Offeroptimizer Help Needed! HijackThis.exe Logfile Included!

A few other people have had this problem. Try searching this thread for solutions.


http://www.able2know.com/forums/viewtopic.php?t=17684&highlight=

If none of them work, someone who knows more should come along eventually to help.

I saw that thread - it said to post the Logfile in a new topic.

I'm sure the gurus will be along to help.

I blocked offeroptimizer's site in my router's firewall settings, but now I get pop up ads with "Blocked by Netgear" messages! I need rid of this thing for good... I wonder where it came from...?

You've got a bunch of problems there. For starters, see this thread, and follow the instructions there for the removal of "Twaintec", but don't do anything else yet.

Once you've done that, and checked things out on that thread, disable System Restore per the instructions found there, then
use this link to downloadCWShredder. Don't download it to a Temp folder or to your desktop, create a folder for it on you C: drive. Unzip it and run it from there, selecting "Fix", not "Scan Only", the reboot; that will probably fix most of this:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http:/ /www.windowws.cc/sp.htm?id=278
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http:/ /www.windowws.cc/sp.htm?id=278
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http:/ /www.windowws.cc/sp.htm?id=278
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http:/ /www.windowws.cc/sp.htm?id=278
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http:/ /www.meshcomputers.com
O1 - Hosts: 127.0.0.0 localhost
O1 - Hosts: 127.0.0.2 auditmypc.com
O1 - Hosts: 127.0.0.3 boards.cexx.org
O1 - Hosts: 127.0.0.4 bulletproofsoft.net
O1 - Hosts: 127.0.0.5 camtech2000.net
O1 - Hosts: 127.0.0.6 cexx.org
O1 - Hosts: 127.0.0.7 computercops.us
O1 - Hosts: 127.0.0.8 ct7support.com
O1 - Hosts: 127.0.0.9 doxdesk.com
O1 - Hosts: 127.0.0.20 kellys-korner-xp.com
O1 - Hosts: 127.0.0.21 kephyr.com
O1 - Hosts: 127.0.0.22 lavasoft.de
O1 - Hosts: 127.0.0.23 lavasoftusa.com
O1 - Hosts: 127.0.0.24 lurkhere.com
O1 - Hosts: 127.0.0.25 majorgeeks.com
O1 - Hosts: 127.0.0.26 merijn.org
O1 - Hosts: 127.0.0.27 mjc1.com
O1 - Hosts: 127.0.0.28 moosoft.com
O1 - Hosts: 127.0.0.29 mvps.org
O1 - Hosts: 127.0.0.30 net-integration.net
O1 - Hosts: 127.0.0.31 noadware.net
O1 - Hosts: 127.0.0.32 no-spybot.com
O1 - Hosts: 127.0.0.33 onlinepcfix.com
O1 - Hosts: 127.0.0.34 pchell.com
O1 - Hosts: 127.0.0.35 pestpatrol.com
O1 - Hosts: 127.0.0.36 safer-networking.org
O1 - Hosts: 127.0.0.37 secure.spykiller.com
O1 - Hosts: 127.0.0.38 secureie.com
O1 - Hosts: 127.0.0.39 security.kolla.de
O1 - Hosts: 127.0.0.40 spybot.info
O1 - Hosts: 127.0.0.41 spychecker.com
O1 - Hosts: 127.0.0.42 spychecker.com
O1 - Hosts: 127.0.0.43 spycop.com
O1 - Hosts: 127.0.0.44 spyguard.com
O1 - Hosts: 127.0.0.45 spykiller.com
O1 - Hosts: 127.0.0.46 spyware.co.uk
O1 - Hosts: 127.0.0.47 spyware-cop.com
O1 - Hosts: 127.0.0.48 spywareinfo.com
O1 - Hosts: 127.0.0.49 spywarenuker.com
O1 - Hosts: 127.0.0.50 spywareremove.com
O1 - Hosts: 127.0.0.51 spywareremove.com
O1 - Hosts: 127.0.0.52 stopzillapro.com
O1 - Hosts: 127.0.0.53 sunbelt-software.com
O1 - Hosts: 127.0.0.54 thiefware.com
O1 - Hosts: 127.0.0.55 tomcoyote.org
O1 - Hosts: 127.0.0.56 unwantedlinks.com
O1 - Hosts: 127.0.0.57 webattack.com
O1 - Hosts: 127.0.0.58 wilders.org
O1 - Hosts: 127.0.0.59 www.auditmypc.com
O1 - Hosts: 127.0.0.60 www.bulletproofsoft.net
O1 - Hosts: 127.0.0.61 www.cexx.org
O1 - Hosts: 127.0.0.62 www.computercops.us
O1 - Hosts: 127.0.0.63 www.ct7support.com
O1 - Hosts: 127.0.0.64 www.doxdesk.com
O1 - Hosts: 127.0.0.65 www.eblocs.com
O1 - Hosts: 127.0.0.66 www.enigmasoftwaregroup.com
O1 - Hosts: 127.0.0.67 www.free-spyware-scan.com
O1 - Hosts: 127.0.0.68 www.free-web-browsers.com
O1 - Hosts: 127.0.0.69 www.grc.com
O1 - Hosts: 127.0.0.70 www.grisoft.com
O1 - Hosts: 127.0.0.71 www.hackfaq.org
O1 - Hosts: 127.0.0.72 www.hazeleger.net
O1 - Hosts: 127.0.0.73 www.javacoolsoftware.com
O1 - Hosts: 127.0.0.74 www.kellys-korner-xp.com
O1 - Hosts: 127.0.0.75 www.kephyr.com
O1 - Hosts: 127.0.0.76 www.lavasoft.de
O1 - Hosts: 127.0.0.77 www.lavasoftusa.com
O1 - Hosts: 127.0.0.78 www.lurkhere.com
O1 - Hosts: 127.0.0.79 www.majorgeeks.com
O1 - Hosts: 127.0.0.80 www.merijn.org
O1 - Hosts: 127.0.0.81 www.mjc1.com
O1 - Hosts: 127.0.0.82 www.moosoft.com
O1 - Hosts: 127.0.0.83 www.mvps.org
O1 - Hosts: 127.0.0.84 www.net-integration.net
O1 - Hosts: 127.0.0.85 www.noadware.net
O1 - Hosts: 127.0.0.86 www.no-spybot.com
O1 - Hosts: 127.0.0.87 www.onlinepcfix.com
O1 - Hosts: 127.0.0.88 www.pchell.com
O1 - Hosts: 127.0.0.89 www.pestpatrol.com
O1 - Hosts: 127.0.0.90 www.safer-networking.org
O1 - Hosts: 127.0.0.91 www.secureie.com
O1 - Hosts: 127.0.0.92 www.security.kolla.de
O1 - Hosts: 127.0.0.93 www.spybot.info
O1 - Hosts: 127.0.0.94 www.spychecker.com
O1 - Hosts: 127.0.0.95 www.spychecker.com
O1 - Hosts: 127.0.0.96 www.spycop.com
O1 - Hosts: 127.0.0.97 www.spyguard.com
O1 - Hosts: 127.0.0.98 www.spykiller.com
O1 - Hosts: 127.0.0.99 www.spyware.co.uk
O2 - BHO: (no name) - {000020DD-C72E-4113-AF77-DD56626C6C42} - C:\WINDOWS\twaintec.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKCU\..\Run: [w56dl9imik] C:\WINDOWS\r3zxdkge4g.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {1C78AB3F-A857-482E-80C0-3A1E5238A565} - ms-its:mhtml:file://C:\ss.MHT!http://toolbar.isearch.com/install/00011/chm.chm::/files/initial.cab.

You should now be able to download both Spybot S&D and AdAware , but DO NOT RUN THEIR SEARCHES untill you have opened each one and updated it using its web update function, as explained in the help file for each. When each have been updated, disconnect from the internet, run AdAware, letting it fix anything it finds, then do the same with Spybot. Do not run either untill both have been updated per instructions. It would be good to run both of them while in safemode. That should get you into pretty good shape.

I've got up to using CWShredder - but the link won't work to download it. The host site seems to be down?

Thanks for replying - could I have another link to CWShredder? Thanks.

Try THIS LINK. From that page, select either "Mirror 1 - Local" or "Download Metropolitan"

I just checked, and those two work for me. Lemme know what happens, OK?

Tell ya what, lufiaguy, if Shredder isn't workin' for ya, try this: move HijackThis to its own folder on your C: drive. Then, with no other windows open or apps running, do another HijackThis scan. examine the scan result carefully, and have HiJackThis fix the items I've singled out in red in my earlier post to you. Find-and-delete files and folders named or containing "twaintec", "meshcomputer", "Sytem" -note the spelling -"sytem", no 2cnd "S", not "System". and "isearch".

And whatever else, try again to get Shredder, and see if you can get-install-and-update SpyBot S&D and AdAware in any event. AdAware's latest update handles the known most recent CoolWeb variants.

I've done everything - thanks very much for your help!

I'll let you know if Offer Optimizer returns!

Thanks again!