1) OE will not allow me to display the content of messages. It seems to d/l OK from Hotmail, but when I click on the message to read it, I get an unending hourglass and no content. I updated from M/S site the critical updates I needed and still no go.
2) EVERYTIME I boot up searchxl tries to hijack my search page. Spyguard catches it, but it continues to repeatedly try. I went under regedit and deleted the reference but something keeps trying to re-install it. This just stared repeating itself. Up until today it would just try to hijack once and then stop.
For both of these problems I have run AVG, Spybot and Adaware. I went and googled every running processes that I saw and the only ones I couldn't find were Service, Osd and Vcobyeiv. Any info or links to help me research these problems would be appreciated.
Also if it is best to re-install OE, will that erase messages that I have in my local folders. Thanks.
That'sAllFolks
07-24-04, 04:26 AM
Here is an update:
Shortly after I posted this I ran Adawar and got 10 problems. I fixed them. Cruised on DVDTalk a bit (Only going to a AOL page and that political flash with Kerry and Bush). I noticed that my machine started to run slow after I watched that Kerry/Bush flash and so I ran Adaware again -- NO PROBLEMS.
So I reboot and run get the searchxl.com message again. I run Adaware and get 9 problems. Had some system problems (too much running) and rebooted again. Adaware brings 15 problems: Logfile below:
No sure where to go from here. ANY SUGGESTIONS. BTW I also have the logfile from the scan with 10 problems (1st one mentioned -- but didn't want to make this TOO long)
Lavasoft Ad-aware Personal Build 6.181
Logfile created on :Saturday, July 24, 2004 3:08:19 AM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R333 18.07.2004
______________________________________________________
Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
#:34 [tapisrv.exe]
FilePath : C:\WINDOWS\SYSTEM\
ProcessID : 4294290231
Threads : 4
Priority : Normal
FileSize : 120 KB
FileVersion : 4.90.3000
ProductVersion : 4.90.3000
Copyright : Copyright (C) Microsoft Corp. 1994-1998
CompanyName : Microsoft Corporation
FileDescription : Microsoft
InternalName : Telephony Service
OriginalFilename : TAPISRV.EXE
ProductName : Microsoft(R) Windows(R) Millennium Operating System
Created on : 1/1/1601
Last accessed : 7/24/2004 5:00:00 AM
Last modified : 6/8/2000 10:00:00 PM
Memory scan result :
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 0
Objects found so far: 0
Started registry scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
CoolWebSearch Object recognized!
Type : RegData
Data : http://www.searchxl.com/ie/
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : SearchURL
Data : http://www.searchxl.com/ie/
Registry scan result :
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 1
Objects found so far: 1
Started deep registry scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Bar.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainDefault_Search_URL.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\SearchSearchAssistant.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Search
Value : SearchAssistant
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet ExplorerSearchURL.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer
Value : SearchURL
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainSearch Page.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Search Page
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\MainDefault_Search_URL.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\SearchSearchAssistant.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_LOCAL_MACHINE
Object : Software\Microsoft\Internet Explorer\Search
Value : SearchAssistant
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : .Default\Software\Microsoft\Internet Explorer\MainSearch Bar.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer\Main
Value : Search Bar
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : .Default\Software\Microsoft\Internet Explorer\MainDefault_Search_URL.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer\Main
Value : Default_Search_URL
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : .Default\Software\Microsoft\Internet Explorer\SearchSearchAssistant.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer\Search
Value : SearchAssistant
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : .Default\Software\Microsoft\Internet ExplorerSearchURL.searchxl.com
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "http://www.searchxl.com/ie/"
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer
Value : SearchURL
Data : "http://www.searchxl.com/ie/"
Possible browser hijack attempt : Software\Microsoft\Internet Explorer\SearchCustomizeSearchabout:blank
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Search
Value : CustomizeSearch
Data : "about:blank"
Possible browser hijack attempt : .Default\Software\Microsoft\Internet Explorer\SearchCustomizeSearchabout:blank
Possible Browser Hijack attempt Object recognized!
Type : RegData
Data : "about:blank"
Rootkey : HKEY_USERS
Object : .Default\Software\Microsoft\Internet Explorer\Search
Value : CustomizeSearch
Data : "about:blank"
Deep registry scan result :
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 13
Objects found so far: 14
CoolWebSearch Object recognized!
Type : RegValue
Data :
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
Value : ITBarLayout
Conditional scan result:
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 1
Objects found so far: 15
3:13:35 AM Scan complete
Summary of this scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
Total scanning time :00:05:16:40
Objects scanned :45539
Objects identified :15
Objects ignored :0
New objects :15
That'sAllFolks
07-24-04, 05:41 AM
Don;t know if this is helpful, but it is a log form Hijack this.
THANKS.
Logfile of HijackThis v1.98.0
Scan saved at 4:36:51 AM, on 7/24/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Instructions on how to configure are at the bottom of the post
1)Configure AdAware forFullScan mode,
2)Update you defintions for AVG or try another virus/trojan scanner
3)Disable System Restore, then
3)Boot to safe mode
Once in Safe Mode
1)Run AVG (set to scan ALL files including compressed(zipped Files) on your hard drives
2)Run AdAware in FullScan mode
3)RunHiJackThis Again and let it fix/delete these Items
4) Run CWShredder
C:\WINDOWS\VCOBYEIV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.search/sp.php
O4 - HKLM\..\Run: [WinSP] REGEDIT.EXE -s c:/sysreg.reg
O4 - HKLM\..\RunServices: [IPConfig] ipconfigs.exe (Trojan. see below for remedy)
O4 - HKLM\..\Run: [IPConfig] ipconfigs.exe (Trojan. see below for remedy)
(http://securityresponse.symantec.com/avcenter/venc/data/backdoor.hacarmy.c.html)
Make sure sure uncheck the safemode option in "msconfig" upon completion of this exersise to enter Xp Normally
Boot into Windows XP Normally
Run Adaware, and HiJackThis, scan with AVG and run CWShredder(post the new log here)
When Clean,you can re-enable system Restore
NOTE:
You may want to consider to try FireFox, Mozilla or anything not IE or a shell of IE
related.
Essential Spyware, Hijacking prevention/monitoring tools:
SpywareGuard
SpywareBlaster
Adaware
HiJackThis http://www.majorgeeks.com/download3155.html
Run a scan, when the scan is finshed then button will change to "save Log". Save the log to the hard drive. Open the log with notepad or any editor(make sure always open with is
unchecked), copy and paste the contents here and I will look for anything suspicious.
SpyBot
BHO Demon 2.0
Use a HostFile (I think SW Guard includes this in the program)
A registry/startup Monitor like regprot
CWShredder http://www.majorgeeks.com/download4086.html
1) ADAWARE 6.181
In Ad-aware click the Gear to go to the Settings area.
The following items should be on a green check, not on a red X.
Under the Scanning button:
Scan within archives
Under Memory & Registry, Check EVERYTHING
In Check Drives & Folders, make sure all of your hard drives are selected
Under the Advanced button, check ALL under Log detail level (this makes it easier for
visitors to the Lavasoft Support Forums to see what options you have selected should you
require assistance.)
Under the Tweak button...
Some of these may not be an available option, depending on your version of Ad-aware and your
version of Windows. Do not be concerned if you cannot select a certain item.
In Scanning Engine:
Unload recognized processes during scanning
Include info about ignored objects in logfile, if detected in scan
Include basic Ad-aware settings in logfile
Include additional Ad-aware settings in logfile
Include used command line parameters in logfile
In Cleaning Engine:
XP/2000: Allow unloading explorer to unload shell extensions prior to deletion
Let Windows remove files in use at next reboot
UNCHECK: Automatically try to unregister objects prior to deletion
Click Proceed to save these settings. When you would like to perform a "Full Scan," switch
the scan mode from SmartScan to Custom.
2)SYSTEM RESTORE IN XP:
To turn off Windows XP System Restore
1. Click Start > Programs > Accessories > Windows Explorer
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Check the "Turn off System Restore" or "Turn off System Restore on all drives" check
box.
5.Click Apply. The a confirmation message appears.
6. This will delete all existing restore points. Click Yes to do this.
7. Click OK.
8. Proceed with what you need to do. For example, removing viruses. Restart the computer and
follow the instructions in the next section to turn on System Restore.
