coolwebsearch spyware

[dan12]

Is that the full validation message?

[dvegas]

yes dan.. I went to "Validate Now", and thats the only messege that appears

[dan12]

Ok, have not forgot you but am away for a couple of day's from main pc, will try and get back to you soon.
Have another option for you to try.
There's a tool that's proved effective in restoring all necessary settings, permissions, and files to repair Windows Update issues.

Dial-a-fix

Download it to your Desktop and unzip it.

Next, open the program.

When you first open it, click the Flush Software Distribtution button. Then put a check mark next to these Options:

Under Prep - Empty temp folders
Under WU/WUAU - Stop services, Register WUAU dlls, Start services
Under SSL/HTTPS Cryptography - All
Under Registration center - All

Then click the GO button.
Next, click the Tools button.

Run these by clicking on each one, then clicking the GO button:

Flush DNS
Repair permissions
Reset WMI/WBEM/WinMgmt

Reboot and try Windows Updates or Microsoft Updates again.[/quote]

I hope this helps.

[dvegas]

dan perfect!! now my pc runs perfectly!! he had installed the updates and.., in my opinion runs very well!

[dan12]

pleased it went ok.
Let me see another HJT log and a uninstall list.

Make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:



5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.

[dvegas]

ACE Mega CoDecS Pack
Actualização de Segurança para o Windows Media Player (KB911564)
Actualização de Segurança para o Windows Media Player 11 (KB936782)
Actualização de Segurança para o Windows Media Player 6.4 (KB925398)
Actualização de segurança para Windows Internet Explorer 7 (KB938127)
Actualização de segurança para Windows Internet Explorer 7 (KB950759)
Actualização de segurança para Windows XP (KB890046)
Actualização de segurança para Windows XP (KB893756)
Actualização de segurança para Windows XP (KB896358)
Actualização de segurança para Windows XP (KB896423)
Actualização de segurança para Windows XP (KB896428)
Actualização de segurança para Windows XP (KB899587)
Actualização de segurança para Windows XP (KB899591)
Actualização de segurança para Windows XP (KB900725)
Actualização de segurança para Windows XP (KB901017)
Actualização de segurança para Windows XP (KB901214)
Actualização de segurança para Windows XP (KB902400)
Actualização de segurança para Windows XP (KB905414)
Actualização de segurança para Windows XP (KB905749)
Actualização de segurança para Windows XP (KB908519)
Actualização de segurança para Windows XP (KB911562)
Actualização de segurança para Windows XP (KB911927)
Actualização de segurança para Windows XP (KB913580)
Actualização de segurança para Windows XP (KB914388)
Actualização de segurança para Windows XP (KB914389)
Actualização de segurança para Windows XP (KB918118)
Actualização de segurança para Windows XP (KB918439)
Actualização de segurança para Windows XP (KB920213)
Actualização de segurança para Windows XP (KB920670)
Actualização de segurança para Windows XP (KB920683)
Actualização de segurança para Windows XP (KB920685)
Actualização de segurança para Windows XP (KB922819)
Actualização de segurança para Windows XP (KB923191)
Actualização de segurança para Windows XP (KB923414)
Actualização de segurança para Windows XP (KB923980)
Actualização de segurança para Windows XP (KB924270)
Actualização de segurança para Windows XP (KB924667)
Actualização de segurança para Windows XP (KB925902)
Actualização de segurança para Windows XP (KB926255)
Actualização de segurança para Windows XP (KB926436)
Actualização de segurança para Windows XP (KB927779)
Actualização de segurança para Windows XP (KB927802)
Actualização de segurança para Windows XP (KB928255)
Actualização de segurança para Windows XP (KB928843)
Actualização de segurança para Windows XP (KB929123)
Actualização de segurança para Windows XP (KB930178)
Actualização de segurança para Windows XP (KB931261)
Actualização de segurança para Windows XP (KB931784)
Actualização de segurança para Windows XP (KB932168)
Actualização de segurança para Windows XP (KB933729)
Actualização de segurança para Windows XP (KB935839)
Actualização de segurança para Windows XP (KB935840)
Actualização de segurança para Windows XP (KB936021)
Actualização de segurança para Windows XP (KB941202)
Actualização de Segurança para Windows XP (KB941569)
Actualização de segurança para Windows XP (KB941644)
Actualização de segurança para Windows XP (KB941693)
Actualização de segurança para Windows XP (KB943055)
Actualização de segurança para Windows XP (KB943460)
Actualização de segurança para Windows XP (KB943485)
Actualização de segurança para Windows XP (KB944653)
Actualização de segurança para Windows XP (KB945553)
Actualização de segurança para Windows XP (KB946026)
Actualização de segurança para Windows XP (KB948590)
Actualização de segurança para Windows XP (KB950749)
Actualização de segurança para Windows XP (KB950760)
Actualização de segurança para Windows XP (KB950762)
Actualização de segurança para Windows XP (KB951376)
Actualização de segurança para Windows XP (KB951698)
Actualização para Windows XP (KB894391)
Actualização para Windows XP (KB898461)
Actualização para Windows XP (KB900485)
Actualização para Windows XP (KB908531)
Actualização para Windows XP (KB910437)
Actualização para Windows XP (KB911280)
Actualização para Windows XP (KB916595)
Actualização para Windows XP (KB920872)
Actualização para Windows XP (KB922582)
Actualização para Windows XP (KB927891)
Actualização para Windows XP (KB930916)
Actualização para Windows XP (KB932823-v3)
Actualização para Windows XP (KB936357)
Actualização para Windows XP (KB938828)
Actualização para Windows XP (KB942763)
Adobe Flash Player ActiveX
Adobe Reader 8.1.2 - Português
ADSL Modem
AGEIA PhysX v7.09.13
Apple Software Update
Assistente de Conexão do Windows Live
avast! Antivirus
Azureus 3.0
Barra de Ferramentas do Yahoo! com bloqueador de pop-up
Cobian Backup 9
COMODO Firewall Pro
COMODO SafeSurf
Correcção para o Windows Media Player 11 (KB939683)
Creative Live! Cam Vista IM Driver (1.01.03.1104)
Creative Live! Cam Vista IM User's Guide (English)
Creative Software AutoUpdate
Creative System Information
Creative WebCam Center
Dracula Origin
FUJIFILM FinePixViewer S Ver.2.1
Google Desktop
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix para Windows XP (KB935448)
iPod for Windows 2006-06-28
iTunes
Java(TM) 6 Update 5
Kaspersky Online Scanner
Malwarebytes' Anti-Malware
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
NVIDIA Drivers
OpenOffice.org Installer 1.0
PowerISO
QuickTime
Realtek High Definition Audio Driver
Skype™ 3.8
SoulSeek Client 156c
Spybot - Search & Destroy
VIA Platform Device Manager
VobSub v2.23 (Remove Only)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live installer
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR
WinZip 11.2
Yahoo! Install Manager

