TTDaddy
Topic Starter
Hello
Thanks in advance for any help you can lend me. As of yesterday my browser (IE6) is being hijacked when I do a Google search. That is, the results display normally but when I click on a link I'm taken to a random ad site. I've been searching for help/remedies and I THINK that Firefox is now working properly but IE is still captive. I've downloaded and run SUPERAntiSPYWARE, Spybot S & D and MBA-M and still the links are being hijacked. I ran Kaspersky and HJT and will post those logs next. Thanks for your help, let me know if I've omitted any crucial information! Hope I'm doing this right…..
Here's the Kaspersky log:
Tuesday, July 21, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, July 21, 2009 22:25:41
Records in database: 2508957
——————————————————————————–
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Scan statistics:
Files scanned: 66235
Threat name: 17
Infected objects: 42
Suspicious objects: 0
Duration of the scan: 01:46:36
File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\028C0000.VBN Infected: Trojan.Java.ClassLoader.ap 3
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN Infected: Trojan.Java.ClassLoader.as 3
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\084C0001.VBN Infected: Trojan.Java.ClassLoader.as 3
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A440001.VBN Infected: Trojan.Java.ClassLoader.as 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A440003.VBN Infected: Trojan.Java.ClassLoader.as 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C740000\4D7CCF31.VBN Infected: not-a-virus:AdWare.Win32.BHO.dht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B0C0000.VBN Infected: Hoax.Win32.Agent.id 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06D40000.VBN Infected: Rootkit.Win32.Clbd.lf 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06D40002.VBN Infected: Backdoor.Win32.TDSS.bkw 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06D40007.VBN Infected: Rootkit.Win32.Clbd.lf 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CD40000.VBN Infected: Trojan-Downloader.Win32.Agent.aswm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DFC0000.VBN Infected: Trojan-Dropper.Win32.Agent.aeob 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DFC0002.VBN Infected: Trojan-Dropper.Win32.Agent.aeob 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\13C80000.VBN Infected: Trojan.Win32.Agent.bgun 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\13C80003.VBN Infected: Trojan.Win32.Agent.bgun 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000000.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000002.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000004.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000006.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B00000A.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08200000\49B8FFD6.VBN Infected: Trojan-Downloader.Win32.DlKroha.s 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\10E80000.VBN Infected: Trojan-Downloader.Win32.DlKroha.s 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E140000\4FBF8F14.VBN Infected: Trojan-Downloader.Win32.Agent.brou 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DE80000\4FEA291F.VBN Infected: Trojan.Win32.Agent.cglu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640000\4E7597D0.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640001\4E759809.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640002\4E759825.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640003\4E759849.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640004\4E759865.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640005\4E759887.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640006.VBN Infected: Trojan-Proxy.Win32.Agent.bnq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640007.VBN Infected: Trojan-Proxy.Win32.Agent.bnq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\103C0001.VBN Infected: Net-Worm.Win32.Koobface.jy 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\103C0004.VBN Infected: Net-Worm.Win32.Koobface.jy 1
C:\Program Files\Musicmatch\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Program Files\Musicmatch\Common\ComponentMgr\HoldingArea\WebSys\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
The selected area was scanned.
Thanks in advance for any help you can lend me. As of yesterday my browser (IE6) is being hijacked when I do a Google search. That is, the results display normally but when I click on a link I'm taken to a random ad site. I've been searching for help/remedies and I THINK that Firefox is now working properly but IE is still captive. I've downloaded and run SUPERAntiSPYWARE, Spybot S & D and MBA-M and still the links are being hijacked. I ran Kaspersky and HJT and will post those logs next. Thanks for your help, let me know if I've omitted any crucial information! Hope I'm doing this right…..
Here's the Kaspersky log:
Tuesday, July 21, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, July 21, 2009 22:25:41
Records in database: 2508957
——————————————————————————–
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Scan statistics:
Files scanned: 66235
Threat name: 17
Infected objects: 42
Suspicious objects: 0
Duration of the scan: 01:46:36
File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\028C0000.VBN Infected: Trojan.Java.ClassLoader.ap 3
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\084C0000.VBN Infected: Trojan.Java.ClassLoader.as 3
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\084C0001.VBN Infected: Trojan.Java.ClassLoader.as 3
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A440001.VBN Infected: Trojan.Java.ClassLoader.as 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0A440003.VBN Infected: Trojan.Java.ClassLoader.as 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C740000\4D7CCF31.VBN Infected: not-a-virus:AdWare.Win32.BHO.dht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B0C0000.VBN Infected: Hoax.Win32.Agent.id 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06D40000.VBN Infected: Rootkit.Win32.Clbd.lf 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06D40002.VBN Infected: Backdoor.Win32.TDSS.bkw 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\06D40007.VBN Infected: Rootkit.Win32.Clbd.lf 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0CD40000.VBN Infected: Trojan-Downloader.Win32.Agent.aswm 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DFC0000.VBN Infected: Trojan-Dropper.Win32.Agent.aeob 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DFC0002.VBN Infected: Trojan-Dropper.Win32.Agent.aeob 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\13C80000.VBN Infected: Trojan.Win32.Agent.bgun 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\13C80003.VBN Infected: Trojan.Win32.Agent.bgun 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000000.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000002.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000004.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B000006.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0B00000A.VBN Infected: Trojan.Win32.Inject.nht 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\08200000\49B8FFD6.VBN Infected: Trojan-Downloader.Win32.DlKroha.s 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\10E80000.VBN Infected: Trojan-Downloader.Win32.DlKroha.s 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0E140000\4FBF8F14.VBN Infected: Trojan-Downloader.Win32.Agent.brou 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0DE80000\4FEA291F.VBN Infected: Trojan.Win32.Agent.cglu 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640000\4E7597D0.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640001\4E759809.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640002\4E759825.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640003\4E759849.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640004\4E759865.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640005\4E759887.VBN Infected: Trojan-Spy.Win32.Zbot.vfe 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640006.VBN Infected: Trojan-Proxy.Win32.Agent.bnq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\0C640007.VBN Infected: Trojan-Proxy.Win32.Agent.bnq 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\103C0001.VBN Infected: Net-Worm.Win32.Koobface.jy 1
C:\Documents and Settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\Quarantine\103C0004.VBN Infected: Net-Worm.Win32.Koobface.jy 1
C:\Program Files\Musicmatch\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Program Files\Musicmatch\Common\ComponentMgr\HoldingArea\WebSys\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
The selected area was scanned.