Jump to content


There Back

  • Please log in to reply
2 replies to this topic

#1 bobwbs



  • Full Member
  • Pip
  • 4 posts

Posted 30 June 2004 - 02:27 PM

All my fixes did not work I know these pests are in a Startup File somewhere i just don't see them.

#2 The Fist

The Fist


  • Full Member
  • Pip
  • 50 posts

Posted 30 June 2004 - 02:49 PM


Please read the FAQ HERE, run CWShredder, Spybot and Ad-Aware. Then load Hijack This into its own directory (e.g. c:\HJT) and run Hijack This. Then post the entire Hijack This log file. That way someone can help you.

Edited by The Fist, 30 June 2004 - 02:50 PM.

#3 bobwbs



  • Full Member
  • Pip
  • 4 posts

Posted 01 July 2004 - 08:14 AM

I am a novice when it comes to navigating software, but I have followed all the recommended fixes FAQ as best I know how. I have been somewhat successful in getting rid of a few spyware that have completely taken over my XP system. You name it I had it, CoolWWW, HomeOldsp, about:blank, cws.googlems, JS Search, Cool Web Search. Search Asst'n. GhostSurf Pro, Spy Sweeper & Spybot S&D are keeping them at bay. I spend more time denying access to attacks than surfing. My desktop is a collection of Spyware killer icons. Spy Sweeper is the only one that identified CoolWWW and CAX Proxy. Every attempt at removing them has failed. They keep coming back. I cannot locate them in any Startup folder. Hijack This log shows what I believe to be it but the fix will not......it comes back.
CWShredder, Spybot, both "Tenebril sweppers say my system is clean. about:blank keeps attempting to hijack my home page.

Logfile of HijackThis v1.97.7
Scan saved at 7:47:13 PM, on 6/29/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe
C:\Program Files\SpyCatcher\DeleteSatellite.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\GhostSurf\GhostSurf.exe
C:\Program Files\SpyCatcher\Scheduler daemon.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Documents and Settings\MG\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\MG\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
O2 - BHO: (no name) - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS\System32\IETie.dll
O4 - HKLM\..\Run: [AcctMgr] C:\Program Files\Norton SystemWorks\Password Manager\AcctMgr.exe /startup
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\Grisoft\AVG6\avgcc32.exe /STARTUP
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKLM\..\RunOnce: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe" nowait
O8 - Extra context menu item: Allow personal info to reach this site - file://C:\Program Files\GhostSurf\info.allow.html
O8 - Extra context menu item: Allow popups on this site - file://C:\Program Files\GhostSurf\popup.allow.html
O8 - Extra context menu item: Allow this advertisement - file://C:\Program Files\GhostSurf\menu.allowimg.html
O8 - Extra context menu item: Block personal info from this site - file://C:\Program Files\GhostSurf\info.block.html
O8 - Extra context menu item: Block popups on this site - file://C:\Program Files\GhostSurf\popup.block.html
O8 - Extra context menu item: Block this advertisement - file://C:\Program Files\GhostSurf\menu.blockimg.html
O9 - Extra button: GhostSurf Privacy Center (HKLM)
O9 - Extra 'Tools' menuitem: GhostSurf Privacy Center (HKLM)
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of

Support SpywareInfo Forum - click the button
PayPal - The safer, easier way to pay online!