3)Entering Safemode the Easy way (or you can use F8 at startup)
Click on Start,
then Run.
In the Run dialog box type "msconfig" and press enter to start the MSCONFIG utility
click on the Boot.ini tab you will see some checkboxes at the bottom under Boot Options.
Click the checkbox next to /SAFEBOOT and select Minimal.
That'sAllFolks
07-24-04, 11:24 PM
Thank you so much for taking the time to give me this detail explanation in taking care of these problems. I think for the most part they are fixed. My OS is WinME and so a couple of differences occurred. I've explained below. OE seems to be OK now and the attempts to hijack the search occurred after my first book, but not after my second. Actually I tthink that ZoneAlarm just detetected a setting back the way it SHOULD have been and asked my permission because they were all going FROM searchxl.com to something else.
I will post the logfiles for hijack and Adaware in the next two posts.
QUESTION: Should I contine to run Adaware customized or should I switch back to automatic mode?
Originally posted by 68ShelbyGT500KR
3)Disable System Restore, then
ce in Safe Mode
1. Click Start > Programs > Accessories > Windows Explorer
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Check the "Turn off System Restore" or "Turn off System Restore on all drives" check
box.
5.Click Apply. The a confirmation message appears.
6. This will delete all existing restore points. Click Yes to do this.
7. Click OK.
8. Proceed with what you need to do. For example, removing viruses. Restart the computer and
follow the instructions in the next section to turn on System Restore.
Click the checkbox next to /SAFEBOOT and select Minimal.
I am not sure what the equivalent to these two steps is in Win ME. I tried to look around and could not find ANYTHING that look similar to disabling system restrore. I booted up in SAFE mode using F8, so I guess that's all the checkbox near /SAFEBOOT means in XP???
Originally posted by 68ShelbyGT500KR
3)RunHiJackThis Again and let it fix/delete these Items
I'm not sure what this means. There were no options to check these. In fact they were not even listed.
That'sAllFolks
07-24-04, 11:34 PM
Logfile of HijackThis v1.98.0
Scan saved at 8:05:24 PM, on 7/24/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Lavasoft Ad-aware Personal Build 6.181
Logfile created on :Saturday, July 24, 2004 7:48:35 PM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R333 18.07.2004
______________________________________________________
Reffile status:
=========================
Reference file loaded:
Reference Number : 01R333 18.07.2004
Internal build : 265
File location : C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\reflist.ref
Total size : 1314436 Bytes
Signature data size : 1293449 Bytes
Reference data size : 20923 Bytes
Signatures total : 28676
Target categories : 10
Target families : 526
Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium IV
Memory available:4 %
Total physical memory:130088 kb
Available physical memory:6616 kb
Total page file size:1967060 kb
Available on page file:1816896 kb
Total virtual memory:2093056 kb
Available virtual memory:2040960 kb
OS:Windows (ME)
Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-aware Settings
=========================
Set : Unload recognized processes during scanning
Set : Include basic Ad-aware settings in logfile
Set : Include additional Ad-aware settings in logfile
Set : Let windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Always back up reference file, before updating
Set : Play sound if scan produced a result
Sorry about the OS, I didn't see that you were using Win ME.I was assuning XP.
To Disable system restore Windows ME
1) Click Start > Settings > Control Panel.
2) Double-click the System icon.
Note: If the System icon is not visible, click "View all Control Panel options" to display it.
3) On the Performance tab click File System.
4) Click the Troubleshooting tab, and then check Disable System Restore
5) Click OK. Click Yes, when you are prompted to restart Windows.
Boot into Safemode in Windows 98 and ME (without the F8 key at startup)
1) Close all open programs.
2) Click Start > Run. The Run dialog box appears.
3) Type msconfig and then click OK
4) In the Advanced Troubleshooting Settings dialog box, check Enable Startup Menu.Click OK. Click OK again when the System Configuration Utility reappears.
5) You will be prompted to restart the computer. Click Yes. The computer will restart in Safe mode. (This can take several minutes.)
When you have disabled System Restore and are in SafeMode do the following:
Enable the task manager via CTRL ALT Del ( it should have a list of apps running/processes)
Highlight and stop these 2 processes: VCOBYEIV.EXE and DDHELP.EXE
Once stopped, go to Windows Explorer and navigate to these locations and delete the files. If it gives an error message and won't delete, try to right click on the file and select "properties" and un-check "read only: and change to "archive".Click OK. Try to delete again
Run Adaware is customized (detailed), like before and remove anything it finds.
Run HijackThis and let it Fix these items.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/mo...ton/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.search/sp.php
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [jbcoosn] C:\WINDOWS\vcobyeiv.exe
Save log, reboot into Windows Normally and re-post your log.
Did you run a full AVG virus scan?
I keep my Adaware set for the full scan(though it takes longer to run) but you can do waht you want at your discretion. Let's make sure your system is totally clean first!
Sorry about the OS Problem.
That'sAllFolks
07-29-04, 12:06 PM
Thanks for taking the time to update this for ME. I have been really busy the last couple of days and have not had the time to try this until now.
First I could not delete VCOBYEIV.EXE and DDHELP.EXE in Safe Mode. They were not there in the task mamanger. So, I re-booted back into Normal and deleted them as explained. I then went back into Safe Mode and ran Adaware. I then ran HiJackThis twice. Once deleting the processes listed and then an "after" image. The log posted is the "after" image log.
Also I assume I should back out of "Disablie System Restore" now that I'm finished. I still have it checked and was planning on unchecking it when I finished running AVG. BTW, I think I am running a full scan. All the boxes are checked in the email scanner tab and the check virus part of Resident Shield. Anyway I will be running that as soon as I finish posting the logs here.
Thanks again for your detailed explanation. I am archiving this info in case this happens again.
That'sAllFolks
07-29-04, 12:07 PM
Logfile of HijackThis v1.98.0
Scan saved at 10:27:26 AM, on 7/29/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Lavasoft Ad-aware Personal Build 6.181
Logfile created on :Thursday, July 29, 2004 9:57:10 AM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R334 24.07.2004
______________________________________________________
Reffile status:
=========================
Reference file loaded:
Reference Number : 01R334 24.07.2004
Internal build : 268
File location : C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6\reflist.ref
Total size : 1316091 Bytes
Signature data size : 1295051 Bytes
Reference data size : 20976 Bytes
Signatures total : 28648
Target categories : 10
Target families : 528
Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium IV
Memory available:63 %
Total physical memory:130108 kb
Available physical memory:54336 kb
Total page file size:1967040 kb
Available on page file:1967040 kb
Total virtual memory:2093056 kb
Available virtual memory:2043328 kb
OS:Windows (ME)
Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-aware Settings
=========================
Set : Unload recognized processes during scanning
Set : Include basic Ad-aware settings in logfile
Set : Include additional Ad-aware settings in logfile
Set : Let windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Always back up reference file, before updating
Set : Play sound if scan produced a result
7-29-2004 9:57:10 AM - Scan started. (Custom mode)
Conditional scan result:
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
New objects : 0
Objects found so far: 9
10:07:55 AM Scan complete
Summary of this scan
ŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻŻ
Total scanning time :00:10:45:100
Objects scanned :158923
Objects identified :9
Objects ignored :0
New objects :9
68ShelbyGT500KR
07-29-04, 07:12 PM
Run HijkackThis and let it fix this line.
O3 - Toolbar: REALBAR - {4E7BD74F-2B8D-469E-C0FF-FD60B590A87D} - C:\PROGRA~1\COMMON~1\REAL\TOOLBAR\REALBAR.DLL
The Purpose of disabling System Restore is to "flush" viruses, trojans and any other parasites from your system.
Once you let HijackThis Fix the 1 "03" item above, Re-Run HijackThis to make sure it is gone.
After is is Confirmed gone, go ahead and enable System Restore.
Your system should be running normal. Keep Everything updated and scan weekly.
That'sAllFolks
08-03-04, 04:35 PM
To 68ShelbyGT500KR:
A THOUSAND THANKS!!!!!!
:wave: :wave: :wave: :wave: :wave: :wave:
68ShelbyGT500KR
08-03-04, 08:27 PM
Originally posted by That'sAllFolks
To 68ShelbyGT500KR:
Buy: