 Hijackthis log- Unknown Redirecting, Major website redirected to fake microsoft website. help please |
Welcome Guest to What the Tech! ( Log In | Register ) We specialize in the removal of malicious software (malware), but here you'll find free help and support for all your tech questions. We invite you to ask questions, share experiences, and learn. Explore our message boards, or register now to post messages of your own. Please Start Here. Register today (registration removes advertising)
  |
 Oct 18 2008, 10:26 AM
Post
#1
|
|
|
New Member  Group: New Member Posts: 8 Joined: 23-December 07 Member No.: 75,387 Operating System: Xp  |
Logfile of HijackThis v1.99.1 Scan saved at 9:17:31 AM, on 10/18/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\vsnp2std.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe c:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe c:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\system32\rpcnet.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = my.collinscollege.edu R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O1 - Hosts: 125.67.67.197 www.yahoo.com O1 - Hosts: 125.67.67.197 www.google.com O1 - Hosts: 125.67.67.197 www.myspace.com O1 - Hosts: 125.67.67.197 www.youtube.com O1 - Hosts: 125.67.67.197 www.facebook.com O1 - Hosts: 125.67.67.197 www.live.com O1 - Hosts: 125.67.67.197 www.msn.com O1 - Hosts: 125.67.67.197 www.wikipedia.org O1 - Hosts: 125.67.67.197 www.ebay.com O1 - Hosts: 125.67.67.197 www.aol.com O1 - Hosts: 125.67.67.197 www.craigslist.org O1 - Hosts: 125.67.67.197 www.blogger.com O1 - Hosts: 125.67.67.197 www.go.com O1 - Hosts: 125.67.67.197 www.amazon.com O1 - Hosts: 125.67.67.197 www.cnn.com O1 - Hosts: 125.67.67.197 espn.go.com O1 - Hosts: 125.67.67.197 www.espn.com O1 - Hosts: 125.67.67.197 www.photobucket.com O1 - Hosts: 125.67.67.197 www.microsoft.com O1 - Hosts: 125.67.67.197 www.comcast.net O1 - Hosts: 125.67.67.197 www.imdb.com O1 - Hosts: 125.67.67.197 www.wordpress.com O1 - Hosts: 125.67.67.197 www.nytimes.com O1 - Hosts: 125.67.67.197 www.weather.com O1 - Hosts: 125.67.67.197 www.ask.com O1 - Hosts: 125.67.67.197 www.aim.com O1 - Hosts: 125.67.67.197 www.apple.com O1 - Hosts: 125.67.67.197 www.mapquest.com O1 - Hosts: 125.67.67.197 www.youporn.com O1 - Hosts: 125.67.67.197 www.fastclick.com O1 - Hosts: 125.67.67.197 www.pornhub.com O1 - Hosts: 125.67.67.197 www.rapidshare.com O1 - Hosts: 125.67.67.197 www.pogo.com O1 - Hosts: 125.67.67.197 www.redtube.com O1 - Hosts: 125.67.67.197 www.doubleclick.com O1 - Hosts: 125.67.67.197 www.att.com O1 - Hosts: 125.67.67.197 www.adobe.com O1 - Hosts: 125.67.67.197 www.vnn.com O1 - Hosts: 125.67.67.197 www.sportsline.com O1 - Hosts: 125.67.67.197 www.netflix.com O1 - Hosts: 125.67.67.197 www.dell.com O1 - Hosts: 125.67.67.197 www.google.co.uk O1 - Hosts: 125.67.67.197 www.bbc.co.uk O1 - Hosts: 125.67.67.197 www.ebay.co.uk O1 - Hosts: 125.67.67.197 www.bebo.com O1 - Hosts: 125.67.67.197 www.amazon.co.uk O1 - Hosts: 125.67.67.197 www.sky.com O1 - Hosts: 125.67.67.197 www.virginmedia.com O1 - Hosts: 125.67.67.197 www.aol.co.uk O1 - Hosts: 125.67.67.197 www.hsbc.co.uk O1 - Hosts: 125.67.67.197 www.antispyware.com O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "c:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "c:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [CleanUp] c:\dell\ib\rmall.bat O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181810095250 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - c:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - c:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - c:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe |
 |
 
|
|
Oct 18 2008, 03:23 PM
Post
#2
|
|
 SuperMember  Group: Malware Team Posts: 1,273 Joined: 30-July 06 Member No.: 59,198 Operating System: Windows XP |
I'll post this in two parts - complete both and post accordingly.
1) Download Malwarebytes' Anti-Malware from here and save it to your Desktop.
2) Download HostsXpert by FunkyToad from here and save it to your Desktop. You will need to extract the file(s): Right click on the zipped folder and from the menu that appears, click on Extract All... In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again. In the final window, click on Finish You should now see the HostsXpert folder - open it and double click HostsXpert.exe
Let me have the MBAM log, a fresh HJT log (run in Normal Mode) AND a description of how your PC is behaving. |
|
|
|
|
Oct 19 2008, 04:08 AM
Post
#3
|
|
|
New Member Group: New Member Posts: 8 Joined: 23-December 07 Member No.: 75,387 Operating System: Xp |
QUOTE (Noviciate @ Oct 18 2008, 04:23 PM)  I'll post this in two parts - complete both and post accordingly. 1) Download Malwarebytes' Anti-Malware from here and save it to your Desktop.
2) Download HostsXpert by FunkyToad from here and save it to your Desktop. You will need to extract the file(s): Right click on the zipped folder and from the menu that appears, click on Extract All... In the 'Extraction Wizard' window that opens, click on Next> and in the next window that appears, click on Next> again. In the final window, click on Finish You should now see the HostsXpert folder - open it and double click HostsXpert.exe
Let me have the MBAM log, a fresh HJT log (run in Normal Mode) AND a description of how your PC is behaving. Here is the log, i'm not sure if i'm suppost to quote you. sorry haven't used, or done this before... thanks for the help so far... i'll update on my computers statues. Logfile of HijackThis v1.99.1 Scan saved at 9:17:31 AM, on 10/18/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\vsnp2std.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe c:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe c:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe C:\WINDOWS\system32\nvsvc32.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\PSIService.exe C:\WINDOWS\system32\rpcnet.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = my.collinscollege.edu R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O1 - Hosts: 125.67.67.197 www.yahoo.com O1 - Hosts: 125.67.67.197 www.google.com O1 - Hosts: 125.67.67.197 www.myspace.com O1 - Hosts: 125.67.67.197 www.youtube.com O1 - Hosts: 125.67.67.197 www.facebook.com O1 - Hosts: 125.67.67.197 www.live.com O1 - Hosts: 125.67.67.197 www.msn.com O1 - Hosts: 125.67.67.197 www.wikipedia.org O1 - Hosts: 125.67.67.197 www.ebay.com O1 - Hosts: 125.67.67.197 www.aol.com O1 - Hosts: 125.67.67.197 www.craigslist.org O1 - Hosts: 125.67.67.197 www.blogger.com O1 - Hosts: 125.67.67.197 www.go.com O1 - Hosts: 125.67.67.197 www.amazon.com O1 - Hosts: 125.67.67.197 www.cnn.com O1 - Hosts: 125.67.67.197 espn.go.com O1 - Hosts: 125.67.67.197 www.espn.com O1 - Hosts: 125.67.67.197 www.photobucket.com O1 - Hosts: 125.67.67.197 www.microsoft.com O1 - Hosts: 125.67.67.197 www.comcast.net O1 - Hosts: 125.67.67.197 www.imdb.com O1 - Hosts: 125.67.67.197 www.wordpress.com O1 - Hosts: 125.67.67.197 www.nytimes.com O1 - Hosts: 125.67.67.197 www.weather.com O1 - Hosts: 125.67.67.197 www.ask.com O1 - Hosts: 125.67.67.197 www.aim.com O1 - Hosts: 125.67.67.197 www.apple.com O1 - Hosts: 125.67.67.197 www.mapquest.com O1 - Hosts: 125.67.67.197 www.youporn.com O1 - Hosts: 125.67.67.197 www.fastclick.com O1 - Hosts: 125.67.67.197 www.pornhub.com O1 - Hosts: 125.67.67.197 www.rapidshare.com O1 - Hosts: 125.67.67.197 www.pogo.com O1 - Hosts: 125.67.67.197 www.redtube.com O1 - Hosts: 125.67.67.197 www.doubleclick.com O1 - Hosts: 125.67.67.197 www.att.com O1 - Hosts: 125.67.67.197 www.adobe.com O1 - Hosts: 125.67.67.197 www.vnn.com O1 - Hosts: 125.67.67.197 www.sportsline.com O1 - Hosts: 125.67.67.197 www.netflix.com O1 - Hosts: 125.67.67.197 www.dell.com O1 - Hosts: 125.67.67.197 www.google.co.uk O1 - Hosts: 125.67.67.197 www.bbc.co.uk O1 - Hosts: 125.67.67.197 www.ebay.co.uk O1 - Hosts: 125.67.67.197 www.bebo.com O1 - Hosts: 125.67.67.197 www.amazon.co.uk O1 - Hosts: 125.67.67.197 www.sky.com O1 - Hosts: 125.67.67.197 www.virginmedia.com O1 - Hosts: 125.67.67.197 www.aol.co.uk O1 - Hosts: 125.67.67.197 www.hsbc.co.uk O1 - Hosts: 125.67.67.197 www.antispyware.com O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "c:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "c:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [CleanUp] c:\dell\ib\rmall.bat O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181810095250 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - c:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - c:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - c:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe |
|
|
|
|
Oct 19 2008, 01:19 PM
Post
#4
|
|
|
SuperMember Group: Malware Team Posts: 1,273 Joined: 30-July 06 Member No.: 59,198 Operating System: Windows XP |
QUOTE i'm not sure if i'm suppost to quote you Nope, not necessary. I don't see the MBAM log that I asked for, so you'll need to post that. |
|
|
|
|
Oct 19 2008, 01:23 PM
Post
#5
|
|
|
New Member Group: New Member Posts: 8 Joined: 23-December 07 Member No.: 75,387 Operating System: Xp |
QUOTE (Noviciate @ Oct 19 2008, 02:19 PM) QUOTE i'm not sure if i'm suppost to quote you Nope, not necessary. I don't see the MBAM log that I asked for, so you'll need to post that. Actually that came out with no infection and my computer is working perfectly now. no more redirecting or anything. Thanks you so much, this clears my head. I woudn't be able to work if i still had this problem. thanks you so much once again 
|
|
|
|
|
Oct 19 2008, 03:29 PM
Post
#6
|
|
|
SuperMember Group: Malware Team Posts: 1,273 Joined: 30-July 06 Member No.: 59,198 Operating System: Windows XP |
I'm glad to hear that the PC is fine. One thing you can do is to post one final HJT log. The one you posted last time is the same as the first one - I need a fresh log to see exactly what's what.
Also, just because you can, run HJT and click on Open the Misc Tools section.
|
|
|
|
|
Oct 19 2008, 05:36 PM
Post
#7
|
|
|
New Member Group: New Member Posts: 8 Joined: 23-December 07 Member No.: 75,387 Operating System: Xp |
QUOTE (Noviciate @ Oct 19 2008, 04:29 PM) I'm glad to hear that the PC is fine. One thing you can do is to post one final HJT log. The one you posted last time is the same as the first one - I need a fresh log to see exactly what's what. Also, just because you can, run HJT and click on Open the Misc Tools section.
Here they are.... HIJack and Uninstall list Logfile of HijackThis v1.99.1 Scan saved at 4:29:50 PM, on 10/19/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\vsnp2std.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\Program Files\Network Associates\Common Framework\FrameworkService.exe c:\Program Files\Network Associates\VirusScan\Mcshield.exe c:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PSIService.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\system32\rpcnet.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\WTablet\Wacom_TabletUser.exe C:\WINDOWS\system32\Wacom_Tablet.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = my.collinscollege.edu O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "c:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "c:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [ISUSPM Startup] c:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "c:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [CleanUp] c:\dell\ib\rmall.bat O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181810095250 O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - c:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - c:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - c:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\WINDOWS\system32\rpcnet.exe O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\WINDOWS\system32\Wacom_Tablet.exe 3dsmax ancillary install Adobe Flash Player ActiveX Adobe Flash Player Plugin Apple Mobile Device Support Apple Software Update Autodesk 3ds Max 9 32-bit Autodesk DWF Viewer 7 AVG Free 8.0 Backburner Bonjour Choice Guard Conexant HDA D110 MDC V.92 Modem Corel Painter X Corel Painter X DivX Codec DivX Converter DivX Player ERUNT 1.1j FBX Plugin 2006.08 for Max 9.0 High Definition Audio Driver Package - KB835221 Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Microsoft .NET Framework 2.0 (KB918842) Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows XP (KB952287) iTunes Java™ 6 Update 7 Malwarebytes' Anti-Malware McAfee VirusScan Enterprise Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Professional Edition 2003 Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual C++ 2005 Redistributable Mozilla Firefox (3.0.3) MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) NVIDIA Drivers PowerDVD 5.7 QuickTime Rocketfish Webcam Roxio DLA Roxio Express Labeler Roxio RecordNow Audio Roxio RecordNow Copy Roxio RecordNow Data Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 11 (KB954154) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB938464) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Security Update for Windows XP (KB954211) Security Update for Windows XP (KB956390) Security Update for Windows XP (KB956391) Security Update for Windows XP (KB956803) Security Update for Windows XP (KB956841) Security Update for Windows XP (KB957095) Sonic Update Manager Synaptics Pointing Device Driver Update for Windows XP (KB951072-v2) Update for Windows XP (KB951978) Wacom Tablet Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Service Pack 3 ZBrush3 |
|
|
|
|
Oct 20 2008, 01:53 PM
Post
#8
|
|
|
SuperMember Group: Malware Team Posts: 1,273 Joined: 30-July 06 Member No.: 59,198 Operating System: Windows XP |
1) I see from your uninstall list that you have both AVG Free 8.0 and McAfee VirusScan Enterprise installed. Given that you appear to have both running as resident scanners, you need to pick one and uninstall the other. Running two or more AVs can lead to conflictions giving less, not more, protection.
2) Your log doesn't appear to show a third-party software firewall installed - if you have one, and i've missed it, please ignore this. If you are relying the firewall that comes with Service Pack 2, then you need to install one. While the SP2 firewall is better than nothing, it doesn't monitor outgoing traffic, so anything malicious on your computer can 'phone home' at will. If you are using a wireless router that comes with a NAT hardware firewall, this also doesn't monitor outgoing connections. There are a few free firewalls available. Comodo Firewall Pro, available here. PC Tools Firewall Plus, available here. Online Armor Free, available here. It is important to note that you should only have one firewall installed at a time, but you can download them all to your Desktop and install each in turn to see which one you prefer. Understanding and Using Firewalls: http://www.bleepingcomputer.com/tutorials/tutorial60.html 3) One thing that needs tidying up in your HJT log: Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'. Place a checkmark in the boxes to the left of the following entries, by clicking on them: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked 4) Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet. |
|
|
|
|
Oct 20 2008, 06:08 PM
Post
#9
|
|
|
New Member Group: New Member Posts: 8 Joined: 23-December 07 Member No.: 75,387 Operating System: Xp |
QUOTE (Noviciate @ Oct 20 2008, 02:53 PM) 1) I see from your uninstall list that you have both AVG Free 8.0 and McAfee VirusScan Enterprise installed. Given that you appear to have both running as resident scanners, you need to pick one and uninstall the other. Running two or more AVs can lead to conflictions giving less, not more, protection. 2) Your log doesn't appear to show a third-party software firewall installed - if you have one, and i've missed it, please ignore this. If you are relying the firewall that comes with Service Pack 2, then you need to install one. While the SP2 firewall is better than nothing, it doesn't monitor outgoing traffic, so anything malicious on your computer can 'phone home' at will. If you are using a wireless router that comes with a NAT hardware firewall, this also doesn't monitor outgoing connections. There are a few free firewalls available. Comodo Firewall Pro, available here. PC Tools Firewall Plus, available here. Online Armor Free, available here. It is important to note that you should only have one firewall installed at a time, but you can download them all to your Desktop and install each in turn to see which one you prefer. Understanding and Using Firewalls: http://www.bleepingcomputer.com/tutorials/tutorial60.html 3) One thing that needs tidying up in your HJT log: Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'. Place a checkmark in the boxes to the left of the following entries, by clicking on them: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked 4) Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet. Alright Noviciate i did what you told me... i have one question though, i'm not sure if you can help me but my girlfriend has been having problems with her computer lately. She can't get on internet anymore, she can't even look at her documents. What makes it even worse it that she lives in another state at the moment. So is there a way i can send her a Hijackthis setup file so she can get a log. I've actually tried to download it but it just directly goes to a run menus... Thanks for helping me out with my problem and if it's not possible to help me with this other i'd totally understand. Thanks a bunch |
|
|
|
|
Oct 21 2008, 01:02 PM
Post
#10
|
|
|
SuperMember Group: Malware Team Posts: 1,273 Joined: 30-July 06 Member No.: 59,198 Operating System: Windows XP |
A nice installer complete with shortcut on the Desktop can be downloaded from here. You just double click the installer to run it and accept the default location, unless you prefer an alternative, and that's that.
You can email the link to somebody she knows or download the file and send it on a disc if prefer. |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members: