when i open IE i get this popup titled 'system integrity scan wizard' and i suspect know that this is spyware but do not know how to remove it. could someone help me? this is the log from hijackthis.
not to mention that now there's this popup window appearing on my computer, which says:
Hello and welcome to the TC forums
Please go
HERE and do a online scan.
Let me know what is found.
Next:
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)
It's normal after running ATF cleaner that the PC will be slower to boot the first time.
Next:
Download
AVG Anti-Spyware from
HERE and save that file to your
desktop.
This is a 30 day trial of the program Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop Once the setup is complete you will need run ewido and update the definition On the main screen select the icon "Update " then select the "Next select the "Start Update " button, the update will start and a Once the update has completed select the "Scanner " icon at the top of Settings " tab. Once in the Settings screen click on "Recommended actions " and then "Quarantine". ". Under "Reports "Select "Automatically generate report after every scan " Un-Select "Only if threats were found " Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.
Reboot your computer into SafeMode . You can do this by restarting F8 key until a menu appears. IMPORTANT: Lauch AVG Anti-Spyware by double-clicking the icon on your desktop. Select the "Scanner " icon at the top and then the "Scan " tab Complete System Scan ". ewido will now begin the scanning process, be patient this may take a little Once the scan is complete do the following: If you have any infections you will prompted, then select "Apply all " Next select the "Reports " icon at the top. Select the "Save report as " button in the lower left hand of the Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
Log from AVG:
* Download
Combofix to your desktop.
Doubleclick
combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
combofix log:
Download Pocket Killbox
http://www.atribune.org/downloads/KillBox.exe
If you already have Killbox first ensure it is this version !.
Then double-click on the killbox.exe program.
Start Killbox and click on Tools->Delete Temp Files.
Then select the option labeled
Delete on reboot.
Do not close killbox, and open
notepad , by clicking on Start, then Run, and typing notepad.exe and pressing the OK button.
When notepad is open,
copy and paste the following
bolded text into the notepad screen. You do this by highlighting each of the below bolded filenames and then pressing
Control-C on your keyboard. Then click on the open notepad windows and press
Control-V to paste the contents into the notepad.
Return to Killbox, go to the File menu and select
Paste from Clipboard.
Still in Killbox, click the
red-and-white Delete File button. Click
Yes at the Delete on Reboot prompt. Click No at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually
"copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
How are you doing with the fix?
well i switched to IE7 now and haven't seen the popup, but every time the computer starts there's this message saying 'error loading nuwawrh.dll the registered module could not be found.' or something along those lines
Did you run the fix I suggested?
"copy/paste" a new HJT log file into this thread.
Logfile of HijackThis v1.99.1
* Download
Combofix to your desktop.
Doubleclick
combo.exe
Follow the prompts.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.
combofix log:
Home - 06-11-15 10:22:02.90 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Documents and Settings\Home\Desktop"
((((((((((((((((((((((((((((((( Files Created from 2006-10-15 to 2006-11-15 ))))))))))))))))))))))))))))))))))
2006-11-07 21:12 121,856 ——— C:\WINDOWS\system32\xmllite.dll
2006-10-30 15:01 53,248 –a—— C:\WINDOWS\system32\Process.exe
2006-10-30 15:01 40,960 –a—— C:\WINDOWS\system32\swsc.exe
2006-10-30 15:01 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2006-10-30 15:01 135,168 –a—— C:\WINDOWS\system32\swreg.exe
2006-10-27 15:09 6,049,280 ——— C:\WINDOWS\system32\ieframe.dll
2006-10-27 15:09 50,688 ——— C:\WINDOWS\system32\msfeedsbs.dll
2006-10-27 15:09 458,752 ——— C:\WINDOWS\system32\msfeeds.dll
2006-10-27 15:09 180,736 ——— C:\WINDOWS\system32\ieui.dll
2006-10-27 02:44 13,312 –a—— C:\WINDOWS\system32\ieudinit.exe
2006-10-17 13:05 206,336 ——— C:\WINDOWS\system32\WinFXDocObj.exe
2006-10-17 12:58 61,952 ——— C:\WINDOWS\system32\icardie.dll
2006-10-17 12:58 12,288 ——— C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 12:57 266,752 ——— C:\WINDOWS\system32\iertutil.dll
2006-10-17 12:27 380,928 ——— C:\WINDOWS\system32\ieapfltr.dll
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-11-15 10:14 ——– d——– C:\Program Files\Star Alliance Timetable
2006-11-14 20:49 ——– d——– C:\Program Files\NetBattle
2006-11-12 19:54 ——– d——– C:\Program Files\Star Alliance Electronic Timetable
2006-11-07 21:17 ——– d——– C:\Program Files\Internet Explorer
2006-10-29 20:50 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-29 20:46 ——– d——– C:\Program Files\softnyx
2006-10-29 20:38 ——– d——– C:\Program Files\Common Files
2006-10-27 15:09 413696 –a—— C:\WINDOWS\system32\vbscript.dll
2006-10-27 15:09 231424 –a—— C:\WINDOWS\system32\webcheck.dll
2006-10-27 15:09 156160 –a—— C:\WINDOWS\system32\msls31.dll
2006-10-27 02:44 71680 –a—— C:\WINDOWS\system32\admparse.dll
2006-10-27 02:44 55296 –a—— C:\WINDOWS\system32\iesetup.dll
2006-10-27 02:44 54784 –a—— C:\WINDOWS\system32\ie4uinit.exe
2006-10-27 02:44 43008 –a—— C:\WINDOWS\system32\iernonce.dll
2006-10-27 02:44 382976 –a—— C:\WINDOWS\system32\iedkcs32.dll
2006-10-27 02:44 229376 –a—— C:\WINDOWS\system32\ieaksie.dll
2006-10-27 02:44 152064 –a—— C:\WINDOWS\system32\ieakeng.dll
2006-10-27 02:44 123904 –a—— C:\WINDOWS\system32\advpack.dll
2006-10-27 02:42 161792 –a—— C:\WINDOWS\system32\ieakui.dll
2006-10-17 13:06 78336 –a—— C:\WINDOWS\system32\ieencode.dll
2006-10-17 13:05 40960 –a—— C:\WINDOWS\system32\licmgr10.dll
2006-10-17 13:05 105984 –a—— C:\WINDOWS\system32\url.dll
2006-10-17 13:04 101376 –a—— C:\WINDOWS\system32\occache.dll
2006-10-17 13:03 17408 –a—— C:\WINDOWS\system32\corpol.dll
2006-10-17 12:57 36352 –a—— C:\WINDOWS\system32\imgutil.dll
2006-10-17 12:56 45568 –a—— C:\WINDOWS\system32\mshta.exe
2006-10-17 12:28 48128 –a—— C:\WINDOWS\system32\mshtmler.dll
2006-10-15 19:29 ——– d——– C:\Program Files\oneworldflights
2006-10-07 17:43 ——– d——– C:\Program Files\Windows Defender
2006-10-07 15:13 26624 –a—— C:\Documents and Settings\Home\Application Data\GDIPFONTCACHEV1.DAT
2006-10-07 14:43 ——– d——– C:\Program Files\Common Files\Macromedia
2006-10-07 14:38 ——– d——– C:\Program Files\Macromedia
2006-09-28 21:56 ——– d——– C:\Documents and Settings\Home\Application Data\Alien Skin
2006-09-28 21:46 ——– d——– C:\Documents and Settings\Home\Application Data\Macromedia
2006-09-21 16:24 ——– d——– C:\Program Files\PopCap Games
2006-09-13 13:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll
2006-09-06 17:43 22752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2006-08-25 23:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll
2006-08-21 20:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-08-21 17:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe
2006-08-16 19:58 100352 –a—— C:\WINDOWS\system32\6to4svc.dll
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"BBC News alerts"="C:\\Program Files\\BBC News alerts\\skinkers.exe"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
"ares"="\"C:\\Program Files\\Ares\\Ares.exe\" -h"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"CTSysVol"="C:\\Program Files\\Creative\\SBAudigy2ZS\\Surround Mixer\\CTSysVol.exe /r"
"CTDVDDET"="C:\\Program Files\\Creative\\SBAudigy2ZS\\DVDAudio\\CTDVDDet.EXE"
"CTHelper"="CTHELPER.EXE"
"SBDrvDet"="C:\\Program Files\\Creative\\SB Drive Det\\SBDrvDet.exe /r"
"UpdReg"="C:\\WINDOWS\\UpdReg.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"VirusScan Online"="C:\\Program Files\\McAfee.com\\VSO\\mcvsshld.exe"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"Picasa Media Detector"="C:\\Program Files\\Picasa2\\PicasaMediaDetector.exe"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"
"nuwawrh.dll"="C:\\WINDOWS\\system32\\rundll32.exe C:\\WINDOWS\\system32\\nuwawrh.dll,nmeawhf"
"StarUpdater"=""
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (TEST-HQHPJJ4EES-Home).job
C:\WINDOWS\tasks\MP Scheduled Scan.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{BDFA07FB-661E-4BFD-8116-4A5BC6BEB41C}.job
Completion time: 06-11-15 10:23:09.51
C:\ComboFix.txt … 06-11-15 10:23
C:\ComboFix2.txt … 06-11-06 14:49
