Member Avatar for mimiii

Hi, My computer has been infected with a bullseye network, cashback, and navisearch program and it recently had this nasty coulomb dialer on the computer. I tried every method to get rid of these junk, but it keeps on coming back. Does anybody know how to remove them?

Thanks in advance.


Thiis is my hijack log below:

Logfile of HijackThis v1.99.0
Scan saved at 8:14:17 PM, on 2/2/2006
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\ucla.bak\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL
O4 - HKLM\..\Run: [ezShieldProtector for Px] C:\WINDOWS\System32\ezSP_Px.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM95\aim.exe -cnetwait.odl
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .asp: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted IP range: (HKLM)
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{96EBAFD0-06C9-4250-AC32-7FAC61B2D435}: Domain =
O18 - Filter hijack: text/webviewhtml - (no CLSID) - (no file)
O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe

  • 3 Contributors
  • 3 Replies
  • 126 Views
  • 13 Hours Discussion Span
  • Latest Post Latest Post by tayspen

Dani AI

Generated

The problem described by looks like a typical persistent adware/dialer combination: several autorun entries plus a DLL started through the system loader. The dialer element makes this urgent — if the machine uses a modem/phone line, disconnect that line and unplug network access before attempting removal. Back up critical files to external media first so recovery is possible if something goes wrong.

Recommended cleanup workflow:

  1. Boot to Safe Mode so most autostarting components are inactive.
  2. From a clean PC, download reputable removal tools to removable media and run them on the infected machine (use at least one antivirus and one anti‑spyware/anti‑adware scanner).
  3. Use an autorun/startup viewer and a process viewer to identify suspicious services/processes; stop those processes, disable the matching startup entries, then remove the associated program folders and service definitions.
  4. Inspect browser settings, helper objects and the hosts file; reset the browser if it’s still redirecting.

A few practical notes tied to the thread: ’s suggestion to unregister the suspicious DLL is valid, but only do that after you confirm it is not a legitimate system component — unregistering the wrong DLL can break Windows. The point raised by about where tools run from is also useful: running a scanner from the desktop works, but it’s cleaner and safer to keep removal utilities in a dedicated folder or on removable media so logs and quarantines are easy to locate and the malware can’t use the same path to restore itself.

If the infection resurfaces after these steps, run an offline rescue scan from bootable media or prepare for a clean OS reinstall. After cleaning, change online passwords and contact the ISP if there were possible dialer charges. If help is still needed, post a fresh, complete HijackThis log (not truncated) and the exact file/folder paths of items you cannot remove so responders can give precise removal steps.

Recommended Answers

All 3 Replies

Member Avatar for tayspen

Hi, first off this should go in the spyware forums. Second i belive this line

C:\Documents and Settings\ucla.bak\Desktop\HijackThis.exe

Means you are running it from your desktop. It needs to be in its own folder. Also the log looks a bit short...or is that just my imagination. Make sure you posted the whole thing.

-T

Member Avatar for BinaryMayhem

Means you are running it from your desktop. It needs to be in its own folder.

what wrong with running it from your desktop? your desktop is a folder! it just means all the back up files will appear on your desktop... if you dont want them... just delete them... there is no problem with hijackthis running from the desktop. it wil fucntion just fine...

as for the problem... here is a list of stuff you need to do to remove it.

first... close all open windows
then you need to unregister cfgmgr52.dllso you can remove everthing.

start -> run -> cmd.exe
enter in: regsvr32 /u cfgmgr52.dll

then check the following boxes and let HJT do its thing.


O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [CashBack] C:\Program Files\CashBack\bin\cashback.exe

O15 - Trusted IP range: (HKLM)

O17 - HKLM\System\CCS\Services\Tcpip\..\{96EBAFD0-06C9-4250-AC32-7FAC61B2D435}: Domain =
O18 - Filter hijack: text/webviewhtml - (no CLSID) - (no file)

edit: make sure you delete cashback.exe, nls, bargains and cfgmgr52.dll

Member Avatar for tayspen

Oh, I stand corrected :).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.