What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Google redirect, taskbar spyware alert popup

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I'm using a Microsoft Windows XP (Vers 2002) with SP 3, and recently encountered several issues after infection by a virus

- Google search result links are redirected
- Red shield icon with a cross in the center in tray keeps popping up with alerts
- Internet Security 2010 alerts kept popping up, sometimes opening IE with its homepage to buy its product etc.
- Desktop background is changed to a 'Spyware Alert!' etc (black box on green background)

Steps already taken:
AVG did not find anything
Stinger removed an Artemis Trojan
Desktop Background can be replaced via other means, but still changes back to the offensive spyware alert after…reboot? (I think, this is a shared computer)
Ran HijackThis and obtained resulting logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:10:49 PM, on 12/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\DHCPManage.exe
C:\WINDOWS\system32\FastNetSrv.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\winupdate86.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\TTPlayer\TTPlayer.exe
C:\POS\Rm22.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\svchost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://bar.baidu.com/sobar/defaultsearch.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://bar.baidu.com/sobar/defaultsearch.html
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\winlogon86.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {8a353969-9e9b-4dc0-877f-78f6730ef59f} - suhalewo.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ClearTKHandle] C:\Program Files\TouchKit\ClearTKHandle.exe
O4 - HKLM\..\Run: [winupdate86.exe] C:\WINDOWS\system32\winupdate86.exe
O4 - HKLM\..\Run: [tqammy] RUNDLL32.EXE C:\WINDOWS\system32\msaouahn.dll,w
O4 - HKLM\..\Run: [jahozugor] Rundll32.exe "c:\windows\system32\fihatoye.dll",a
O4 - HKLM\..\Run: [vegotuvoso] Rundll32.exe "hilemebu.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\BPA Client 1\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-18\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Internet Security 2010] C:\Program Files\InternetSecurity2010\IS2010.exe (User 'Default user')
O4 - Global Startup: Restaurant Maid 2.28.LNK = C:\POS\Rm22.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{55484BED-9D17-42D3-AF77-F9EBFFE642F4}: NameServer = 193.104.110.38,4.2.2.1,192.168.1.254
O20 - AppInit_DLLs: c:\windows\system32\fihatoye.dll
O21 - SSODL: pihiyowuk - {d5db8868-f4d1-4e86-b652-fe7e9ccae354} - c:\windows\system32\fihatoye.dll
O22 - SharedTaskScheduler: gahurihor - {d5db8868-f4d1-4e86-b652-fe7e9ccae354} - c:\windows\system32\fihatoye.dll
O23 - Service: DHCPManagement - Unknown owner - C:\WINDOWS\DHCPManage.exe
O23 - Service: fastnetsrv Service (fastnetsrv) - Netopsystems A - C:\WINDOWS\system32\FastNetSrv.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: X-Charge Server (XCService) - Unknown owner - C:\Program Files\X-Charge\XCService.exe

–
End of file - 5749 bytes


Can anyone please help me with this? I'm not sure which boxes I should be checking and what other action I should take for the seemingly various viruses that are present. Thank you!
Post #2
My name is SweetTech. I would be glad to take a look at your log and help you with solving any malware problems. I'd be grateful if you would note the following:
  • Logs from malware removal programs (DDS is one of them) can take some time to analyze. I need you to be patient while I analyze any logs you post.
  • Please make sure to carefully read any instruction that I give you.
    Reading too lightly will cause you to miss important steps, which could have destructive effects.
  • If you're not sure, or if something unexpected happens, do NOT continue! Stop and ask!
  • These instructions have been specifically tailored to your computer and the issues you are experiencing with your computer. It's important to note that these instructions are not suitable for any other computer, even if the issues are fairly similar.
  • Do not do things I do not ask for, such as running a spyware scan on your computer. The one thing that you should always do, is to make sure sure that your anti-virus definitions are up-to-date!
  • If I instruct you to download a specific tool in which you already have, please delete the copy that you have and re-download the tool. The reason I ask you to do this is because these tools are updated fairly regularly.
  • I am going to stick with you until ALL malware is gone from your system. I would appreciate it if you would do the same. From this point, we're in this together ;)
    Because of this, you must reply within five days    . I will post a reminder should you seem to fail to do this, however, if you fail to reply within three days then,
    unless I have been notified of your absence in advance, the topic shall be closed!
  • Lastly, I am no magician. I will try very hard to fix your issues, but no promises can be made. Also be aware that some infections are so severe that you might need to resort to reformatting and reinstalling your operating system.
    Don't worry, this only happens in severe cases, but it sadly does happen. Be prepared to back up your data. Have means of backing up your data available.
Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise.
This may cause a delay, but I will do my best to keep it as short as possible.

