Computer Help Needed

[Rinny]

Have anyone ever dealt with "www.search-daily.com"??? My computer is infected with it. Whenever I search the net, I get redirected to the "www.search-daily.com" and says the site is restricted. I've searched for help but what I'm reading is to technical for me to do. I've ran all types of scans, ie: AVG (free edition), spybot, adaware6, spyware blaster, and registry mechanic.
AVG caught an "exploit" and sent it to the vault. Registry Mechanic caught 45 problems and fixed them...the others caught nothing. I've also checked my add/remove folder and I see nothing out of the ordinary in there.
If you know of a way I can locate where this thing is and delete it, I would certainly appreciate it.
I have Windows XP Professional. I use Internet Explorer 6. I'm not sure what other information you'll need.
Thanks!

[shopgal]

try sending a pm to N8PXR he's pretty computer savy and maybe he can help ya out..hope u get your problem fixed!!..:)

[Rinny]

Thanks!!!!

[Rinny]

Shopgal??!!! I tried sending the pm but it won't recognize the name. Would you please see that he sees this and ask him to pm me?? Thanks so much!!

[Bamassee]

From Lavasoft Support Forums:

Run Hijack This and choose Do A System Scan then place a check next to these entries

O2 - BHO: SpoofBHO Class - {07A78AEA-4A54-4967-9A60-4B68592D30C7} - C:\WINDOWS\se_spoof.dll
O2 - BHO: CvgraphObj Object - {12355F3E-90C3-41AA-8705-15969AF7F210} - C:\WINDOWS\vgraph.dll
O2 - BHO: Oddbot - {2B896072-F6E3-4FF7-ADE6-43D5BEC6557C} - C:\WINDOWS\system32\nodeipproc.dll

Close all open browser and other windows except for Hijack This and press the Fix Checked button

Download Ewido Anti-Spyware (http://www.ewido.net/en/download/)
Load Ewido and then click the Update tab at the top. Under Manual Update click Start update.
After the update finishes (the status bar at the bottom will display "Update successful")
Click on the Scanner tab at the top and then click on Complete System Scan
Ewido will list any infections found on the left, when the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will then display "All actions have been applied" on the right.

[Rinny]

I ran HiJack This and none of these were listed:
O2 - BHO: SpoofBHO Class - {07A78AEA-4A54-4967-9A60-4B68592D30C7} - C:\WINDOWS\se_spoof.dll
O2 - BHO: CvgraphObj Object - {12355F3E-90C3-41AA-8705-15969AF7F210} - C:\WINDOWS\vgraph.dll
O2 - BHO: Oddbot - {2B896072-F6E3-4FF7-ADE6-43D5BEC6557C} - C:\WINDOWS\system32\nodeipproc.dll

I'll download Ewido and see what happens next:)
Thanks!!

[Eagle55]

You can download adaware 2007 from Lavasoft.com. It's free and might help you.

[Rinny]

Thanks! I'm running the stinger now. I'll see what happens after I run the scans and reboot.

[0ldman]

I replied to your email, but wasn't sure where you'd check first.

Not every one of these is a problem, the first BHO listed here "d3dim70.dll" is unknown, don't like something I don't know. There is no reason for quicktime to load during startup, the ssv.dll java doesn't need to load at startup. The rest will be automatically updated if needed, the last "saswinlo.dll" is another unknown, and since it claims to be an antispyware, I'm pretty sure its a scam. I only trust Spybot Search and Destroy, Adaware and Spywareblaster. There are a few other manual tools, but these are the only programs I trust.




O2 - BHO: (no name) - {6AF6717B-A834-4E02-8952-4B4A6184FC80} - C:\WINDOWS\System32\d3dim70.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab


O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.lowrance.com/Software/PCSoftware/Install/iFINDERH2O/isetup.cab
O16 - DPF: {95D88B35-A521-472B-A182-BB1A98356421} (Pearson Installation Assistant 2) - http://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {BD4C7EDB-A392-11D9-8BFB-0040953018D7} (PhaseCaster Widget) - http://www.streamerp2p.com/sfiles/phasex.cab
O16 - DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} (Pearson MathXL Player) - http://asp.mathxl.com/books/_Players/MathPlayer.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[Rinny]

You have mail!

[0ldman]

Gotta love bulk mail filters... or not.

You have mail!

[Rinny]

Got it, thanks! Not sure why it went to bulk but I'm glad you told me you'd sent an email...I would have dumped it without looking!
I'm working today so I'll get back up with you later.
You have mail!!