I am running windows 7 ultimate and my firefox 3.5.4 browser got hijacked apparently. I have tried all the usual things but I can not get any of them to run as the trojan is shutting them down before I can get any log files. I did use Kapersky online and was able to determine what it was but now I can't get rid of it. Attached is the log file any help on how to proceed would be much appreciated.

Combofix even renaming it on the download does not install, i tried running as administrator and in compatibility mode XP Service Pack 2.

Malware Bytes and hijack this installs and runs but during the scans gets shut down and the files are permission locked. I used Inherit to unlock them and uninstall the programs. I installed AVG 9.0 FREE after the fact and scanned the computer but it did not detect anything so I uninstalled it.

I also ran EXEHelper and was able to get a log as well

UPDATE: I ran the online superantispyware.com and during the scan it shut down as well this thing is pissing me off.

the Kapersky and EXEhelper logs are posted below thanks for your help!!

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, October 22, 2009
Operating system: Microsoft Professional (build 7600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, October 22, 2009 16:25:32
Records in database: 3045602
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Objects scanned: 102267
Threats found: 2
Infected objects found: 45
Suspicious objects found: 2
Scan duration: 01:32:53


File name / Threat / Threats count
wininit.exe\CAFB175D.x86.dll/wininit.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
globalroot\Device\__max++>\CAFB175D.x86.dll/globalroot\Device\__max++>\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 23
services.exe\CAFB175D.x86.dll/services.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
svchost.exe\CAFB175D.x86.dll/svchost.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 8
spoolsv.exe\CAFB175D.x86.dll/spoolsv.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
AppleMobileDeviceService.exe\CAFB175D.x86.dll/AppleMobileDeviceService.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mDNSResponder.exe\CAFB175D.x86.dll/mDNSResponder.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
msmdsrv.exe\CAFB175D.x86.dll/msmdsrv.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
sqlbrowser.exe\CAFB175D.x86.dll/sqlbrowser.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
WLIDSVC.EXE\CAFB175D.x86.dll/WLIDSVC.EXE\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
explorer.exe\CAFB175D.x86.dll/explorer.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
SQLAGENT.EXE\CAFB175D.x86.dll/SQLAGENT.EXE\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jusched.exe\CAFB175D.x86.dll/jusched.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
iTunesHelper.exe\CAFB175D.x86.dll/iTunesHelper.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
firefox.exe\CAFB175D.x86.dll/firefox.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
java.exe\CAFB175D.x86.dll/java.exe\CAFB175D.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
Selected area has been scanned.

_______________________________________ _______________________________________ ____
exeHelper by Raktor
Build 20091021
Run at 15:00:33 on 10/22/09
Now searching...
Checking for numerical processes...
Checking for bad processes...
Checking for bad files...
Checking for bad registry entries...
Removing HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PopRock
Resetting filetype association for .exe
Resetting filetype association for .com
Resetting userinit and shell values...
Resetting policies...
--Finished--

Hi jspizzy,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

1. Download DDS and save it to your desktop from
2. Here
3. here or
4. here.
   
   • Disable any script blocking protection (How to Disable your Security Programs)
   • Double click DDS icon to run the tool (may take up to 3 minutes to run)
   • When done, DDS.txt will open.
   • After a few moments, attach.txt will open in a second window.
   • Save both reports to your desktop.
   
   
5. We Need to check for Rootkits with RootRepeal
   
   1. Download RootRepeal from one of the following locations and save it to your desktop.
      
      • Here
      • Here
        
      • or Here
   2. Open on your desktop.
   3. Click the tab.
   4. Click the button.
   5. In the Select Scan dialog, check
      
   6. Push Ok
   7. Check the box for your main system drive (Usually C:), and press Ok.
   8. Allow RootRepeal to run a scan of your system. This may take some time.
   9. Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt.
   
   
6. Copy/paste the log (that you've previously saved to your desktop) from RootRepeal onto your post.
   
   
7. Copy/paste the DDS.txt log (that you've previously saved to your desktop) onto your post.
   
   
8. Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

Due to inactivity this topic will be closed.
If you need help please start a new thread.