Searchweb2 annoying toolbar

[Halcyon]

Hi,
Unfortunately my cousin has not seen the light and switched to Mozilla as yet and Im in the middle of deleting all the spyware and junk on his PC.
The one thing thats still causing me problems is this annoying SearchWeb2 toolbar and adverts that also seems to automatically take over the homepage to startup its adverts.

Ive already run Adaware.
Ive just got Hijack this but now dont know what to do.
So heres my log and Id appreciate if anyone can guide me from here on what to do as it will be a great help.
Thanks to everyone who can help.


Logfile of HijackThis v1.97.7
Scan saved at 13:44:39, on 10/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\PROGRA~1\Wanadoo\CnxMon.exe
C:\PROGRA~1\MESSAG~1\StartMessager.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\program files\altnet\points manager\points manager.exe
C:\WINDOWS\System32\RUNDLL32.EXE
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
c:\progra~1\intern~1\iexplore.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Internet Explorer\Iexplorer.exe
C:\adaware\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchweb2.com/passthrough/in...www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.vlzcdhjenzwexjeotspw.net/...pneAGibGoI.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - (no file)
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINDOWS\mslagent\4b_1,0,1,0_mslagent.dll (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {ED61C36B-8FC9-13E2-3888-BD752F8D98B5} - C:\PROGRA~1\litemore\RectPhone.exe
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: (no name) - {828BB0B5-AA50-4671-8FA0-D4FCF86D1142} - (no file)
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Bias live] C:\PROGRA~1\MULTIR~1\Idlebows.exe
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [title media mp3 this] C:\Documents and Settings\All Users\Application Data\cast glue title media\corn ford.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\RunServices: [Driver32] Overwritten when removing W32/Sircam-A, please delete.
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Image Transfer.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O9 - Extra button: Wanadoo (HKCU)
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/game...s/y/pote_x.cab
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} (TDServer Control) - http://fr.encyclopedia.yahoo.com/rsc/tdserver.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix-i.com/download/ipixx.cab
O16 - DPF: {14325268-79E0-4D2A-89A4-FFFC6E22741E} - http://akamai.downloadv3.com/binarie...ce_3_FR_XP.cab
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/s...ctor/swdir.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - http://office.microsoft.com/officeup...ntent/opuc.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/05a37564a640596...dxIE601_fr.cab
O16 - DPF: {5C3A9EA6-4068-46B8-8B5A-692FB10607B1} (IntDialerData Class) - http://www.grupox.com/perf/DialerData.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...tatsClient.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...900.5408680556
O16 - DPF: {BD092CD7-AA66-4FF6-8CE1-D4E01489ED2B} (VacPro.UserControl1) - http://www.7adpower.com/dialer/EMSAT.CAB
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697514} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp3_mp3.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://www.sexyzapping.com/kits/iX.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/s...sh/swflash.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.fnacphoto.com/tools/xupload/XUpload.ocx
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...reShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4A44A1B-99B6-4B35-BBD8-D1FC41DF2E6A}: NameServer = 80.10.246.1 80.10.246.132

[Bifta]

try this:

http://www.lop.com/new_uninstall.exe

[Chris W]

Originally Posted by Halcyon

<big snip>

to start with you want to get rid of these:


end the following processes:
C:\PROGRA~1\MESSAG~1\StartMessager.exe
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
C:\program files\altnet\points manager\points manager.exe
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchweb2.com/passthrough/i.../www.google.fr/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.vlzcdhjenzwexjeotspw.net...SpneAGibGoI.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - _{D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - (no file)
R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: NavErrRedir Class - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
O2 - BHO: (no name) - {021BB032-80A8-4FB6-B3D5-CF27B1553B95} - C:\WINDOWS\mslagent\4b_1,0,1,0_mslagent.dll (file missing)
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: (no name) - {ED61C36B-8FC9-13E2-3888-BD752F8D98B5} - C:\PROGRA~1\litemore\RectPhone.exe
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: (no name) - {828BB0B5-AA50-4671-8FA0-D4FCF86D1142} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [Bias live] C:\PROGRA~1\MULTIR~1\Idlebows.exe
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [title media mp3 this] C:\Documents and Settings\All Users\Application Data\cast glue title media\corn ford.exe
O4 - HKLM\..\RunServices: [Driver32] Overwritten when removing W32/Sircam-A, please delete.
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O16 - DPF: ChatSpace Full Java Client 3.1.0.229 - http://surechat.com:9000/Java/cfs31229.cab
O16 - DPF: {C771B05E-E725-4516-97A5-4CE5EB163CFB} - http://www.sexyzapping.com/kits/iX.exe


tben see where you have got to ... there is really too much information there to digest!

[Tezcatlipoca]

bb31 had this problem recently.

Have a read of this thread for some ideas: http://www.cableforum.co.uk/board/sh...ad.php?t=15403

[Halcyon]

Biftas link did the trick.
Il also get rid of those other little parts you mention monkey.
Thanks.

[Richard M]

He will probably want to keep hold of this:
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart

That's Messenger Plus, an MSN Messenger extension.

[Chris W]

Originally Posted by Richard M

He will probably want to keep hold of this:
C:\Program Files\Messenger Plus! 3\MsgPlus.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart

That's Messenger Plus, an MSN Messenger extension.

but as i assumed his cousin knew little about preventing spyware he had installed the version which had the nasty bits with it. Best of uninstalling messenger plus, and then reinstalling- decline the license agreement and it will offer you a spyware free version.

[ntl customer]

Also remove these - they are not needed and simply consume memory ...

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

This also looks suspicious too ...

C:\Program Files\Internet Explorer\Iexplorer.exe

Unless it is different in France, but there is also iexplore.exe in the list which suggests that the above is a dud.

[Halcyon]

Thanks to you all.
Alls working great.

[Ĉø®ÃÆâ€]

Bifta
Thank you, I have been having problems with searchweb2 for ages, 5 minutes on here and it has gone.:o
Again thank you.

[MovedGoalPosts]

Originally Posted by ĈÃÃâ€*’¸ÃÆ⠀™ÃƒÂ¢Ã¢â€šÂ¬Ã…¡Ãƒâ€šÃ‚®Ãƒâ €šÃ‚§ÃÃâ€*†™Ãƒâ€šÃ‚Â¥GÃÃâ€*’à ‚®Ã‚Ã ¡Ãƒâ€šÃ‚®LÃÃâ€*’ÂÂà ‚¬ÃƒÆ’¢â€Åà ‚Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ ’‚¹Ã¢âââ⠂¬Å¡Ã‚¬Ã…¾Ã‚¢

Bifta
Thank you, I have bin avin probs wiv that slippery little fing for ages, 5 mins on here and whooshhhhhhhhhhh tis gone.
TYSVM
xx

:Welcome: [untypable name] to Cable Forum.

jst a kwik note 2 say i h8 ppl hoo txt spk bt gld Bifta helpd

[nffc]

Originally Posted by ĈÃÃâ€*’¸ÃÆ⠀™ÃƒÂ¢Ã¢â€šÂ¬Ã…¡Ãƒâ€šÃ‚®Ãƒâ €šÃ‚§ÃÃâ€*†™Ãƒâ€šÃ‚Â¥GÃÃâ€*’à ‚®Ã‚Ã ¡Ãƒâ€šÃ‚®LÃÃâ€*’ÂÂà ‚¬ÃƒÆ’¢â€Åà ‚Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ ’‚¹Ã¢âââ⠂¬Å¡Ã‚¬Ã…¾Ã‚¢

Bifta
Thank you, I have bin avin probs wiv that slippery little fing for ages, 5 mins on here and whooshhhhhhhhhhh tis gone.
TYSVM
xx

yo innit, ow iz ur bling 2day n ur burberry n iz u bin in de prk wiv ur m8s avin a bit ov cidr n chillin in ur trackis innit wiv ur bitch oo iz bin 2 da snbd 2day innit n u iz got ur gti wiv cstm md splrs n da lits n da massiv drm n bss stff innit lol n u iz a chav n i dnt lk chavs innit me lk goffs n geggers n now go n lstn 2 babycakes by 3 of a kind innit n dis is a frm nt a mobl fne so dnt tlk lk u r txtin ur chavette innit. bye n keep it real innit.

[Ĉø®ÃÆâ€]

Yes it is very annoying, but gets a response.
Thanks for advice anyway.

[danielf]

Originally Posted by ĈÃÃâ€*’¸ÃÆ⠀™ÃƒÂ¢Ã¢â€šÂ¬Ã…¡Ãƒâ€šÃ‚®Ãƒâ €šÃ‚§ÃÃâ€*†™Ãƒâ€šÃ‚Â¥GÃÃâ€*’à ‚®Ã‚Ã ¡Ãƒâ€šÃ‚®LÃÃâ€*’ÂÂà ‚¬ÃƒÆ’¢â€Åà ‚Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â¬ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ ’‚¹Ã¢âââ⠂¬Å¡Ã‚¬Ã…¾Ã‚¢

Yes it is very annoying, but gets a response.
Thanks for advice anyway.

Why are you keen on a response, when you're just remarking that someone's post helped you?

[Ĉø®ÃÆâ€]

It was my first post and I am still learning. I suppose I felt I could have been informed in a different manner about forum posts.