[dan12]

don't forget the HJT log

[dvegas]

oh!! sorry!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:24:27, on 18-06-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programas\Alwil Software\Avast4\aswUpdSv.exe
C:\Programas\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programas\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programas\Windows Live\Messenger\msnmsgr.exe
C:\Programas\Spybot - Search & Destroy\TeaTimer.exe
C:\Programas\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programas\Alwil Software\Avast4\ashMaiSv.exe
C:\Programas\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\Programas\Internet Explorer\IEXPLORE.EXE
C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programas\Windows Live\Messenger\usnsvc.exe
C:\Programas\Internet Explorer\IEXPLORE.EXE
C:\Programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pt/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hiperligações
R3 - URLSearchHook: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programas\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programas\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programas\Ficheiros comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programas\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Auxiliar de Conexão do Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programas\Ficheiros comuns\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Barra de Ferramentas do Yahoo! com bloqueador de pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programas\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programas\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programas\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programas\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programas\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programas\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Creative WebCam Tray] "C:\Programas\Creative\Shared Files\CamTray.exe"
O4 - HKCU\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHEI~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVIÇO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Serviço de rede')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Exif Launcher S.lnk = ?
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programas\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programas\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programas\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partne ... nicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programas\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windows ... 1828591125
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microso ... 1829019109
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/ ... /CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DD62A15-6A62-477F-BF4D-661AF5D9FBEE}: NameServer = 212.55.154.174 212.55.154.190
O17 - HKLM\System\CS2\Services\Tcpip\..\{4DD62A15-6A62-477F-BF4D-661AF5D9FBEE}: NameServer = 212.55.154.174 212.55.154.190
O17 - HKLM\System\CS3\Services\Tcpip\..\{4DD62A15-6A62-477F-BF4D-661AF5D9FBEE}: NameServer = 212.55.154.174 212.55.154.190
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHEI~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\cssdll32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programas\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programas\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Programas\COMODO\Firewall\cmdagent.exe
O23 - Service: GoogleDesktopManager - Google - C:\Programas\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programas\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programas\Ficheiros comuns\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Programas\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 8378 bytes

[dan12]

Well we got there in the end , well done for sticking with me.
You may well be able to update your java now you have the your xp updates.

Congratulations you are clean!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Create a new System Restore Point
This is a good time to clear your existing system restore points and establish a new clean restore point:

• Go to Start > All Programs > Accessories > System Tools > System Restore
  
• Select Create a restore point, and Ok it.
  
• Next, go to Start > Run and type in cleanmgr
  
• Select the More options tab
  
• Choose the option to clean up system restore and OK it.
  

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.5.2
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here
Find here changes from older version 1.4 here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Stand Up and Be Counted!
Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints called Malware Complaints. Please register there first! Then follow the instructions.

>> Here << you can see how you can help us.

Happy safe surfing!

Dan

[Elrond]

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.