How to remove IDGSEARCH (Please help)

[jiayir]

Hi,
I've installed Hijackthis...I've already removed everything that looks like "idgsearch related". Could you take a look at the log files, and explain what changes we can make to our desktop to mimize future impacts.

Thanks,

Jiayir

SCAN RESULTS:
>>>>>>>>>>>>>>>>>>>>


Logfile of HijackThis v1.97.7
Scan saved at 12:11:27 PM, on 11/19/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\NORTON~1\navapw32.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Media\Media\UpdateStats.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~1\AIM95\aim.exe
C:\WINDOWS\accesso[1].exe
C:\WINDOWS\accesso[1].exe
C:\WINDOWS\accesso[1].exe
C:\WINDOWS\accesso[1].exe
C:\Program Files\Common Files\efax\HotTray.exe
C:\Program Files\Common Files\efax\Dllcmd32.exe
C:\Program Files\Souvenir\Souvenir 4.0\souvServer.exe
C:\WINDOWS\System32\UrvQa.exe
C:\WINDOWS\System32\ZslJoqfy.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Office\Desktop\HijackThis.exe

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} -
C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program
files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\navapw32.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program
Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [2N85L533MR#GJT] C:\WINDOWS\System32\MkpjPr5.exe
O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM95\aim.exe -cnetwait.odl
O4 - HKLM\..\RunOnce: [Ad-aware] "C:\Program Files\Lavasoft\Ad-aware
6\Ad-aware.exe" "+b1"
O4 - Startup: Autoconfigure Ella.lnk = C:\WINDOWS\system32\regsvr32.exe
O4 - Startup: Souvenir Server.lnk = C:\Program Files\Souvenir\Souvenir
4.0\souvServer.exe
O4 - Global Startup: eFax.com Tray Menu.lnk = C:\Program Files\Common
Files\efax\HotTray.exe
O4 - Global Startup: Live Menu.lnk = C:\Program Files\Common
Files\efax\Dllcmd32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft
Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel
present
O8 - Extra context menu item: &Google Search - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program
Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: AIM (HKLM)
O12 - Plugin for .spop: C:\Program Files\Internet
Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com/start.html
O16 - DPF: Yahoo! Backgammon -

http://download.games.yahoo.com/games/clients/y/at0_x.cab

O16 - DPF: Yahoo! Bridge -

http://download.games.yahoo.com/games/clients/y/bt0_x.cab

O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client
Proxy) -

http://64.124.45.181/downloads/ccpm_0237.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -

http://download.yahoo.com/dl/installs/yinst.cab

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -

http://a1540.g.akamai.net/7/1540/52/200212...pple.com/borris

/us/win/QuickTimeInstaller.exe
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield
International Setup Player) -

http://www.installengine.com/engine/isetup.cab

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -

http://v4.windowsupdate.microsoft.com/CAB/...AB?37582.610127

3148
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwa...ash/swflash.cab

 

[carrr]

In a nutshell, surf with your eyes open. Never agree to any pop-ups wanting consent for installation. Stay up on the latest threats...good sources (though not exhaustive) are:

http://www.doxdesk.com/

http://www.spywareinfo.com/

http://tomcoyote.org/forums/ipdl.php

Download, install, update, and configure the IMMUNIZE function of SpyBot:

http://www.safer-networking.org/

I'd also look into packing your HOSTS file to ward off a slew of potential attackers. See this site:

http://someonewhocares.org/hosts/

Look into other spyware blockers as well...this recent thread has good suggestions all around: thread83-710926

These are just a few suggestions. You're never going to be 100% safe, especially when you've got users without slues/cares...spyware/hijack creators are moving so fast anymore...but you can arm yourself to the teeth and really minimize your risk.

 

[carrr]

and, by the way, these two entries strike me a suspect:

C:\WINDOWS\System32\UrvQa.exe
C:\WINDOWS\System32\ZslJoqfy.exe

Possibly viruses/virus related...I'd do a thorough scan with the latest definitions. If you don't have AV - get some...but you can go here in the meantime for a free online scan:

http://housecall.trendmicro.com/

 

[steamwiz]

idgsearch is a redirect of CWS

Download and run this program :-

http://www.spywareinfo.com/~merijn/files/cwshredder.zip

These 2 :-

C:\WINDOWS\System32\UrvQa.exe
C:\WINDOWS\System32\ZslJoqfy.exe

and this :-

O4 - HKLM\..\Run: [2N85L533MR#GJT] C:\WINDOWS\System32\MkpjPr5.exe

Are the peper.a trojan - and it is not easy to get rid of

see this link for instructions :-

http://www.mjc1.com/files/peperpage/

When done - post another hijackthis log - there will be more to fix

steam

 

[carrr]

That is a b*&#h to remove manually.
How 'bout one of these avenues?

http://www.wilders.org/anti_trojans.htm

...TDS-3 might can pull it off

And there's another uninstaller offered up here:

http://www.computercops.biz/postt6849.html

 

[odysse1]

For all people who has probleme with IDGSEARCH
and the MSGoodle.dll (folder application data)
the trojan comes whith the updat of windows media player 9 :
remove it whith all bug correctjf of windows media player , destroy MSGoogle.dll etc...
and reinstall it after to reboot.

Spyware don't know this trojan right now.
Tell it to others people.
Cheers
Odysse1