searchweb2 - unable to remove!!

[bb31]

HELP!!!


my homepage has been overtaken by search web 2 and its placed a toolbar I am unable to get rid of. I have tried spybot, spyblaster and norton to remove it and it still appears.

Help - what can i do next these toolbars are annoying me

[IanUK]

I was going to put some url's here but they are a bit long.

Put 'searchweb2 removal' (remove the quotes) into google and you will get a page with answers from various sites of how to remove it.

HTH

Ian

IanUK, you can post long URL's, the forum will shorten them with "..." in the middle of it

[Neil]

Here's an uninstaller (apparently)

[Edit]-Link Removed as I'm not so sure about it now....

Use at your own risk!

[bb31]

Originally Posted by IanUK

I was going to put some url's here but they are a bit long.

Put 'searchweb2 removal' (remove the quotes) into google and you will get a page with answers from various sites of how to remove it.

HTH

Ian

(tu) off to try - wish me luck

[Tezcatlipoca]

Try HiJackThis - http://www.spychecker.com/program/hijackthis.html

If you aren't sure what to do with it, post the log here & I'm sure someone will be able to help.

Maybe CWShredder will help too? - http://www.majorgeeks.com/download4086.html

[Marge]

DO NOT DELETE ANYTHING

[bb31]

Originally Posted by Matt D

Try HiJackThis - http://www.spychecker.com/program/hijackthis.html

If you aren't sure what to do with it, post the log here & I'm sure someone will be able to help.

Maybe CWShredder will help too? - http://www.majorgeeks.com/download4086.html

tried CWShredder and heres the log:-

Please understand that a CWShredder 'Scan only' report
might not be sufficient to troubleshoot an infected system.
You can use HijackThis for that:
http://www.merijn.org/files/hijackthis.zip
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Windows XP (5.01.2600 SP1)
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\System32
AppData folder: C:\Documents and Settings\Roy\Application Data
Username: Roy

Found Hosts file: C:\WINDOWS\System32\drivers\etc\hosts (734 bytes, A)
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
Found Win.ini file: C:\WINDOWS\win.ini (583 bytes, A)
Found System.ini file: C:\WINDOWS\system.ini (231 bytes, A)

- END OF REPORT -

and done highjack this report:-Logfile of HijackThis v1.97.7
Scan saved at 21:59:00, on 26/07/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\LTSMMSG.exe
C:\WINDOWS\System32\atiptaxx.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Messenger Plus! 2\MsgPlus.exe
C:\PROGRA~1\COMMON~1\XCPCSync\TRANSL~1\ErPhn2\ErTr ay.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
c:\progra~1\intern~1\iexplore.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\Common Files\Symantec Shared\NMain.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Roy\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchweb2.com/passthrough/in...www.bbc.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/cust...//my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.swpbgrtxbvkydygrenqbheg.b...ugKa6vT1z.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
O2 - BHO: (no name) - {0147BA15-26D0-4AE5-A968-3086A7DC38D2} - C:\PROGRA~1\AUDIOA~1\ooze htm.exe
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [LTSMMSG] LTSMMSG.exe
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [XTNDConnect PC - ErPhn2] C:\PROGRA~1\COMMON~1\XCPCSync\TRANSL~1\ErPhn2\ErTr ay.exe
O4 - HKLM\..\Run: [itch army] C:\PROGRA~1\HOLEFR~1\thatthunk.exe
O4 - HKLM\..\Run: [BIASKINDFIVEMAPI] C:\Documents and Settings\All Users\Application Data\cdromsoftbiaskind\face keep.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Research (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0309.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.co...020.2727083333
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/p...le/install.cab


what do i do now???

[Marge]

O4 - HKLM\..\Run: [itch army] C:\PROGRA~1\HOLEFR~1\thatthunk.exe

What sites have you been on my friend and why haven't you told me about them ??

[bb31]

Originally Posted by Debsy42

O4 - HKLM\..\Run: [itch army] C:\PROGRA~1\HOLEFR~1\thatthunk.exe

What sites have you been on my friend and why haven't you told me about them ??

dont know where thats come from!!! should i delete it??

[Tezcatlipoca]

Originally Posted by bb31

tried CWShredder and heres the log:-

Please understand that a CWShredder 'Scan only' report
might not be sufficient to troubleshoot an infected system.
You can use HijackThis for that:
http://www.merijn.org/files/hijackthis.zip
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Windows XP (5.01.2600 SP1)
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\System32
AppData folder: C:\Documents and Settings\Roy\Application Data
Username: Roy

Found Hosts file: C:\WINDOWS\System32\drivers\etc\hosts (734 bytes, A)
Shell Registry value: HKLM\..\WinLogon [Shell] Explorer.exe
UserInit Registry value: HKLM\..\WinLogon [UserInit] C:\WINDOWS\system32\userinit.exe,
Found Win.ini file: C:\WINDOWS\win.ini (583 bytes, A)
Found System.ini file: C:\WINDOWS\system.ini (231 bytes, A)

- END OF REPORT -

You can safely do a "Fix" with CWShredder, rather than just a Scan.

Originally Posted by bb31

and done highjack this report:-Logfile of HijackThis v1.97.7

I'm not sure about all of it, but these are suspicious IMO:

Originally Posted by bb31

C:\PROGRA~1\COMMON~1\XCPCSync\TRANSL~1\ErPhn2\ErTr ay.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchweb2.com/passthrough/in...www.bbc.co.uk/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.swpbgrtxbvkydygrenqbheg.b...ugKa6vT1z.html

O2 - BHO: (no name) - {0147BA15-26D0-4AE5-A968-3086A7DC38D2} - C:\PROGRA~1\AUDIOA~1\ooze htm.exe

O4 - HKLM\..\Run: [XTNDConnect PC - ErPhn2] C:\PROGRA~1\COMMON~1\XCPCSync\TRANSL~1\ErPhn2\ErTr ay.exe

O4 - HKLM\..\Run: [itch army] C:\PROGRA~1\HOLEFR~1\thatthunk.exe

O4 - HKLM\..\Run: [BIASKINDFIVEMAPI] C:\Documents and Settings\All Users\Application Data\cdromsoftbiaskind\face keep.exe

O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://install.wildtangent.com/bgn/p...le/install.cab

The log also showed you have several instances of iexplore.exe (Internet Explorer) running in the background.

Try doing a Fix with CWShredder, but *first* do a Control-Alt-Delete & click on Task Manager & then Processes. Select each entry for "iexplore.exe" & End Process. Then run CWShredder & do a Fix.

Then try HiJackThis again.

Hopefully someone else will have a better idea than me on which things you can safely delete.

I'd definitely Fix these two though:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchweb2.com/passthrough/i.../www.bbc.co.uk/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.swpbgrtxbvkydygrenqbheg....kugKa6vT1z.html

[bb31]

still no joy - the tool bar still there!!!

good old debsy my pc fixer is coming round to sort it out tomorrow before i do anymore damage

I promise i wont hit the delete key or go to pc world and buy a new one b4 then

[SOSAGES]

i went round a clients and saw both laptops he has had this - i didnt know what it was but i knew it was evil i did a search on google for it and it came up with various pages informing me it was as evil as i thought and then they said how to remove it -

i think adaware removed it for me that and i had to remove it from startup and control panel..
plenty of instructions on the web how to remove it good luck

Where is Paul?I'm sure he's the man for this job.

[Tezcatlipoca]

Something I forgot to mention last night:

You may have more luck if you do all the scanning & cleaning while in Safe Mode.

Boot the PC into Safe Mode (Hold F8 when you turn it on, & then select Safe Mode from the menu when it appears), & then run AdAware, SpyBot, CWShredder, HiJackThis etc.....

I recently got rid of a different hijacker thing from my housemate's PC, & the only way to clean it properly was to do the scanning & cleaning while in Safe Mode.