coolWWWsearch problem

frustrated · November 7, 2005

Logfile of HijackThis v1.99.1

Scan saved at 12:28:43 AM, on 11/7/2005

Platform: Windows XP (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

I happened to stumble onto the coolWWWsearch hijacker today and was wondering if anyone here had any helpful advice. I've tried all the usual methods, such as spybot s&d, ewido, cwshredder, but none fix the problem. Please help!

Here's my HJT log to help diagnose the problem:

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\system32\ntdx.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\HiWAAY Rocket Access\PropelAC.exe

C:\WINDOWS\system32\ZONELABS\vsmon.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\System32\wuauclt.exe

C:\Program Files\ewido\security suite\ewidoguard.exe

C:\Program Files\ewido\security suite\ewidoctrl.exe

C:\WINDOWS\sysyy.exe

C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080

R3 - Default URLSearchHook is missing

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx__SpybotSDDisabled (file missing)

O2 - BHO: Class - {27868172-1DE0-73D4-6E18-7124BED8DF85} - C:\WINDOWS\system32\mstc32.dll

O2 - BHO: Class - {427883E4-77FD-0FBD-0A27-92CC8F6BD789} - C:\WINDOWS\system32\mstc32.dll

O2 - BHO: IE_PopupBlocker Class - {656EC4B7-072B-4698-B504-2A414C1F0037} - C:\Program Files\HiWAAY Rocket Access\prpl_IePopupBlocker.dll

O2 - BHO: Class - {977B791D-EFEB-6D3B-4977-46BE03214A70} - C:\WINDOWS\system32\mstc32.dll

O2 - BHO: Class - {97AF78C9-15E9-AA49-D1E7-70A94F9D9B06} - C:\WINDOWS\system32\mstc32.dll

O2 - BHO: Class - {AF24ECE7-2AD0-FD03-3E5C-825AE627C049} - C:\WINDOWS\apiej32.dll

O2 - BHO: Class - {CB60E08A-964A-5FEF-6DF4-A5150B4A88D1} - C:\WINDOWS\system32\mstc32.dll

O2 - BHO: Class - {D8DBBFBF-DDA6-EEA0-A520-1DF97AE8D26D} - C:\WINDOWS\system32\mstc32.dll

O2 - BHO: Class - {E9316BCB-D8E8-3772-E707-BD8544ED75DD} - C:\WINDOWS\system32\mstc32.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: AIM Search - {40D41A8B-D79B-43d7-99A7-9EE0F344C385} - C:\Program Files\AIM Toolbar\AIMBar.dll

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [Propel Accelerator] "C:\Program Files\HiWAAY Rocket Access\trayctl.exe" /STARTUPLAUNCH

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [ntdx.exe] C:\WINDOWS\system32\ntdx.exe

O4 - HKLM\..\RunOnce: [ipil32.exe] C:\WINDOWS\ipil32.exe

O4 - HKLM\..\RunOnce: [sysyy.exe] C:\WINDOWS\sysyy.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm

O8 - Extra context menu item: Allow pop-ups from this site - C:\Program Files\HiWAAY Rocket Access\pac-addwl.html

O8 - Extra context menu item: Refresh Pa≥ with Full Quality - C:\Program Files\HiWAAY Rocket Access\pac-page.html

O8 - Extra context menu item: Refresh Pi&cture with Full Quality - C:\Program Files\HiWAAY Rocket Access\pac-image.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_01\bin\npjpi141_01.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - F:\PROGRA~1\AIM95\aim.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE

O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin4.dll

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{405383E2-DD25-4145-81B3-1F47362F856C}: NameServer = 216.180.99.2 216.180.122.2

O17 - HKLM\System\CS1\Services\Tcpip\..\{405383E2-DD25-4145-81B3-1F47362F856C}: NameServer = 216.180.99.2 216.180.122.2

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe

O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe

O23 - Service: hpdj3500 - Unknown owner - C:\DOCUME~1\DCOFFM~1\LOCALS~1\Temp\hpdj3500.exe (file missing)

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe

Rawe · November 8, 2005

Hello and welcome to MalwareBytes..

I would need to see the ENTIRE HijackThis log - please post the complete thing along with the headers.

Can you also disable Ewido Guard for now. Seems you have couple of bad infections, we'll clean them up in no time though

Rawe · November 9, 2005

Ok, sorry, didn't realize you DID post the full log. Can you possibly disable Ewido guard, then update to Windows XP Service Pack 1a (NOT sp2), then post a fresh log.

frustrated · November 10, 2005

Ok, sorry, didn't realize you DID post the full log. Can you possibly disable Ewido guard, then update to Windows XP Service Pack 1a (NOT sp2), then post a fresh log.

Well, I've managed to rid my system of coolWWWsearch by consulting with members of another forum and I'm having no problems now. I appreciate your offer of help though. I could run another HJT scan and post the results just to get a second opinion if you think it is necessary. I installed SP2 today, but that was only after my source confirmed that my machine was clean. Right now I'm basically just ramping up security to try to prevent this from happening again. coolWWWsearch is a pretty nasty little piece of work.

Rawe · November 10, 2005

I could check your HJT log just to make sure. CWS wasn't the only infection you have. Have you installed SpywareBlaster yet?

frustrated · November 11, 2005

I could check your HJT log just to make sure. CWS wasn't the only infection you have. Have you installed SpywareBlaster yet?

Yes, I've had SpywareBlaster for a while. I just failed to update it in a timely fashion which may have allowed these infections. I'm running it now with all the latest updates. I have noticed that several other annoying things, like the AIM toolbar and being redirected to an AIM page after a page cannot be found have ceased as well.

Here's the latest HJT log:

Logfile of HijackThis v1.99.1

Scan saved at 10:11:28 AM, on 11/11/2005

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ZONELABS\vsmon.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\Program Files\HiWAAY Rocket Access\PropelAC.exe

C:\Program Files\SpywareGuard\sgmain.exe

C:\Program Files\SpywareGuard\sgbhp.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Common Files\Real\Update_OB\realevent.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\D Coffman\Desktop\Protection Tools and Files\Tools\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:8080

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx__SpybotSDDisabled (file missing)

O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll