What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Google and Yahoo links redirect me to other pages

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Everytime i use google or yahoo the links from their search engines redirect me to other search pages. I have Avira AntiVir PersonalEdition. When I did an initial scan I found 2 of TR\Click.526, TR\Dldr.DNSChanR.5, TR\Small.GQ.4, and TR\Click.Small.KG. While each subsequent scan finds nothing else it does give me a bunch of warnings. Here is the log of my last scan:

AntiVir PersonalEdition Classic
Report file date: Tuesday, June 27, 2006 09:44

Scanning for 415804 virus strains and unwanted programs.

Licensed to: AntiVir PersonalEdition Classic
Serial number: 0000149996-WURGE-0001
Platform: Windows XP
Windows version: (Service Pack 1) [5.1.2600]
Username: jrunner
Computer name: TICKTOCK

Version informations:
AVSCAN.EXE : 7.0.0.42 376872 6/26/2006 19:43:30
AVSCAN.DLL : 7.0.0.42 53288 6/26/2006 19:43:29
LUKE.DLL : 7.0.0.42 110632 6/26/2006 19:43:33
LUKERES.DLL : 7.0.0.42 25640 6/26/2006 19:43:33
ANTIVIR0.VDF : 6.35.0.1 7371264 6/26/2006 19:43:26
ANTIVIR1.VDF : 6.35.0.5 2048 6/26/2006 19:43:27
ANTIVIR2.VDF : 6.35.0.75 267776 6/26/2006 19:43:27
ANTIVIR3.VDF : 6.35.0.82 17408 6/26/2006 19:43:27
AVEWIN32.DLL : 7.1.0.16 1540608 6/26/2006 19:43:28
AVPREF.DLL : 7.0.0.1 33832 6/26/2006 19:43:29
AVREP.DLL : 6.35.0.47 466984 6/26/2006 19:43:29
AVRPBASE.DLL : 7.0.0.0 1544232 6/26/2006 19:43:29
AVPACK32.DLL : 7.1.0.1 331816 6/26/2006 19:43:29
AVREG.DLL : 6.31.0.90 25128 6/26/2006 19:43:29
NETNT.DLL : 6.32.0.0 6696 6/26/2006 19:43:34
NETNW.DLL : 6.32.0.0 9768 6/26/2006 19:43:34
RCIMAGE.DLL : 7.0.0.71 1642536 6/26/2006 19:43:38
RCTEXT.DLL : 7.0.0.75 77864 6/26/2006 19:43:38

Configuration settings for the scan:
Jobname: '%s'……………..: Manual Selection
Configuration file…………: C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Boot sectors………………: C
Scan memory……………….: 1
Process scan………………: 1
Scan all files…………….: 2
Scan archives……………..: 1
Recursion depth……………: 20
Smart extensions…………..: 1
Macro heuristic……………: 1
File heuristic…………….: -1
Primary action…………….: 1
Secondary action…………..: 0

Start of the scan: Tuesday, June 27, 2006 09:44


The scan over running processes will be started
33 Processes was scanned

Start scanning boot sectors:

Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( 20 files ).


Starting the file scan:

C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\Documents and Settings\jrunner\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\jrunner\NTUSER.DAT.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\jrunner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\jrunner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\jrunner\Local Settings\Temp\Perflib_Perfdata_518.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\NTUSER.DAT
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\ntuser.dat.LOG
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
[WARNING] The file could not be opened!
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\default
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\default.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SAM
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SAM.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SECURITY
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\SECURITY.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\software
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\software.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\system
[WARNING] The file could not be opened!
C:\WINDOWS\system32\config\system.LOG
[WARNING] The file could not be opened!
C:\WINDOWS\Temp\ZLT01335.TMP
[WARNING] The file could not be opened!
C:\WINDOWS\Temp\ZLT01338.TMP
[WARNING] The file could not be opened!


End of the scan: Tuesday, June 27, 2006 10:12
Used time: 28:57 min

The scan has been done completely.

3146 Scanning directories
121286 Files were scanned
0 viruses and/or unwanted programs was found
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
763 Archives were scanned
27 Warnings
0 Notes

As well, I have both Ad-aware and Spybot Search and Destroy. Running both of those just find tracking cookies so I don't think there is anything there. I also used Ewido and while getting tracking cookies as well, I have found Downloader.Agent.uj and Trojan.Pakes. Ewido has no problems quarentining Trojan.Pakes, an error occurs while trying to do the same with Downloader.Agent.uj. After running Ewido again all that is left is the Downloader.Agent.uj, but after running Ewido a third time, the Trojan.Pakes is back too. Here is my last log from Ewido:

———————————————————
ewido anti-spyware - Scan Report
———————————————————

+ Created at: 9:42:16 AM 6/27/2006

+ Scan result:



C:\System Volume Information\_restore{F78EE8A8-F656-4848-AA58-14B3CDC7C9AE}\RP749\A0017708.exe.tcf -> Downloader.Agent.uj : Cleaned with backup (quarantined).
[1004] VM_00F30000 -> Downloader.Agent.uj : Error during cleaning.
[1024] VM_00890000 -> Downloader.Agent.uj : Error during cleaning.
[1044] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning.
[1108] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning.
[1200] VM_003B0000 -> Downloader.Agent.uj : Error during cleaning.
[1332] VM_00F10000 -> Downloader.Agent.uj : Error during cleaning.
[1960] VM_007B0000 -> Downloader.Agent.uj : Error during cleaning.
[2120] VM_00350000 -> Downloader.Agent.uj : Error during cleaning.
[240] VM_008F0000 -> Downloader.Agent.uj : Error during cleaning.
[548] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning.
[604] VM_00C30000 -> Downloader.Agent.uj : Error during cleaning.
[820] VM_00880000 -> Downloader.Agent.uj : Error during cleaning.
[900] VM_00870000 -> Downloader.Agent.uj : Error during cleaning.
C:\Documents and Settings\jrunner\Cookies\jrunner@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.33:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.34:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.35:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.39:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.40:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.41:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.42:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\jrunner\Cookies\[removed][1].txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.56:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\jrunner\Cookies\[removed][2].txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.51:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@findwhat[1].txt -> TrackingCookie.Findwhat : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@overture[1].txt -> TrackingCookie.Overture : Cleaned.
:mozilla.61:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.62:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.63:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.14:C:\Documents and Settings\jrunner\Application Data\Mozilla\Firefox\Profiles\g7cyhcqi.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\Documents and Settings\jrunner\Cookies\jrunner@zedo[2].txt -> TrackingCookie.Zedo : Cleaned.
C:\System Volume Information\_restore{F78EE8A8-F656-4848-AA58-14B3CDC7C9AE}\RP749\A0017757.exe -> Trojan.Pakes : Cleaned with backup (quarantined).


::Report end

I also used Trojan Hunter. The first time I scanned it found one thing in my registry, but I guess Trojan Hunter took care of it. I ran Trojan Hunter again and this time it found one thing in a file, and again I assume that Trojan Hunter took care of it. Now when I scan it finds nothing. And finally here is my HijackThis logfile:

Logfile of HijackThis v1.99.1
Scan saved at 3:49:40 PM, on 6/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\TrojanHunter 4.5\THGuard.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Documents and Settings\jrunner\Desktop\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\WINDOWS\System32\LVCOMS.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKLM\..\Run: [dmgns.exe] C:\WINDOWS\System32\dmgns.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc4.webresponse.one.microsoft.com/…p/TLIEFlash.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3426D5-0AEC-4983-8BFF-8B702CDBEDCB}: NameServer = 85.255.113.93,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{295330C8-56EA-4631-BFA0-F5C5DBF69E06}: NameServer = 85.255.113.93,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB0CF6F-B622-4768-A5B5-64D5A032BDAD}: NameServer = 85.255.113.93,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{2BEE4C77-FDFE-414E-A9FB-17570EB602AB}: NameServer = 85.255.113.93,85.255.112.23
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D1FDEAA-0A46-4CA2-84E4-71DB9B3B5DCE}: NameServer = 85.255.113.93,85.255.112.23
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C3426D5-0AEC-4983-8BFF-8B702CDBEDCB}: NameServer = 85.255.113.93,85.255.112.23
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3426D5-0AEC-4983-8BFF-8B702CDBEDCB}: NameServer = 85.255.113.93,85.255.112.23
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)

If all these programs can't take care of this what should I do? Thanks!
Post #2
Welcome to the forum :wavey:

Your computer has been hijacked by people in the Ukraine. What you have is a Wareout infection.

85.255.112.0 - 85.255.127.255
Inhoster hosting company
OOO Inhoster, Poltavskij Shliax 24, Kharkiv, 61000, Ukraine


Please download FixWareout from one of these links:
Fixwareout.exe
Fixwareout.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

* Save it to your desktop and run it.
* Click Next, then Install, make sure "Run fixit" is checked and click Finish.
* The fix will begin; follow the prompts.
* You will be asked to reboot your computer; please do so.
* Your system may take longer than usual to load; this is normal.
* Once the desktop loads a text will open (report.txt). We'll need that in a bit.

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):
(Note: Fixwareout.exe may have removed some of these)

O4 - HKLM\..\Run: [dmgns.exe] C:\WINDOWS\System32\dmgns.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{0C3426D5-0AEC-4983-8BFF-8B702CDBEDCB}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{295330C8-56EA-4631-BFA0-F5C5DBF69E06}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{2BB0CF6F-B622-4768-A5B5-64D5A032BDAD}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{2BEE4C77-FDFE-414E-A9FB-17570EB602AB}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{8D1FDEAA-0A46-4CA2-84E4-71DB9B3B5DCE}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CS1\Services\Tcpip\..\{0C3426D5-0AEC-4983-8BFF-8B702CDBEDCB}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CS2\Services\Tcpip\..\{0C3426D5-0AEC-4983-8BFF-8B702CDBEDCB}: NameServer = 85.255.113.93,85.255.112.23

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

C:\WINDOWS\System32\dmgns.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new log file into this thread. :)

Also open this file with Notepad:

C:\fixwareout\report.txt

And paste it's contents into your next post.

:)
Post #3
I did everything to the T but I did not see any dmgns.exe, not even in the System32 folder. Here is my new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 8:09:44 PM, on 6/27/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\CTHELPER.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\TrojanHunter 4.5\THGuard.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv4.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\jrunner\Desktop\HijackThis.exe

O1 - Hosts: localhost 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Jet Detection] "C:\Program Files\Creative\SBLive\PROGRAM\ADGJDet.exe"
O4 - HKLM\..\Run: [LVCOMS] C:\WINDOWS\System32\LVCOMS.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [KillAndClean] "C:\Program Files\KillAndClean\KillAndClean.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {94B82441-A413-4E43-8422-D49930E69764} (TLIEFlashObj Class) - https://rtc4.webresponse.one.microsoft.com/…p/TLIEFlash.CAB
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: PDEngine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDEngine.exe
O23 - Service: PDScheduler (PDSched) - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk\PDSched.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WUSB54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv4.exe (file missing)

And here is the report.txt from fixwareout:

Fixwareout ver 1.003
Last edited 04/26/2006
Post this report in the forums please

Reg Entries that were deleted
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ruins\zhpmd
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\xedocne
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\gib_ogol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\repiwoh
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\llun
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\23plhps
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\mgcppp
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\tesvaf
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls\nlcalik
…

Microsoft ® Windows Script Host Version 5.6
Random Runs removed from HKLM
"dmphz.exe"=-
…

PLEASE NOTE, There WILL be LEGIT FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Example ipsec6.exe is lagitamate

»»»»» Search by size and names…
C:\WINDOWS\SYSTEM32\IPSEC6.EXE
C:\WINDOWS\SYSTEM32\RDPCLIP.EXE
* csr.exe C:\WINDOWS\System32\CSOUR.EXE

»»»»» Misc files

»»»»» Checking for older varients covered by the Rem3 tool

»»»»»
Search five digit cs, dm and jb files
This WILL/CAN also list Legit Files, Submit them at Virustotal
C:\WINDOWS\SYSTEM32\CSOUR.EXE 51,287 2006-06-26
C:\WINDOWS\SYSTEM32\DMPHZ.EXE 44,071 2003-05-11
Post #4
Go here:

VirusTotal Online File Scanner

And submit these files for a virus scan:

C:\WINDOWS\SYSTEM32\CSOUR.EXE
C:\WINDOWS\SYSTEM32\DMPHZ.EXE

If it says they are "infected", remove them.

The log looks good. :thumbup:

Thank you for choosing TomCoyote for your malware removal solutions.

M68 :)

Post Infection Items To Ponder
Post #5
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI