PCTech Forums

by **msiler** » Mon Jun 07, 2004 4:33 am

I am plagued by the constant return of the following 3 items

Common hijacker: Redirected host
Search.netscape.com=207.36.196.189

Common hijacker: Redirected host
Auto.search.msn.com=207.36.196.189

IGetNet: Redirected host
ieautosearch=207.36.196.189

When I run Hijack this I can "clean" them but they just return shortly.

When I run Spybot S&D and try to "Fix" them I get the following message:

Unexpected error in fixing threats
(Datei "D:\Winnt\System32\etc\hosts" Kann Nicht Erstellt Werden. The Process cannot access the file beacause it is being used by another process)

Two questions:
1) What's up with this error message and how can I fix this?
When i go to the "...etc\hosts" file there is only one 1kb host file and it will absolutely not be deleted (I was able to delete 3 other host files though).

2) How do i change the "Destination Address" of these three "Hosts"?
I want to change it to 127.0.0.1 and at least fool them to start

Thank you in advance,
-Matt-

by **liljim** » Mon Jun 07, 2004 6:12 am

Try booting in safe mode,then disable system restore.Delete the unwanted files,reboot then turn system restore back on.

by **msiler** » Mon Jun 07, 2004 12:37 pm

I am using Windows 2000pro.
There is no System Restore to turn off.

Any other way to accomplish what you recommend?

-Matt-

by **brad** » Mon Jun 07, 2004 12:53 pm

It's a common hijack attempt to change your Search Engine.
I'd download and install: . Now Run it and post a copy of the Log File here.
(Always create a Folder for HiJackThis anywhere but your Temp/Temporary Internet Folders. This is where it will save the backup files needed if there's a problem.)

brad

by **Restek** » Mon Jun 07, 2004 1:09 pm

Did you try doing it in safe mode?

by **msiler** » Wed Jun 09, 2004 3:14 am

An unexpected error has occurred at procedure: modMain_FixOther1Item(sItem=O1 - Hosts: 207.36.196.189 ieautosearch)
Error #70 - Permission denied

Windows version: Windows NT 5.00.2195
MSIE version: 6.0.2800.1106
HijackThis version: 1.97.7

Above is the Error Message I get everytime I run Hijackthis and then try to fix these three problems: (hijackthis log in my next post)

1) Search.netscape.com=207.36.196.189
2) Auto.search.msn.com=207.36.196.189
3) ieautosearch=207.36.196.189

They refuse to be removed and always come back upon re-boot. Even after removing them in Safe Mode.

If I cannot remove them then at least maybe I can change their Addresses so they are no longer a problem.

How do I change their "Destination Address" to 127.0.0.1

by **msiler** » Wed Jun 09, 2004 3:15 am

Logfile of HijackThis v1.97.7
Scan saved at 10:13:43 PM, on 6/8/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
D:\WINNT\System32\smss.exe
D:\WINNT\system32\winlogon.exe
D:\WINNT\system32\services.exe
D:\WINNT\system32\lsass.exe
D:\WINNT\system32\svchost.exe
D:\WINNT\system32\spoolsv.exe
D:\WINNT\system32\cisvc.exe
D:\Program Files\Executive Software\DiskeeperLite\DKService.exe
D:\WINNT\System32\svchost.exe
D:\WINNT\system32\gearsec.exe
D:\PROGRA~1\Iomega\System32\AppServices.exe
d:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
D:\PROGRA~1\NORTON~1\NORTON~3\navapsvc.exe
D:\PROGRA~1\NORTON~1\NORTON~3\npssvc.exe
D:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
D:\WINNT\system32\regsvc.exe
D:\WINNT\system32\MSTask.exe
D:\Program Files\Norton SystemWorks\Norton Speed Disk\nopdb.exe
D:\WINNT\system32\stisvc.exe
D:\WINNT\System32\TSIRCSRV.EXE
D:\WINNT\System32\WBEM\WinMgmt.exe
D:\WINNT\System32\mspmspsv.exe
D:\WINNT\system32\svchost.exe
D:\Program Files\Iomega\AutoDisk\ADService.exe
D:\WINNT\system32\inetsrv\inetinfo.exe
D:\WINNT\system32\rundll32.exe
D:\WINNT\Explorer.EXE
D:\PROGRA~1\NORTON~1\NORTON~3\alertsvc.exe
D:\PROGRA~1\mcafee.com\agent\mcagent.exe
D:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
d:\progra~1\mcafee.com\vso\mcvsescn.exe
D:\PROGRA~1\HEWLET~1\HPSHAR~1\hpgs2wnf.exe
D:\Program Files\MSGTAG\MSGTAG.exe
D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
D:\Program Files\Sony Handheld\HOTSYNC.EXE
D:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
D:\Program Files\SpywareGuard\sgbhp.exe
D:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
D:\WINNT\system32\hpoipm07.exe
D:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
D:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe
D:\WINNT\system32\cidaemon.exe
D:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
D:\PROGRA~1\J2MESS~1\DLLCMD32.EXE
D:\Program Files\iambic Software\Agendus for Windows Professional Edition\AgendusPro.exe
D:\Program Files\Opera75\opera.exe
D:\Program Files\Microsoft Office\Office\WINWORD.EXE
D:\Download\Spy and Malware\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.my.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.yahoo.com
O1 - Hosts: 207.36.196.189 auto.search.msn.com
O1 - Hosts: 207.36.196.189 search.netscape.com
O1 - Hosts: 207.36.196.189 ieautosearch
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - d:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [MCAgentExe] d:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] D:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [REGSHAVE] D:\Program Files\REGSHAVE\REGSHAVE.EXE /autorun
O4 - HKLM\..\Run: [VSOCheckTask] "d:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] "d:\PROGRA~1\mcafee.com\vso\mcvsshld.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] D:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKCU\..\Run: [MSGTAG] "D:\Program Files\MSGTAG\MSGTAG.exe" /startup
O4 - Startup: HotSync Manager.lnk = D:\Program Files\Sony Handheld\HOTSYNC.EXE
O4 - Startup: SpywareGuard.lnk = D:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: MailWasherPro.lnk = D:\Program Files\FireTrust\MailWasher Pro\MailWasher.exe
O4 - Startup: AboutTime.lnk = D:\Program Files\AboutTime\AboutTime.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: HPAiODevice(hp officejet d series) - 1.lnk = D:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://d:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://d:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://d:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://d:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)
O9 - Extra button: Help (HKCU)
O9 - Extra button: Support (HKCU)
O9 - Extra button: ComcastHSI (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/ ... mv9VCM.CAB
O16 - DPF: {41F31718-2B9D-4F76-85E2-DD11BBA99F8D} - http://install.spywarelabs.com/DistID/2 ... 031120.EXE
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mci ... insctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/share ... cgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shoc ... wflash.cab

by **Ranger Bob** » Wed Jun 09, 2004 4:03 am

Have you tried going into the Hosts file to see if these entries exist? If they do you can edit the Hosts file to 127.0.0.1. Actually you don't need a Hosts file so you could rename the file to something like Hosts.old and reboot the PC to see if that corrects the problem.

by **msiler** » Wed Jun 09, 2004 12:44 pm

Hi RB,
1) I think I am loking in the corrct place for the "hosts" files:
D:\WINNT\System32\Drivers\Etc

2) They do NOT exist in the the above hosts file

3) I have repeatedly renamed the suspicious host file in the above folder but it always reverts to it's old self and reappears after deletion (in safe mode also)

4) How can I find the hosts file on my computer - a regular search yields nothing?

5) When and if i do find them how do i edit or delete them?

6) Spybot S&D shows that they are on my computer when I use the "Tools" and look under Hosts Mode - so I am sure they are on my computer somewhere...

Thanks again for the help,
-Matt-

by **brad** » Wed Jun 09, 2004 1:13 pm

PCTech Forums

SpyBot S&D Question(s)

SpyBot S&D Question(s)

Who is online