Hijacked by Find-Any 1

[Ngolem]

This is similar to the CoolSearch virus but an updated CWShredder does nothing to it.

I have a Win95 machine so much of this virus didn't install properly but still it has hijacked my browser....

Can anyone help me get rid of this crap?

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[jrbarnett]

Download HijackThis and run it, then look at the FAQs in this forum by myself and THoey on how to read the log.

John

 

[Ngolem]

Thanks for the direction....I read the Faq on interpreting the logfile, butI am basically a newbie at this. Below is the logfile from HijackThis.

The references to "any-find" seem obvious to fix but I am not sure of the others. BTW I got my version of the IE from
eznsearch and its logo appears at the top of the browser...I suppose this could go too.

Any comments on other things found in this logfile are welcome.....thanks for your help.

******************************************************

Logfile of HijackThis v1.97.7
Scan saved at 9:24:35 AM, on 3/25/04
Platform: Windows 95 B (Win9x 4.00.1111)
MSIE: Internet Explorer v5.51 SP2 (5.51.4807.2300)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\LOADWC.EXE
C:\WINDOWS\LOADQM.EXE
C:\WINDOWS\OLEHELP.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\TEMP\NEW FOLDER\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://any-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://any-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://any-find.com/index.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.yahoo.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.eznsearch.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://any-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by EZN
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://any-find.com/index.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [BrowserWebCheck] loadwc.exe
O4 - HKLM\..\Run: [CookieWall] C:\PROGRAM FILES\ANALOGX\COOKIEWALL\COOKIE.EXE
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\DPPS2.EXE"
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKCU\..\Run: [olehelp] C:\WINDOWS\olehelp.exe
O4 - HKCU\..\Run: [svchost] C:\WINDOWS\SVCHOST.EXE
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O14 - IERESET.INF: START_PAGE_URL=http://www.eznsearch.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -

http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[jrbarnett]

Hi

First, open task manager and see if you can terminate olehelp.exe, then fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://any-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://any-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

http://any-find.com/index.htm

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

http://www.eznsearch.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://any-find.com/sp.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

http://any-find.com/index.htm

O4 - HKCU\..\Run: [olehelp] C:\WINDOWS\olehelp.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.eznsearch.com
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} -

http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

I would also run a good virus scanner over the computer, you don't seem to have any running in the background.

John

 

[carrr]

You might also wish to have a look at the registry keys mentioned here:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.bookmarker.d.html

...as olehelp.exe as detected above is part of the Trojan.Bookmarker.D parasite.

"'Tis an ill wind that blows no minds." - Malaclypse the Younger

 

[Ngolem]

everything seems great now.....thanks

Jim Broadbent

The quality of the answer is directly proportional to the quality of the problem statement!

 

[diogenes10]

Jim,
Just saw your latest thread.
I think you're well on your way to having the material for a book-something like Adventures of the Novice Computer User. I think you got this one fixed up a little easier than some of the earlier ones.