76/mcinsctl.cabO16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dllO16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,16/mcgdmgr.cabO16 - DPF: {E2F2B9D0-96B9-4B25-B90C-636ECB207D18} - http://www.whenusearch.com/WUInstSEWC.cabO19 - User stylesheet: C:\WINDOWS\system32\c0020n1q.7da

PGPhantom · Answer

Can you please download the following two applications:
- Ad-Aware: http://www.bleepingcomputer.com/forums/index.php?showtutorial=48
- CoolWebSearch Shredder from: http://www.spywareinfo.com/~merijn/files/CWShredder.exe

Boot into safe mode as per these instructions:
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam

Run CoolWebSearch Shredder in safe mode and be sure to select "Fix".

Reboot, sign on and run ad-aware.

After completed, reboot one last time and repost a new HijackThis log into this post.

mapro · Answer

Thanks for the instruction, my PC working good now.  Thank you again.

Virus & Spyware

NEW VARIANT? Can't detect?

Was this post helpful?