Member Avatar for heho

Hi, I recently encountered Coolwebsearch. I used adaware, spybot and hijack this and successfully deleted the spyware. However, now I am unable to browse secure websites. I get a "page cannot be displayed" site. Please help, I am desperate here! Oh yeah, I did everything imaginable. I downloaded winsockfix, it didnt work, and when i did it the 2nd time my internet didnt work at all. so i had to do system restore. I did all of the internet options, and flushed the dns, and reregistered the register keys. I also did pagefix which didnt work either.

my hijack this log
Logfile of HijackThis v1.99.1
Scan saved at 2:05:23 AM, on 8/3/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\SYSTEM32\CMD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\hijackthis\HijackThis.exe

O4 - HKLM\..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinNite] C:\WINDOWS\NITEAIM.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exe

  • 2 Contributors
  • 1 Reply
  • 205 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

Short summary and focused checklist (adds to and ):

CoolWebSearch and similar hijackers commonly leave behind a hostile hosts file and add/alter networking hooks (Winsock/LSP, proxy settings or BHOs) that will let HTTP work but break HTTPS/login pages. (softpanorama.org)

Important checks (concise, in roughly the order that usually helps):

  • Hosts file: inspect C:\WINDOWS\system32\drivers\etc\hosts for any lines redirecting real sites (especially banking or search sites) to other IPs or to 127.0.0.1; restore the normal hosts file if anything looks odd. The hosts file is a frequent target of CWS variants. (bleepingcomputer.com)

  • Proxy / IE settings and registry: verify LAN Settings (Tools → Internet Options → Connections → LAN Settings) has no unexpected proxy set. Check HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for ProxyEnable / ProxyServer entries — malware often leaves a local proxy that breaks SSL. (devblogs.microsoft.com)

  • IE crypto state and DLL registrations: clear the SSL state (Internet Options → Content → Clear SSL state) and, if that does not help, re-register the cryptographic/IE DLLs that Windows uses for HTTPS. Run an elevated command prompt and enter the following (one line at a time), then reboot:

    cd /d %windir%\system32
regsvr32 softpub.dll
regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 dssenh.dll
regsvr32 rsaenh.dll
regsvr32 gpkcsp.dll
regsvr32 sccbase.dll
regsvr32 slbcsp.dll
regsvr32 mssip32.dll
regsvr32 cryptdlg.dll

    Re-registering these DLLs is a known fix for "cannot view secure sites" errors. (learn.microsoft.com)

  • Winsock / LSP corruption: was right to suggest a Winsock repair — but on Windows XP the available fix depends on the Service Pack. The newer netsh winsock reset is reliable on XP SP2+, but XP SP1 machines used tools like WinsockXPfix; any Winsock repair should be done only after backing up the registry / creating a restore point because it can break networking-dependent software. ()

Quick diagnostic additions: try Internet Explorer (No Add-ons) to rule out a BHO/plugin and confirm the system clock is correct (bad date/time will make certificates look invalid). If hosts/proxy/Winsock/DLL re-registrations don’t restore HTTPS, a carefully staged restore from a pre-infection image or a clean reinstall is often the final recourse for persistent CWS remnants. (learn.microsoft.com)

Member Avatar for dlh6213

Hi-ho Heho, welcome to DaniWeb :D

Did you try WinsockXPFix?

Run it, and click the Fix button; choose YES when asked if you want to proceed.

If it still doesn't work, try IEFix --

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.