Jump to content


Photo

Help! I can't get rid of WebSearch Toolbar!


  • Please log in to reply
4 replies to this topic

#1 RichardPugh

RichardPugh

    Member

  • New Member
  • Pip
  • 4 posts

Posted 31 May 2004 - 03:04 PM

Alright, I've been pretty on top of my Spyware for awhile now. I've rid my computer of most of it, but for the past month I have been battling this %^$&# program called Websearch Toolbar. SpySweeper can't delete the files so it tells me to delete them manually; I go to delete them manually and I can't access the folder! I can't access the registry key either. Anyone know of any methods to destroy this bad boy once and for all?





:bounce:
:rofl:

#2 dave38

dave38

    Devout Murphyite!

  • Emeritus
  • PipPipPipPipPip
  • 8,508 posts

Posted 31 May 2004 - 05:07 PM

We need a closer look at what's happening.
Please download Hijack this
Copy it into its own folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, save the log, do Ctrl-A to Select All, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
Be wary of strong drink. It may make you shoot at tax collectors, and miss!
Please support SWI forum

#3 RichardPugh

RichardPugh

    Member

  • New Member
  • Pip
  • 4 posts

Posted 01 June 2004 - 12:21 AM

oops

Edited by RichardPugh, 01 June 2004 - 12:22 AM.


#4 RichardPugh

RichardPugh

    Member

  • New Member
  • Pip
  • 4 posts

Posted 01 June 2004 - 12:21 AM

There's the list. Thanks man!


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Wintab32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Browser Mouse\Browser Mouse\1.0\lwbwheel.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXE
C:\WINDOWS\System32\CTHELPER.EXE
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\CLOSEP~1\findfast.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Adobe\Photoshop 7.0\Photoshop.exe
C:\Program Files\AIM\aim.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Opera7\opera.exe
C:\Program Files\SmartFTP\SmartFTP.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Sonic Foundry\Vegas 4.0\vegas40.exe
C:\Program Files\Sonic Foundry\Vegas 4.0\vegas40.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Documents and Settings\Ricky Pugh\Desktop\hijackthis\HijackThis.exe

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [dvditch] C:\PROGRA~1\CLOSEP~1\findfast.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html

#5 RichardPugh

RichardPugh

    Member

  • New Member
  • Pip
  • 4 posts

Posted 13 June 2004 - 02:04 AM

can anyone help??




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button