Help with CoolWebSearch

[Hawkide]

I am trying to help a friend and it looks like I need help myself. Her IE homepage has been redirected to:

res://xhewa.dll/index.html#37049

CWShredder does not find anything

HijackThis shows some registry additions and changes that look like they are related to this, but I am not sure what to do. Should I just FIX those with CWShredder? Or should I use some sort of spyware software to fix (Spybot did not help). I ahve attached the log from HijackThis below. TIA...

StartupList report, 10/14/2004, 10:32:51 PM
StartupList version: 1.52
Started from : C:\Documents and Settings\User\Desktop\HijackThis.EXE
Detected: Windows XP SP1 (WinNT 5.01.2600)
Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)
* Using default options
==================================================

Running processes:

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ipom.exe
C:\WINDOWS\LTSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
C:\program files\desksite\bin\cma.exe
C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Sony\VAIO Action Setup\VAServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\system32\ntvdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\User\Desktop\HijackThis.exe

--------------------------------------------------

Listing of startup folders:

Shell folders Common Startup:
[C:\Documents and Settings\All Users\Start Menu\Programs\Startup]
Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
America Online 7.0 Tray Icon.lnk = C:\Program Files\America Online 7.0\aoltray.exe
Logitech Desktop Messenger.lnk = C:\Program Files\Desktop Messenger\8876480\Program\LDMConf.exe
Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
VAIO Action Setup (Server).lnk = ?

--------------------------------------------------

Checking Windows NT UserInit:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
UserInit = C:\WINDOWS\system32\userinit.exe,

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LTSMMSG = LTSMMSG.exe
SiS Tray =
ZTgServerSwitch = c:\program files\support.com\client\lserver\server.vbs
NvCplDaemon = RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
QuickFinder Scheduler = "C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100.EXE"
RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
EM_EXEC = C:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE
Desksite CMA = c:\program files\desksite\bin\cma.exe
MPFExe = C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
crxh.exe = C:\WINDOWS\system32\crxh.exe

--------------------------------------------------

Autorun entries from Registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

ipom.exe = C:\WINDOWS\system32\ipom.exe

--------------------------------------------------

Autorun entries from Registry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

LDM = C:\Program Files\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
Yahoo! Pager = C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
msnmsgr = "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

--------------------------------------------------

Shell & screensaver key from C:\WINDOWS\SYSTEM.INI:

Shell=*INI section not found*
SCRNSAVE.EXE=*INI section not found*
drivers=*INI section not found*

Shell & screensaver key from Registry:

Shell=Explorer.exe
SCRNSAVE.EXE=C:\WINDOWS\System32\scrnsave.scr
drivers=*Registry value not found*

Policies Shell key:

HKCU\..\Policies: Shell=*Registry key not found*
HKLM\..\Policies: Shell=*Registry value not found*

--------------------------------------------------


Enumerating Browser Helper Objects:

(no name) - C:\Program Files\adobe\acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
(no name) - C:\WINDOWS\apizb32.dll - {846F9A8E-E7DB-6F52-C00E-3F1ED8F8566C}

--------------------------------------------------

Enumerating Download Program Files:

[BrowseFolderPopup Class]
InProcServer32 = C:\WINDOWS\MCBin\Shared\MGBrwFld.dll
CODEBASE =

http://download.mcafee.com/molbin/Shared/MGBrwFld.cab

[Shockwave ActiveX Control]
InProcServer32 = C:\WINDOWS\system32\Macromed\Director\SwDir.dll
CODEBASE =

http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

[YInstStarter Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\yinsthelper.dll
CODEBASE =

http://download.yahoo.com/dl/installs/yinst.cab

[Quicksilver Class]
CODEBASE =

http://scpwla.ops.placeware.com/etc/place/LIMA/SCLpws-a1/5.1.5.222/lib/quicksilver.cab

[{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}]
CODEBASE =

http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,72/mcinsctl.cab

[RdxIE Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\CONFLICT.1\RdxIE.dll
CODEBASE =

http://207.188.7.150/125fa88aba58500b5906/netzip/RdxIE6.cab

[Pixami/Snapfish Upload UI Control]
InProcServer32 = C:\WINDOWS\DOWNLO~1\SNAPFI~1.OCX
CODEBASE =

http://www.snapfish.com/SnapfishUploader.cab

[Snapfish File Upload ActiveX Control]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\SnapfishUpload1404.ocx
CODEBASE =

http://www.snapfish.com/SnapfishUpload.cab

[CustomerCtrl Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\customerclient.dll
CODEBASE =

http://cs7b.instantservice.com/jars/customerxsigned33.cab

[{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}]
CODEBASE =

http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,19/mcgdmgr.cab

[Shockwave Flash Object]
InProcServer32 = C:\WINDOWS\System32\macromed\flash\Flash.ocx
CODEBASE =

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

[PopCapLoader Object]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\popcaploader.dll
CODEBASE =

http://zone.msn.com/bingame/zuma/default/popcaploader_v5.cab

[GpcContainer Class]
InProcServer32 = C:\WINDOWS\Downloaded Program Files\ieatgpc.dll
CODEBASE =

https://krollworldwide.webex.com/client/latest/webex/ieatgpc.cab

--------------------------------------------------

Enumerating Windows NT logon/logoff scripts:
*No scripts set to run*

Windows NT checkdisk command:
BootExecute = autocheck autochk *

Windows NT 'Wininit.ini':
PendingFileRenameOperations: C:\DOCUME~1\User\LOCALS~1\Temp\GLB1A2B.EXE


--------------------------------------------------

Enumerating ShellServiceObjectDelayLoad items:

PostBootReminder: C:\WINDOWS\system32\SHELL32.dll
CDBurn: C:\WINDOWS\system32\SHELL32.dll
WebCheck: C:\WINDOWS\System32\webcheck.dll
SysTray: C:\WINDOWS\System32\stobject.dll

--------------------------------------------------
End of report, 7,438 bytes
Report generated in 0.047 seconds

Command line options:
/verbose - to add additional info on each section
/complete - to include empty sections and unsuspicious data
/full - to include several rarely-important sections
/force9x - to include Win9x-only startups even if running on WinNT
/forcent - to include WinNT-only startups even if running on Win9x
/forceall - to include all Win9x and WinNT startups, regardless of platform
/history - to list version history only

 

[diogenes10]

You have a particularly difficult coolwebsearch infection.
Fixing it involves using a program called aboutbuster among other things. This is one that I do not understand all the tools involved so I can not give you good specific advice, here is a thread where you can see one experts approach to fixing this problem.

http://computercops.biz/pstp308383-.html#308383

It is most likely that you will have other issues on your system as well. You will have to check out your hijackthis log to see.

-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?

 

[diogenes10]

http://forums.maddoktor2.com/index.php?showtopic=1034

I'd forgotten about this, here is recap of steps maybe it will help you out.


-------------------------------------
It's 10 O'Clock ( somewhere! ).
Are your registry and data backed up?