Minor Ad-Ware problem that's driving me batty!

Hi y'all - i hope someone can help me out with soemthing fishy that's been going on.

For the last couple of weeks (i think since I downloaded Java for Dell training) i've been having Browser relevancy issues liek this:

1. Find driving me nuts
Your relevant result is a click away!
www.upspiral.com/

2. Look for driving me nuts
Find driving me nuts at one of the best sites the Internet has to offer!
www.redzip.com/

with variations - usually upspiral and redzip, and also ezanga keep popping up. Also i've noticed a marked decrease in overall quality of hits returned.

I have run HJT - and deleted anything sketchy, run spybot, run adaware, run spysubtract - googled for any info possible, gone through my registry, and through the usual C drive areas where these types of things linger - and I can't make it go away.

The relevancy ads are the only issue. No popups or anything like that. Has anyone else had this problem, or have a solution?

please help!

Are they browser ads, or maybe net send ads? I would suggest maybe downloading the Microsoft Antispyware program and giving that a shot. Also, might want to post a HJT log on the site so we can take a look at it. Have you scanned for viruses also?

Hi zENGER - here's my HJT log - bear in mind i've already cleaned it as best i could:

Logfile of HijackThis v1.99.1
Scan saved at 3:48:28 PM, on 5/4/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
C:\WINDOWS\icmsca.exe
C:\Program Files\InterMute\icmssp\icmssp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\FaxSrCli\Notify.exe
C:\FaxSrPTM\FaxSrPTM.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\mspmspsv.exe
C:\Documents and Settings\TinaD\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://intranet.atlantaregional.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://intranet.atlantaregional.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir...ie&ar=iesearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Atlanta Regional Commission
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKCU\..\Run: [mspmspsv] C:\WINDOWS\System32\mspmspsv.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Fax Sr. Notify.lnk = C:\FaxSrCli\Notify.exe
O4 - Global Startup: Fax Sr. Print to Mail.lnk = C:\FaxSrPTM\FaxSrPTM.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=http://intranet.atlantaregional.com
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by101fd.bay101.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/Ms...Downloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = atlantaregion.com
O17 - HKLM\Software\..\Telephony: DomainName = atlantaregion.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE56CABD-EE1B-4697-A5F8-79789499283C}: NameServer = 192.168.1.14,192.168.1.140
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = atlantaregion.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = atlantaregion.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperWorkstation\DKService.exe
O23 - Service: InterMute Client Agent - InterMute, Inc. - C:\WINDOWS\icmsca.exe
O23 - Service: InterMute SpySubtract Agent - InterMute, Inc. - C:\Program Files\InterMute\icmssp\icmssp.exe
O23 - Service: Sweep for Windows NT Network (SWEEPNET) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
O23 - Service: Sweep for Windows NT Update (SWEEPUPDATE) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWUPDATE.EXE

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Sophos has been acting up for me so i'm actually reinstalling it now, but I'm running a trendmicro scan since i'm not quite sure when sophos quit. TrendMicro's beta 6.0 is looking kind of cool witht he built in spyware scan - let's see how it does. I will try MS Spyware scan next if TrendMicor doesn't find anything.


Oh as far as the ads - attached is a screen capture. it seems like what happens is that i will put in my search text (in this case - Trend Micro) and it will run the search, return the results, and then the first 2 or 3 entries will be changed to whatever ad-listing is applicable - in this case i believe it's stop-sign.com. If i use quotation makrs in my search it is upsprial and redzip and i think ezanga comes up when i use AND in my search.

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = atlantaregion.com
O17 - HKLM\Software\..\Telephony: DomainName = atlantaregion.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{BE56CABD-EE1B-4697-A5F8-79789499283C}: NameServer = 192.168.1.14,192.168.1.140
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = atlantaregion.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = atlantaregion.com


Did you setup those servers as your DNS servers? This looks like a browser redirection type problem, that maybe its redirecting your home page somewhere bogus, yet still shows the URL that you think it is. I can't be positive this is what is going on, but I would be very leary of those lines.

yeah those are all fine and supposed to be there. this is puzzling the heck out of me.


just finished the trendmicro scan too - no viruses, a couple of tracking cookies which i deleted but other than that - clean.

It might worth running Microsoft AntiSpyware Beta (until a AO Senior can take a look at your log). Quite a few people have had some luck with it.

- Xierox

You said your antivirus has been acting up? How about your firewall?

I know automated scans give mixed results, but I ran your HighjackThis file through HijackThis, but am unable to post the results. You would have to post your log there yourself, if you haven't done so already.

But I got 11 unknown applications and the five possible nasty hits that zENGER mentioned. I tried to search the 11 unknowns in different combinations, but was unsuccessful in turning up any solid hits on those items in question exept this one:

O4 - Global Startup: Fax Sr. Notify.lnk = C:\FaxSrCli\Notify.exe

When I ran Notify.exe through google I got a hit from symantec about a Backdoor.Armageddon.B found here. . Though it is not the exact same extension as the one found on your logs, it was using a Notify.exe

Quote:

---

Backdoor.Armageddon.B is a variant of a zoo Trojan. It is a server that is accessed through any number of known clients.

When it runs, the executable moves itself to %windir%\System\Notify.exe.

It modifies the %windir%\System.ini file so that it will run when you restart Windows. In the [boot] section of the file, it appends %windir%\system\Notify.exe to the shell= line. Typically this line is shell=explorer.exe, although some systems have additional boot shells loaded.

---

Quote:

---

NOTES:

* %windir% is a variable that refers to the folder in which Windows is installed. By default this is C:\Windows or C:\Winnt..
* The modification to the System.ini file is effective only on Windows 95/98/Me-based computers.

