Member Avatar for agavzy

All:

I've been reading with great interest the threads regarding IE hijacking and have tried a number of the sugestions in order to get myself fixed, but still seem to be having a problem.

I originally found the following in my Control Panel Add/Remove Programs:
MsSearch
MSIESH
IEFEATSL.DLL

I have downloaded and run the latest and greatest versions of CWSHREDDER, AdAware and Spybot S&D and then have run HijackThis (the text of which is attached).

However, each time I close my browser and open it again it defaults to an ABout:Blank homepage which gives me another search engine page.

PLease tell me how I can get rid of the accursed fiend!
I am running on Windows XP Home eddition with 4 users.

Thanks!
- - Aaron

Logfile of HijackThis v1.97.7
Scan saved at 8:53:56 AM, on 4/26/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\cisvc.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\BRMFRSMG.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\QUICKENW\QWDLLS.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Visitor\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ckl.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ckl.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ckl.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\System32\ckl.dll/sp.html (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\System32\ckl.dll/sp.html (obfuscated)
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\System32\ckl.dll/sp.html (obfuscated)
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O1 - Hosts: doxdesk.com
O1 - Hosts: www.safer-networking.org
O1 - Hosts:
O1 - Hosts: www.security.kolla.de
O1 - Hosts: www.spybot.info
O1 - Hosts: www.spychecker.com
O1 - Hosts: www.spychecker.com
O1 - Hosts: www.spycop.com
O1 - Hosts: www.spyguard.com
O1 - Hosts: www.spykiller.com
O1 - Hosts:
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: (no name) - {4B82C6E3-540E-42B2-B92D-52DE58CD04D0} - C:\WINDOWS\System32\ckl.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [MCAgentExe] C:\Program Files\McAfee.com\Agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\McUpdate.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [sr1exe] "C:\Documents and Settings\All Users\Application Data\Dell\Alert\252\updtSup3.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) -
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) -

  • 3 Contributors
  • 4 Replies
  • 236 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by agavzy

Dani AI

Generated

’s HijackThis output and the Add/Remove entries match a CoolWebSearch–type hijack; correctly called that variant. These infections typically install a small DLL that Internet Explorer is pointed to (via res:// entries), and they often modify the hosts file to block anti‑spyware sites — which is why scanners sometimes report removal but the hijack returns. (zemana.com)

Practical removal checklist (do these in Safe Mode; back up the registry and create a System Restore point first):

  1. Run an updated CoolWebSearch remover (CWShredder) then follow with current anti‑malware scanners (Spybot, Ad‑aware, Malwarebytes). CWShredder was the targeted tool for CWS variants. (support.moonpoint.com)
  2. Inspect and restore the hosts file (C:\Windows\System32\drivers\etc\hosts). Remove any 127.* mappings that redirect legitimate anti‑spyware domains. BleepingComputer’s HijackThis notes this O1/hosts behavior and how it blocks sites. (bleepingcomputer.com)
  3. Use Autoruns (Sysinternals) to find and disable persistence points: Browser Helper Objects, IE toolbars, Run/RunOnce keys, AppInit_DLLs and other auto‑start locations. Disable suspicious entries, then reboot and delete the backing files from system32 (rename first if deletion is blocked). (learn.microsoft.com)

If the hijack reappears after these steps, a secondary dropper or scheduled task is likely reinstalling it; a full offline scan (bootable rescue disk) or a clean OS reinstall can be the final remedy. Manual registry edits solve many stubborn cases but carry risk — always export keys before changing them. ’s tip about linking directly to precise fixes is useful when following community removal guides. (zemana.com)

Summary: the symptom set matches CoolWebSearch; try the Safe‑Mode -> CWShredder -> anti‑malware -> Autoruns workflow, back up before editing the registry, and escalate to offline/clean install if persistence continues.

Recommended Answers

All 4 Replies

Member Avatar for crunchie

You are going to love this. You have the latest variant of the coolwebsearch infection. As of now the only fix available is very long winded & involves going into the registry. I will give you the link to the fix & you can then decide whether to go ahead now, or wait for the automatic removal tools to be updated. (If they will be/can be) Other than that I suggest you use Opera or Mozilla browser until there is a fix.

http://www.wilderssecurity.com/showthread.php?t=28658

Member Avatar for caperjack

just a tip ,instead of posting the link to all the post in that thread ,click on the # of the post in the thread and use that so the person gets to the one releated to them ,instead of having to read and figure out what one is the right one .like this .

http://www.wilderssecurity.com/showpost.php?p=162440&postcount=4

Member Avatar for crunchie

just a tip ,instead of posting the link to all the post in that thread ,click on the # of the post in the thread and use that so the person gets to the one releated to them ,instead of having to read and figure out what one is the right one .like this .

http://www.wilderssecurity.com/showpost.php?p=162440&postcount=4

Cool. Didn't know you could do that. :D

Member Avatar for agavzy

ALL FIXED!!!!!


Gents - thank you VERY much!!!!!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.