Results 1 to 8 of 8
  1. #1
    WS Lounge VIP sdckapr's Avatar
    Join Date
    Jul 2002
    Location
    Pittsburgh, Pennsylvania, USA
    Posts
    11,225
    Thanks
    14
    Thanked 342 Times in 335 Posts

    Hijack this not removing items

    I routinely run Ad-Aware, SpyBot search and Destroy and HijackThis.

    I recently discovered several items in HijackThis that are not found the other ones and even though I constantly check and pick Fix this in Hijackthis they do not go away.

    The lines are:
    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,CustomizeSearch =
    R0 - HKLMSoftwareMicrosoftInternet ExplorerSearch,SearchAssistant =

    O10 - Unknown file in Winsock LSP: c:windowssystem32calsp.dll
    O10 - Unknown file in Winsock LSP: c:windowssystem32calsp.dll
    O10 - Unknown file in Winsock LSP: c:windowssystem32calsp.dll
    O10 - Unknown file in Winsock LSP: c:windowssystem32calsp.dll

    I am not too worried about the first 2 as they don't seem to do anything "bad" (that I can tell - I have had them for awhile) but the calsp.dll worries me.

    Any ideas of what they are and any have any suggestions for getting rid of them?

    Steve

  2. #2
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: Hijack this not removing items

    Possibly related to "cool web search"? Try CWShredder and see if that helps. The main page seems to be under construction, but there is a mirror of unknown currency here: http://www.richardthelionhearted.com...downloads.html.

    A Google on that DLL yielded this recent thread in the Spywareinfo forums.

  3. #3
    Platinum Lounger
    Join Date
    Nov 2001
    Location
    Melbourne, Victoria, Australia
    Posts
    5,016
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hijack this not removing items

    Hi Steve

    I know that AdAware has a plugin: LSP Explorer, available at their site. I don't know if this will be of help. The dll you mention is "CouponAge" or "CouponDeals" malware, but does it still exist on your system as a file? It may be that the registry entries (only) remained after cleaning.

    You could try exporting then deleting those keys; restore if something subsequently blows up. Better still, RegSeeker will do that job for you if it determines they're "orphaned".

    HTH

    Alan

  4. #4
    Super Moderator jscher2000's Avatar
    Join Date
    Feb 2001
    Location
    Silicon Valley, USA
    Posts
    23,112
    Thanks
    5
    Thanked 93 Times in 89 Posts

    Re: Hijack this not removing items

    A search at CastleCops says calsp.dll is a "malware layered service provider" associated with "CouponAge" (whatever that is).

  5. #5
    WS Lounge VIP sdckapr's Avatar
    Join Date
    Jul 2002
    Location
    Pittsburgh, Pennsylvania, USA
    Posts
    11,225
    Thanks
    14
    Thanked 342 Times in 335 Posts

    Re: Hijack this not removing items

    Jefferson and Alan,
    Thanks for the info. I will investigate and let you know what I discover.

    Steve

  6. #6
    Star Lounger
    Join Date
    Mar 2001
    Location
    Atlanta, Georgia, USA
    Posts
    64
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hijack this not removing items

    I had a rather nasty malware that neither AdAware or Spybot Search and Destroy could find. They turned out to be Browser Helper Objects. I downloaded BHODemon from Majorgeeks.com. It found the two BHO offenders and let me nullify them. I also had Spybot's Resident Shield turned on, so it warned me when the BHO's were trying to write themselves back into my registry with a different name (seems to be a trick they've learned recently). I also ran MSCONFIG to find and deactivate any other startup programs that weren't recognizable.

    One reboot - and I'm spyware free (for now)...

  7. #7
    WS Lounge VIP sdckapr's Avatar
    Join Date
    Jul 2002
    Location
    Pittsburgh, Pennsylvania, USA
    Posts
    11,225
    Thanks
    14
    Thanked 342 Times in 335 Posts

    Re: Hijack this not removing items

    I finally had time to work on this again and for anyone interested I was able to remove them using the <img src=/S/free.gif border=0 alt=free width=30 height=15> lspfix

    Steve

  8. #8
    Platinum Lounger
    Join Date
    Nov 2001
    Location
    Melbourne, Victoria, Australia
    Posts
    5,016
    Thanks
    0
    Thanked 0 Times in 0 Posts

    Re: Hijack this not removing items

    Thanks Steve. Slotted safely into the toolbox for future disasters.

    Alan

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •