Home Search Assistant is a SPYWARE

Hi there!!!,

I have to tell something about HSA ( Home Search Assistant) that i witnessed last week. HSA is a spyware dat had downloaded to my PC without my knowledge. Whenever i opened IE the explorer opened with a default home page ( even if the default home page in internet options is set to blank). There were popups every 1 minute... First i decided on formatting HDD later I decided against it

First I used Google to search for the description of this particular spyware and the menace it would cause. I found the following.

1. The HSA spyware is a CoolwebSearch
2. It is a new version and hence CWS shredder cant able to kill the spyware.
3. It modifies its exe file with different name each time it is deleted.
4. IT slows down the internet explorer performance.
5. If we use windows XP with SP2 this spyware wont affect.
6. The most worst part is POPUPS.

All details collected, >>I downloaded hijackthis.exe file and scanned my PC completely , Hijackthis was really usefull it showed bad entries and i deleted those entries, but when i rebooted the PC again HSA appears.

So i downloaded system mechanic and checked my registry for invalid entries and it dint work.
so i ran hijackthis in safe mode and located the entries in hijackthis log. From the log i manually deleted registry entries and exe files, but again until internet was connected IE was ok but once connected HSA started its action.

Trying to find some solution to get rid of this, i found a link http://www.short-media.com/review.php?r=259
The link was really useful and hence i did as it was stated in that page.

First i checked for New entries in Windows XP Services we can open it using services.msc command in run

I was searching for the three services below
Network Security Service

Workstation NetLogon Service

Remote Procedure Call (RPC) Helper

and i found 2 services running

Network Security Service
Remote Procedure Call (RPC) Helper

with some invalid entries, i stopped these two services and then disabled the service. Then I downloaded aboutbuster.exe. Later i ran hijackthis in normal mode, found lots of entries and deleted those entries using hijackthis. I also downloaded spybot-search & Destroy, installed and found 15 SPyware entires and as usual deleted those too

opened C:/documentsand settings/admin/favorites and found some site entires which was donwloded without by knowledge by HSA and deleted them and i just hard rebooted the PC meaning plugged the power out to stop the PC from shutting down normally. <> This was tricky since there is a dll file created by the spyware in my C:\windows\system32 folder and it may create another instance of the spyware again wen i reboot normally.

Then i booted the PC in safe mode, again ran hijackthis and this time found registry entries in runonce and run, deleted the entries. and also one or two exe files that are invalid Finally ran aboutbuster, It was really useful cos about buster deleted the dll file from system32 folder.

I restarted my PC in normal mode and the spyware is gone
ooops! really it took me 3 days to cure my PC

These r the entires i found thro hijackthis.log:::irrevlevant links are highlighted

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Admin\Desktop\removing HSA\HijackThis.exe

R1-HKCU\Software\Microsoft\InternetExplorer\Main,SearchBar = res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R1-HKCU\Software\Microsoft\Internet Explorer\Main,SearchPage = res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1-HKLM\Software\Microsoft\InternetExplorer\Main,Default_Search_URL= res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R1-HKLM\Software\Microsoft\InternetExplorer\Main,SearchBar = res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R1-HKLM\Software\Microsoft\InternetExplorer\Main,SearchPage = res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R1-HKCU\Software\Microsoft\InternetExplorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R0-HKLM\Software\Microsoft\InternetExplorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xngql.dll/sp.html#12345
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - Default URLSearchHook is missing
O2-BHO:AcroIEHlprObjClass-{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}- C:\ProgramFiles\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2-BHO:(noname)-{55C2A982-5FB8-705D-AB13-7616770AA2ED}-C:\WINDOWS\sysst.dll(file missing)
O3-Toolbar:&Radio-{8E718888-423F-11D2-876E-00A0C9082467}-C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo!Toolbar-{EF99BD32-C1FB-11D2-892F-0090271D4F88}-C:\PROGRA~1\YAHOO!\COMPAN~1\INSTALLS\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunOnce: [winbu32.exe] C:\WINDOWS\winbu32.exe
O4 - HKLM\..\RunOnce: [atlfl32.exe] C:\WINDOWS\atlfl32.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &WordWeb... - res://C:\WINDOWS\wweb32.dll/lookup.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9-Extrabutton:(noname)-{08B0E5C0-4FCB-11CF-AAA5-00401C608501}-C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9-Extra 'Tools' menuitem: Sun Java Console-{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9-Extrabutton:Messenger-{FB5F1910-F110-11d2-BB9E-00C04F795683}-C:\Programfiles\Messenger\MSMSGS.EXE
O9-Extra'Tools'menuitem:WindowsMessenger-{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.static.topconverting.com (HKLM)
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O16-DPF:{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}-http://static.windupdates.com/cab/DownloadsUnlimited/ie/bridge-c361.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) -