I am checking over your log, I will post back shortly with instructions.
Post #4
[external image: Posted Image] One or more of the identified infections is a backdoor trojan and password stealer.

This type of infection allows hackers to access and remotely control your computer, log keystrokes, steal critical system information, and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it contains any other sensitive information, then from a clean computer, change all passwords where applicable.
It would also be wise to contact those same financial institutions to appraise them of your situation.


I highly suggest you take a look at the two links provided below:
1. How Do I Handle Possible Identify Theft, Internet Fraud, and CC Fraud?
2. When should I re-format? How should I reinstall?

Scanning with DDS

Please download DDS by sUBs from one of the following links and save it to your desktop.
[external image: Posted Image]
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by doing the following:
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image] to insert the attachment into your post
Scanning with GMER
[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Please make sure you include the following items in your next post:
1. The logs that were produced after running DDS. (DDS.txt & Attach.txt)
2. The log that was produced after running GMER.
3. An update on how your computer is currently running.

It would be helpful if you could answer each question in the order asked, as well as numbering your answers.
Post #5
Do I need to download DDS both links you have provided? Since the infected computer is a work computer I'm helping to fix, I'm accessing the forums from home, and my Mac won't give me anything but gibberish when I click on the second link in either Safari or Firefox. Also, because of the holiday season I'm not actually going in to work unless I drop by to help fix the computer, so my replies may be delayed. Sorry and thank you so much!
Post #6
Business or Corporate Computer

Unfortunately, we cannot help remove malware from any business or corporate computers. Most if not all of these systems have specific modifications made to them, which can be removed or damaged by some of the tools we use. Being altered, these systems may also hinder the tools we use, and possibly reduce the effectiveness in removing the malware of the computer. As this is a public forum there is the slight chance that some sensitive material may be exposed to the public. If this computer is infected, there is a great chance that other networked computers (as is the case with most business) have been infected as well.

A snippet from our Terms of Use:

We offer free computer help and tech support for home and personal use. We are not here to support others that work for profit, or to support/replace your company's IT department.

I strongly urge you to contact your IT department. Make sure you inform them of the issues/problems you are experiencing. If your computer is infected, then chances are other computers are as well. Please make sure that you make your IT department aware of this, so that they are able to create a plan to minimize any impact this may have on the business.

I'm sorry, that I am not able to be of more assistance to you.

Please respond to this topic to let me know that you have read this post. That way I can go ahead and have this thread closed.
Post #7
Basically, we have no IT department, and we own only one computer. I don't believe there is any confidential material at all since it is not the purpose of the computer. Thanks anyway.
Post #8
Hello, I've spoken to a colleague of mine, and he has assured me that he doesn't see a problem with me continuing to offer assistance in getting this computer clean. You do not need to download DDS from both links. We provide you with 2 links, so that in the event one link is down or you experience issues with one, you can try the other link provided. I have a question in regards to the infected work computer. Does this computer have the ability to connect to the Internet?
Post #9 last edited
I am so glad to hear that. Thank you so much! I really appreciate it, and I'm positive the other people I work with will thank you for it too. Yes, the computer has the ability to connect to the internet, but it doesn't need to connect to the internet for work-related things/transactions as I unplugged the LAN cable when alerts about someone trying to gain remote access kept popping up. No sensitive information like credit card numbers are stored in it either. Ah, I get it about the either/or DDS now. Just wanted to clarify since they had different extensions and if I needed both of them for the program to work! Again, thank you and Merry Christmas! :D
Post #10

Ah, I get it about the either/or DDS now. Just wanted to clarify since they had different extensions and if I needed both of them for the program to work!

It's better to ask, and be sure then to not ask and be unsure.

Merry Christmas to you as well. :)
Post #12
Hi SweetTech, Sorry for being MIA for a while, real life happened with the Christmas season and I was travelling between places and finally have time to check my email. I would like to thank you from the bottom of my heart for all the help you've given me so far, especially since this is a special case, but I think… the computer is beyond salvation now, so I think we can stop here. Thank you so much for your concern so far! Happy holidays, kyrin
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI