Spyware HELP!

Question

Hey' was hoping someone could help me with a problem i am having regarding Spyware...? Over the last week or so i have tried every spyware removal program tool available and they all pick up the problem, 'delete it' and apparently solve the problem. However this is not the case, and even after finishing the Dell Virus/Spyware removal guide lines, including the microsoft antispyware tools, shredders, CW shredder' etc etc, i still have the problem. Basically, when i perfrom a search on Google.com, the result is either one of 4 options. 1) Does not load... about 5 mins later i get URL not found... 2) Loads, but each time it does load, brings up the same 5 or 6 websites at the top of the search results from, HARDCORE PORN HERE, INSURANCE, FIRSTCLICK, DOUBLE CLICK... etc and then towards the bottom half of the screen a few of the results i actually would be interested in. 3) I get re-directed to what is set as my homepage ( http://www.bbc.co.uk), but loaded with errors, i.e. no pics shown or text missing. 4) Internet Explorer has encoutered a problem and must now close. The names of the spyware/viruses (mind you Norton Anti Virus 2005 hasnt found anything on my computer. Same goes with Trend Mico PC Cillin Virus checker.) are apparently 'tracker cookies' and 'hijackers' or something like this... and everytime i delete them they just keep coming back... and the same search results shown each time i search google. I have uninstalled any programs i did not recognise on my system... located any files or folders which are spyware, deleted them... and most of the time they return. Any solutions, help, even information would be of great help to me... this is extremerly annoying as i have only had my PC for around 3 months now. Here is also a list of the running processes on my computer: Spysub.exe iexplorer.exe alg.exe taskmgr.exe SymWSC.exe wdfmgr.exe symlcsvc.exe CCEVTMGR.EXE CCSETMGR.EXE explorer.ece msmsgs.exe gcasDtServ.exe hposol08.exe CCAPP.EXE hpgs2wnd.exe ptask.exe bcmwltry.exe Directcd.exe svchost.exe gcasServ.exe SAVSCAN.EXE svchost.exe svchost.exe nvsvc32.exe svchost.exe svchost.exe iexplorer.exe svchost.exe realsched.exe lsass.exe services.exe winlogon.exe csrss.exe smss.exe NAVAPSVC.EXE msmsgs.exe hpgs2wnf.exe spoolsv.exe System System Idle Process Best Reagrds, Stephen.

ky331 · Answer

First off, there is a difference between viruses and adware/spyware.... norton A/V and trend micro pc cillin a/v both focus on viruses, rather than on adware/spyware. so they may report your system as being clean of viruses... but it may still be (very) infected by adware/spyware.   secondly, tracking cookies are not necessarily bad.... most sites you go to (including your bank, for example) may place a 'cookie' on your machine... sometimes, this allows you to re-access the site without having to log-in again... which can be helpful.  so you WANT 'good' cookies.  the problem is that some cookies collect information from you at one site, but then share the information with other sites.    unfortunately, 'bad' cookies have a way of coming back, over and over again.   if you wish to permanently stop them: in Internet Explorer, click on TOOLS    INTERNET OPTIONS    PRIVACY    EDIT (web sites) and then type-in and BLOCK the 'bad' cookies you want to keep away (e.g., DOUBLECLICK.NET ) when done, click on OK Just be careful not to block any 'good' sites (like your bank/brokerage, or sites you intentionally log-into regularly, like Yahoo or HotMail).   By the way, I know this cookie-blocking feature is available on win98,  winME, and win2000... i'm not sure about other WIN operating systems.   Alternatively, you can download a program which can monitor cookies (among other things):  WinPatrol 9.0 http://winpatrol.com/     to check for adware/spyware, you need a different set of tools, such as:   Microsoft anti-spyware beta (Note:  will NOT run on win98 nor winME) http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en   spybot search and destroy 1.3 http://www.spybot.info/en/download/index.html  for the underlying 1.3 program.   Install it.  and THEN go to: http://majorgeeks.com/download4392.html  for the 1.3. 1TX DSO-Exploit patch   ad-aware SE 1.05, with the VX2 add-on http://www.lavasoftusa.com/   CWShredder 2.13 http://majorgeeks.com/download3019.html     and, when these don't completely do the job, HiJackThis 1.99.1, which should only be used in consultation with the experts in this forum http://majorgeeks.com/download3155.html   good luck Message Edited by ky331 on 02-28-2005 11:16 AM

Midnight Star · Answer

Stephen, Did you mean 'iexplore.exe' or what you posted earlier 'iexplorer.exe'? - Mike.

Steveos21 · Answer

It turns out it was actually, iexplore.exe   @   29,232k would this be my problem? Regards, Steve.

Midnight Star · Answer

Steveos, Post up a HiJackThis log for analysis, and i'll see if anything is there that shouldn't be. - Mike.

Steveos21 · Answer

Logfile of HijackThis v1.99.1 Scan saved at 15:41:19, on 05/03/2005 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\WINDOWS\system32\bcmwltry.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe C:\Program Files\interMute\SpySubtract\SpySub.exe C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe C:\WINDOWS\System32
vsvc32.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\ssmith\Desktop\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKLM\..\Run: [XpDis0Conf] C:\PROGRA~1\Belkin\BELKIN~1\Tool\WinXPDisableZeroConfigation.exe VEN_14E4&DEV_4320&SUBSYS_70011799 /d O4 - HKLM\..\Run: [XpOpenAuto] 'C:\Program Files\Belkin\Belkin 54Mbps Wireless Utility\TOOL\OpenXpAuto.exe' VEN_14E4&DEV_4320&SUBSYS_70011799 O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe O4 - HKLM\..\Run: [removecpl] RemoveCpl.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE 'REBOOT' O4 - HKLM\..\Run: [gcasServ] 'C:\Program Files\Microsoft AntiSpyware\gcasServ.exe' O4 - HKLM\..\Run: [WinPatrol] 'C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe' O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: SpySubtract.lnk = C:\Program Files\interMute\SpySubtract\SpySub.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS
ppdf32.dll O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409 O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by10fd.bay10.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: WLTRYSVC - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE (file missing) hope that means something to you guys! lol Steve

Midnight Star · Answer

Steve,

There's nothing in the log that is standing out, so let's move on to the next scan and see if it can pick anything up...

Download mwav.exe from MicroWorld, then:

1. Double-click the mwav.exe icon to run it ( it'll self extract).
2. Click " Scan".
3. When it completes, post back the results from the 'Virus log information' pane.

Mike.

Virus & Spyware

Was this post helpful?