cant find away to del spyware using HijackThis

:confused:
can you help me out guys my friend pc is infected by a spyware...
I used SPYBOT, ADAWARE, AVG still there's a possible spyware cause when using the
IE is not in good state.. well anyway i used the HIJACKTHIS GUYS...

HERE'S WHAT IT SAY'S

Logfile of HijackThis v1.97.7
Scan saved at 2:57:59 PM, on 10/19/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir...r=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://192.168.0.100:918
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = iexplore
O2 - BHO: (no name) - {00000185-C745-43D2-44F1-01A1C789C738} - C:\PROGRA~1\SB\SMART-~1\BHO010~1.DLL
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {8FF39596-B202-46EB-9240-2E6EDCB018E7} - C:\WINDOWS\System32\kbnbg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_3_12_0.dll
O8 - Extra context menu item: Download using LeechGet - file://C:\Program Files\LeechGet 2004\\AddUrl.html
O8 - Extra context menu item: Download using LeechGet Wizard - file://C:\Program Files\LeechGet 2004\\Wizard.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Parse with LeechGet - file://C:\Program Files\LeechGet 2004\\Parser.html
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} (EGEGAUTH Class) - http://akamai.downloadv3.com/binarie...1025_EN_XP.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...f4a58b0be0058e
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/platypus/miniclipGameLoader.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/downlo...22/wmv9VCM.CAB
O16 - DPF: {50AD557E-3426-41FD-AFDD-2AF39BB1C387} - http://akamai.downloadv3.com/binarie...ce_5_EN_XP.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1096083732811
O16 - DPF: {8B936702-C234-40D0-B69C-A2F669A33978} - http://akamai.downloadv3.com/binarie...ce_7_EN_XP.cab
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E80ABE49-F6F2-40F8-9D7D-2AB4AA5CBB03}: NameServer = 203.172.11.26,202.57.96.4


CAN YOU HELP ME OUT GUYS!!!! :confused:

Please tell your friend that if they persist in running unpatched systems this will happen :rolleyes:

1. Get a firewall. As you friend does not seem very experienced I would try ZoneAlarm. Set all settings to high. That will give you adequate protection whilst you are doing the rest.

2. Update Spybot, AdAware and your AV and run them all in safe mode (F8 on boot up).

3. Go to the Microsoft site (use Windows Update) and update your WinXP and Internet Explorer. That should fix your IE problems. It should be at least at SP1 (6.00.2800.1106), yours is: (6.00.2600.0000) which is way out of date.

4. Get HijackThis v1.98 and run it again.

5. Try using a different browser.............Mozilla 1.7, Mozilla Firefox, Opera or whatever. You will have to use IE for some tasks like updating Windows, but for day to day use it is safer to use something else.

Good luck.

Ouch! this boy's eat up with it. Just happens I learned through trial and error the other day when I tried to find and download a dvd player/decoder and wound up with 5 different kinds of spyware installed along with the one player that actually worked - even with hijack this cleaning in safemode, on reboot the spyware would just return. Here's how I fixed it -

After cleaning up in safe mode with spybot and hijack this, on a whim I ran msconfig. Sure enough, the spyware installer was in the startup section. Oops. That was kinda sloppy on the author's part, but to the average user it'd be enough to make him throw up his hands in disgust. I promptly removed it from startup, checked through the other ini files for anything related to it, and now the machine works just fine. The spyware is still on my machine somewhere I'm sure, but it cannot load and won't be started. I'm still in 'agreement' with the licensing agreement that came with the player that said I had to install this and that spyware, because it *is* still here, and *is* still installed - it's just rendered inoperable.

Hope that helps some.

In addition to nihil's good advice..it's possible you have a CWS infection that either spybot or Adaware only partially cleaned up.


This is only the first step:

Put a checkmark next to the following entries in HijackThis. Make sure all
other windows and browsers are closed before clicking on “Fix Checked”.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about :NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about :NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about :NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about :NavigationFailure
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redi...&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redi...amp;ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about :NavigationFailure
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about :blank
O2 - BHO: (no name) - {8FF39596-B202-46EB-9240-2E6EDCB018E7} - C:\WINDOWS\System32\kbnbg.dll
***********************************************************

Download and install APM from here:
http://www.diamondcs.com.au/index.php?page=apm

Now, start APM.
In the upper window select explorer.exe
In the lower window find and rightclick the O2 - BHO: entry from your HijackThis log.

In the current log it is this file but it may have changed names.
It is currently :

O2 - BHO: (no name) - {8FF39596-B202-46EB-9240-2E6EDCB018E7} - C:\WINDOWS\System32\kbnbg.dll
<--This file name

It is the 02 BHO entry with no description, in case it has changed names. It is not tied to any program you recognize.
Select Unload DLL, and click OK on the prompts that follow.

***********************************************************

Boot into SAFE MODE by tapping the f8 key during boot up.

Run Adaware with the following options selected:

Quote:

---

• Configure Ad-aware
  • Click on the Gear-shaped icon at the top to open the Settings window.
  • All of the following settings I mention should be enabled (green checkmark). Some settings cannot be enabled in certain versions of Windows. If a setting I mention is grey and can't be enabled, skip it.
  • General Settings - Automatically save log-file, Automatically quarantine objects prior to removal, and Safe Mode (always request confirmation)
  • Scanning Settings
    
    • Scan Within Archives
    • Click on 'Click here to select drives + folders' and check next to each hard drive then hit ok.
    • Scan Active Processes
    • Scan Registry
    • Deep Scan Registry
    • Scan my IE favorites for banned URL’s
    • Scan my Hosts file
  • Advanced Settings - Enable all four options under 'Log-file Detail level'
  • Tweak Settings
    • Under 'Scanning Engine' - Enable 'Unload recognized processes during scanning', 'Include basic Ad-aware settings in logfile', and 'Include additional Ad-aware settings in logfile'
    • Under ‘Cleaning Engine’ - Enable 'Let Windows remove files in use at next reboot'
  • Click Proceed
• Click on the 'Start' button in the lower right.
• Select 'Use custom scanning options', enable 'Activate in-depth scanning', and click Next. The scan will take several minutes to complete. When the scan is complete click Next.
• Right click on the list of items and click 'Select all items' then click Next. Press Yes to confirm. The detected items are now quarantined.
• Close Ad-aware

---

==========================

Reboot and post a new log using the updated version as nihil sugested.

Don't forget to disable the System Restore (My Computer, Properties, System Restore, Turn off system restore.) before cleaning out the system.

I've reinfections from this "protected area". Re-enable when "clean."

ahhh another hijack this log, seen quite alot of these lately, spyware is on the rise, i use all of those and was introduced to webroot spysweeper, its legit program, just google for it and its free with current updates. it found more than ad-aware did. and has all kinds of shield programs running in the background to protect from more enterning, def agree with the firewall and the windows update.

Quote:

---

Don't forget to disable the System Restore (My Computer, Properties, System Restore, Turn off system restore.) before cleaning out the system.

---

With all due respect, I would never recommend that step until after the infection is removed. If for some reason the user gets removal happy with HJT and ignores suggestions, then they have nothing to fall back on if the removal goes badly.

Just my 2 bits.

Thanks guys
is there a possible way to block this spyware except using a firewall installed in your PC and using SPOYBOT,ADAWARe?

any softwares or suggestions guys to protect yourself from this dangerous PARASITES theyre giving a headache dudE!!

Update windows!
in IE: Tools, Windows Update.

That will prevent 90% of adware, responsible computing will take care of the rest.

ohh I seeee!!!
Its that really simple....
no other possible way ok fine whatever
I think its just business .... so many little people will have ......
ok thats enough
I think you will not agree with ...

ANYWAY THANKS A LOT !
GOD BLESS YOU ALL

im having the same problems as we speak, i just weant thru safe mode and deleted the folder C:\windows\srchasst and the reg key that weant along with it plus the prefetches, so far so good. I think it has to do with a program called randreco.exe. check out my posts to get my specs on the problem. so far so good. other then the fact that my homepage keeps getting changed to searchportal.info. ill let you know if it holds or i just waisted my time.

what i had to do to get rid of the problem is go into command prompt and delete C:\windows\ srchasst and C:\windows\inetg. i also deleted the registry keys (did a search for randreco, search assistant, and inetg). finaly i deleted the prefetches to these files. its worked for me so far. im going on my first day with no ppups or annoying programs being installed.

Personally I think that there needs to be something done about all the spyware out there today. A normal person that builds a code to "get Information" from someone else's computer can get a jail term, but if its a large corparation (e.g. .. Yahoo, Microsoft, etc.,) all that happens is oh well download a new patch or another program and deal with it. Why don't the laws that apply to us apply to them?

Quote:

---

Originally posted here by phatcat42141
Personally I think that there needs to be something done about all the spyware out there today. A normal person that builds a code to "get Information" from someone else's computer can get a jail term, but if its a large corparation (e.g. .. Yahoo, Microsoft, etc.,) all that happens is oh well download a new patch or another program and deal with it. Why don't the laws that apply to us apply to them?

---

well I agree with bro but ....
cant you see that everything around us is business that's why?

one more thing you can do so stop spyware/adware from installing on your system is to get

1. spywareblaster : www.javacoolsoftware.com/spywareblaster.html
2. spywareguard : www.javacoolsoftware.com/spywareguard.html

you should also immunise in spy.bot and add the host entries to your host file.
spy.bot also comes with a inbuilt feature of blocking bad download in internet explorer you should also enable this.

I put this in another post, but it fits here so I'll post a bit of it.

My darling Mrs. Ice just brought home a 'loaner' laptop from school. Thanks to Spybot and HiJack This, I found and successfully removed over 285 bits of spyware/malware, along with several nasty virii. Amazingly enough, after fixing all of this, cleaning up the machine in general, but before deleting out AOL and NetZero, which the previous users had installed, I did a little search. Sure enough, idiot number 57 left a picture of herself and her boyfriend on the machine. Oops. I posted it to the desktop, along with the logs of what I'd done and a nice little note to the IT boss there at the school (who knew I was doing it and gave me his admin pass)...

To further educate this IT boss, I've referred him to here. I also gave him copies of spybot and hijack this on that laptop, and the urls where to find them, and suggested he get a firewall. We can hope yet another unsecured college will soon be educated.

Quote:

---

Originally posted here by jin29_neci
Thanks guys
is there a possible way to block this spyware except using a firewall installed in your PC and using SPOYBOT,ADAWARe?

any softwares or suggestions guys to protect yourself from this dangerous PARASITES theyre giving a headache dudE!!

---

Spyware does SUCK.

I use multiple mechanisms to _try_ to block spyware on my Windows PCs...
1) HOSTS File: I have found this to be very successfull at blocking spyware. I update my HOSTS file with a list of spyware and adware sites. This way, when my browser trys look up the DNS name it gets my local PC 127.0.0.1. I have a nice little batch file which checks every day for a new list. This list is updated by a very cool person who hates spyware so much they keep this list updated.

Quote:

---

echo off
cls
echo Downloading new hosts file from http://www.mvps.org/winhelp2002/hosts.txt
del /q hosts.txt*.*
wget http://www.mvps.org/winhelp2002/hosts.txt
copy /y hosts.txt c:\winnt\system32\drivers\etc\hosts

---

2) Install SpywareBlaster. Get it at http:www.javacoolsoftware.com

3) Install SpywareGuard. Get it at http://www.javacoolsoftware.com/spywareguard.html

Good luck.

In accordance with AO rules would creating an anti-spyware compain be illegal or immoral?? Its Illegal for any person to come into your home uninvited and put things you do not want in there. you are also aloud to take action against people who come into you home uninvited, they are criminals. Would it be different if we took action against people who uninvitedly install there software on our personal computers. It has the same principles does it not. I may be missing something here but i do not beleive so. I consider myself a hacker neophyte. I beleive in freedome of information, if its in the public its in the public (reporting holes and backdoors to companies). I do not support malicious crimes (cracking peoples personal encrypted information, creating and distributing viruses) why am i a terrorist then?? I would like to see action taken against spyware and other alike. If anyone has any information or is starting an orginization of this nature please tell me. We are the anti-terrorist of the cyber world. Why else would the government use us for our knowledge?

ric-o
thanks for the tip
its great......
I think time will come this spyware will stop their evolution....... I hope but do you believe in this guys I think nahhhh never mind but i do still believe that someday there will be a software for this spyware to stop there evolution,,,