---

I am far from an expert, so it could be nothing. I was about to just move on until after reading this thread about 3 or 4 times when I noticed that you mentioned that your AV was acting up and that you were reinstalling it this last time I looked the thread back over (actually, I did notice that the first time, but never made a connection till last) and remembered seeing this there, as well, at the very top on what a Backdoor.Armageddon.B does:

Quote:

---

Backdoor.Armageddon.B allows unauthorized access to the infected computer. When it is run, it disables antivirus and firewall software.

---

And this, also under "Notes":

Quote:

---

When the infected computer is started, the Trojan notifies the hacker. This Trojan uses port 6969. It also searches for major antivirus and firewall packages, and disables them if they are running.

---

So that is why I was asking you about your AV and firewall, because I recalled you mentioning that, and that is what lead me to post after all. Again, I am not an expert in this matter, but I just wanted to see if I could find anything out for you. I'm just trying to help find a solution, so, don't kill the messenger:D Hope this is of some use to you.

Cheers!

Might want to run "netstat -ao" on the machine and find out what ports its listening on.

Also, might want to use msconfig and turn EVERYTHING off, and give it a go that way. You can then easily turn everything back on. Identify what processes run even after everything is turn off after a reboot.

Zenger, those are legit (as Tryska said) check this out:

Quote:

---

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Atlanta Regional Commission

---

Also, 192.168.1.14 & 192.168.1.140 are probably the IP addresses of the primary and secondary DNS servers for atlantaregion.com.

I only have one other piece of info to add to this thread in regards to Igfxtray.exe and Hkcmd.exe
From AnswersThatWork:

Quote:

---

Recommendation :
Although great in theory, on some PCs we have found that whenever IGFXTRAY and HKCMD are running, Windows Explorer is prone to hanging and showing as "not responding" in the Task List. Our recommendation, therefore, is that you should not have this tray icon running, and that you should also not use the hotkey facility that comes with it.

---

This is more or less a personal judgement call as neither process is malicious in nature.

i should prolly have mentioned this is a corporate machine - behind a firewall that's not acting up, faxsr notify is a legit program and i got sophos back up and running. for soem reason on my machine it stops updating and uninstalls itself every few days. I have a feeling it might be because i restart my machine each night, and it's pending an actual login before starting and maybe gets locked up. I'm not really sure, but i will test it.

i'm also going to give Microsoft's program a go. Perhaps all those false positives will work in my favor.

so as an update - ran Microsoft's product and it found absolutely nothing on my machine - but the problem's still there.


One interesting thing i found was that it's specific to my profile on this pc - logging in under other profiles i'm not having the same issue. I went through and cleaned out my cookies and temp directory, but that hasn't helped.

That is a very good fact that you found there. Since it only does it on your profile, we can compare yours with the others and find out what is causing it. Grab a this and run it. Find out what DLLs are links to explorer and iexplore and then compare them to those that are running under another profile. I'll bet that one of those DLLs is your culprit.

thanks zENGER! I'll get back to you in a bit.

okay - so here's what i got....

i ran the APM on the local admin profile first, and got a bunch of dlls.

There were several that were not in common with the results from my personal profile.

The dll (in iexplore) that stands out is actxproxy.dll

if i unload it from iexplore.exe - the adware goes away. if i reload it, and refresh my browser - or jsut leave it alone. it comes back.

one curious thing which i haven't been able to replicate - At one point there were several Java dlls in my iexplore list. When i unloaded the first one - the browser shut down, and when i reopened it the adware was gone entirely. I think i might have to wait for Java to reload all that stuff back.

i don't think it's the actxproxy by itself tho - because the file hasn't been modified since 2004, and was created on that same date. Also if i go in to the local admin profile and load the dll into iexplore there it doesn't replicate the problem.

So i'm not sure.

As far as the explorer.exe module nothing additional in my personal profile that's not in the local admin profile. :(

I'm curious if you mispelled that or it its right. I did a google search for the file in question, and came across various references. In particular I found that actxprxy.dll (without the o) is a part of activeX. Here is a link: http://www.liutilities.com/products/...rary/actxprxy/ .

Just a question here.

Did you try doing the search the way you normally do, ( I assume using the search button ) then type in the URL for Yahoo so you go directly to the to the Yahoo page, then try the same search?

Is there a difference?

actually i normally search directly from the yahoo page itself. so all of this is happening when i go to www.yahoo.com and start searching from there. or if i go to www.google.com and search from there.


and zENGER - yes - i did misspell it - no "o" in the actual file name. I'll have a look at the link.

hey guess what? I downloaded Ewido's security suite and ran it - it found a couple of false positives but also some other cookies that it found to be spyware. I then ran the latest version of CrapCleaner - manually selected which cookies i want to keep, deleted all registry issues, and cleaned out temp files and such, and it seems my problem is finally gone.


Let's see what happens in the next couple of days.

I had a virus with the exact same symptoms (redzip an uspiral added to search results). Like Tryska, I ran Ewido and got it to go away. I didn't need to run CrapCleaner. I did need to reboot, though. The files Ewido said were infected:

C:\W2KSRV\system32\PROXYCFG.EXE -> Heuristic.Win32.Hijacker1

HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1C955F3B-5B32-4393-A05D-24B4970CD2A1} -> Dialer.Generic

C:\W2KSRV\Downloaded Program Files\popcaploader.dll -> Not-A-Virus.RiskWare.Downloader.PopCap.a

My apologies if it is bad form to bump a 2-month old thread here, but since I found the help here useful, I wanted to add my experience in case it helped the next person Googling for a solution.

-Erik

There is no problem with bumping threads if you are adding to them in a positive way.
It only gets reds when you add 'I agree' or some such twaddle.........

You had the same problem, you have added your observations to the thread, the thread is a better thread for it :)

And welcome to AO