Homepage Hijacked By lookfor.cc

Question

nosfree 0 Newbie Poster

22 Years Ago

my homepage has been hijacked by "home search"

here's my hijackthis log file..

Logfile of HijackThis v1.97.7
Scan saved at 3:46:32 PM, on 6/18/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\System32\DRIVERS\CDANTSRV.EXE
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\MsPMSPSv.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\netxs32.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Icons\Seticon.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\syswq32.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\carcrt40.exe
C:\Program Files\Perfect Keylogger Lite\bpk.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\America Online 9.0a\aoltray.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\WINDOWS\System32\CurQXbj.exe
C:\WINDOWS\System32\Xtl5.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\Program Files\Common Files\Aol\aoltpspd.exe
C:\Program Files\MSN\MSNCOREFILES\msn.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Mike Butt\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ropnc.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://ropnc.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ropnc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://ropnc.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ropnc.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F0 - system.ini: Shell=
F2 - REG:system.ini: Shell=
O2 - BHO: (no name) - {F74B10DD-C3BA-1643-F8BA-F818F5131A48} - C:\WINDOWS\system32\mfcaf32.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\ycomp5_3_19_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [1A:Stardock TrayMonitor] "C:\Program Files\Common Files\Stardock\TrayServer.exe"
O4 - HKLM\..\Run: [TIxDSL] C:\PROGRA~1\TIADSL~1\BIN\WIN2K\tidslmon.exe
O4 - HKLM\..\Run: [Desksite CMA] c:\program files\desksite\bin\cma.exe
O4 - HKLM\..\Run: [IPInSightLAN 01] "C:\Program Files\Verizon Online\VisualIPInsight\IPClient.exe" -l
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\Verizon Online\VisualIPInsight\IPMon32.exe"
O4 - HKLM\..\Run: [SetIcon] C:\Program Files\Icons\Seticon.exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Program Files\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe
O4 - HKLM\..\Run: [syswq32.exe] C:\WINDOWS\system32\syswq32.exe
O4 - HKLM\..\Run: [56Y#Y@H2EL5FTC] C:\WINDOWS\System32\UgmSN8q.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Spyware Begone] c:\freescan\freescan.exe -FastScan
O4 - HKCU\..\Run: [aprtRWi7j] carcrt40.exe
O4 - HKCU\..\Run: [BPK] C:\Program Files\Perfect Keylogger Lite\bpk.exe
O4 - HKLM\..\RunOnce: [netxs32.exe] C:\WINDOWS\netxs32.exe
O4 - HKLM\..\RunOnce: [ntzc32.exe] C:\WINDOWS\system32\ntzc32.exe
O4 - HKLM\..\RunOnce: [ipfg32.exe] C:\WINDOWS\system32\ipfg32.exe
O4 - HKLM\..\RunOnce: [crhh32.exe] C:\WINDOWS\crhh32.exe
O4 - HKLM\..\RunOnce: [atlfs.exe] C:\WINDOWS\system32\atlfs.exe
O4 - HKLM\..\RunOnce: [msfv.exe] C:\WINDOWS\system32\msfv.exe
O4 - HKLM\..\RunOnce: [ntfh32.exe] C:\WINDOWS\system32\ntfh32.exe
O4 - HKLM\..\RunOnce: [addhk32.exe] C:\WINDOWS\addhk32.exe
O4 - HKLM\..\RunOnce: [atlal.exe] C:\WINDOWS\system32\atlal.exe
O4 - HKLM\..\RunOnce: [d3wb32.exe] C:\WINDOWS\system32\d3wb32.exe
O4 - HKLM\..\RunOnce: [ipxw32.exe] C:\WINDOWS\ipxw32.exe
O4 - HKLM\..\RunOnce: [appvb.exe] C:\WINDOWS\system32\appvb.exe
O4 - HKLM\..\RunOnce: [sysih.exe] C:\WINDOWS\sysih.exe
O4 - HKLM\..\RunOnce: [sdkzq32.exe] C:\WINDOWS\sdkzq32.exe
O4 - HKLM\..\RunOnce: [sdkpe.exe] C:\WINDOWS\sdkpe.exe
O4 - HKLM\..\RunOnce: [winib32.exe] C:\WINDOWS\winib32.exe
O4 - HKLM\..\RunOnce: [apioc.exe] C:\WINDOWS\system32\apioc.exe
O4 - HKLM\..\RunOnce: [addck.exe] C:\WINDOWS\addck.exe
O4 - Global Startup: Verizon Online.lnk = C:\Program Files\Verizon Online\VOLSW\Verizon Online.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Control Pad (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: AOL Toolbar (HKLM)
O9 - Extra 'Tools' menuitem: AOL Toolbar (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,81/mcinsctl.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - http://cdn2.adsdk.com/bannerfarm/47309/BundleOuter1132031209.EXE
O16 - DPF: {DC187740-46A9-11D5-A815-00B0D0428C0C} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{2E0A23C0-59A9-4A78-A385-D23B98E74E88}: NameServer =
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C2CFCC8-6E90-4A65-8802-8DCA80B9CCD4}: NameServer =
O17 - HKLM\System\CS1\Services\Tcpip\..\{2E0A23C0-59A9-4A78-A385-D23B98E74E88}: NameServer =

thanx for your time.... i appreciate it

microsoft:windows virus-malware

2 Contributors
1 Reply
205 Views
19 Hours Discussion Span
Latest Post 22 Years Ago Latest Post by crunchie

Dani AI

Generated 6 Months Ago

This log shows a classic homepage‑hijack pattern (IE start/search redirected to a DLL page, an unknown BHO and many weird autostart entries) — lookfor.cc has been tied to CoolWebSearch variants that behave this way. PC Hell: How to Remove Lookfor.cc. (pchell.com)

As recommended, start with a dedicated CoolWebSearch remover (CWShredder) run from Safe Mode with all browsers closed; many removal guides and forums recommend using the archived Merijn/1.59.1 build if you can find it, because later wrapper/hosted builds sometimes misbehave. BleepingComputer discussion on CWShredder and archived builds. (bleepingcomputer.com)

Do not skip the networking check: some trojans alter Windows’ DNS (the NameServer registry values) so browsers are steered through hostile resolvers. Verify and reset your TCP/IP/DNS settings to “obtain automatically” or to a known-good DNS (ISP/OpenDNS), and also check your router’s DNS settings if you use one. Guidance on how malware changes NameServer entries and how to restore DNS is here. [F‑Secure: DNSChanger summary] [Freeola: change DNS in Windows XP]. (f-secure.com)

Final cautions and follow-up: back up HijackThis (use HJT’s backup/restore) before fixing anything, run multiple up‑to‑date anti‑spyware/antivirus scans after CWShredder, and be aware that a keylogger or other covert logger is a higher‑risk finding — if present, isolate the PC, change passwords from a clean machine, and consider a full OS reinstall if the infection persists. [HijackThis usage/backup guide] [Norton on keylogger removal]. (bleepingcomputer.com)

Quick checklist (in order): run CWShredder in Safe Mode → reboot, run full AV + Ad‑aware/Spybot scans → inspect/reset DNS/router → rescan and post a fresh HJT log. If anything is unclear, paste the new HJT log (scan only).

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 1 · 2004-06-19T15:10:59+00:00

Download CWShredder from & run it. Select the fix button & it will get rid of everything related to CoolWebSearch that is stored in it's database. Close ALL windows, including IE, before running CWShredder. Reboot.

To help prevent this from happening again, install the patches for the vulnerabilities that this hijacker exploits by going here for your critical updates.

Unzip HJT into it's own permanent folder before doing anything in order for it to create backups. (Not a temporary folder or directly on the desktop & not directly on your hard drive). Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked' :

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\WINDOWS\System32\SearchBar.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ropnc.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://ropnc.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ropnc.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://ropnc.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\ropnc.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

F0 - system.ini: Shell=

O2 - BHO: (no name) - {F74B10DD-C3BA-1643-F8BA-F818F5131A48} - C:\WINDOWS\system32\mfcaf32.dll

O4 - HKLM\..\Run: [syswq32.exe] C:\WINDOWS\system32\syswq32.exe
O4 - HKLM\..\Run: [56Y#Y@H2EL5FTC] C:\WINDOWS\System32\UgmSN8q.exe

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - http://cdn2.adsdk.com/bannerfarm/47...r1132031209.EXE

Reboot into safe mode following the instructions & navigate to & delete the following if found:

C:\WINDOWS\system32\syswq32.exe< file
C:\WINDOWS\System32\UgmSN8q.exe< file
C:\WINDOWS\system32\ropnc.dll< file

In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.

Reboot after doing this & post another log please.