Browser Hijacked Please Help With Log

Hi gfbfh,

I'm Gary R, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

• Perform all actions in the order given.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with it till you're given the all clear.
• Remember, absence of symptoms does not mean the infection is all gone.

If you can do these things, everything should go smoothly.

• Please note you'll need to have Administrator priviledges to perform the fixes. (XP accounts are Administrator by default)

You are currently running HijackThis from a temporary directory here: C:\Documents and Settings\Brent\Local Settings\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

Hijack this needs a permanent folder to store backups in. Please make a folder here: C:/HJT and place HijackThis.exe in that folder.

DO NOT follow the steps below until you have moved HijackThis.

Download FixWareout and save it to your Desktop.
Aternate Download Site

Note: Leave your internet connection running, the fixwareout may prompt you to download BFU from merijn.

• Double click Fixwareout.exe to run it.
• Click Next, then Install.
• Make sure Run fixit is checked and click Finish.
• The fix will begin; follow the prompts.
• You will be asked to reboot your computer; please do so.
• Your system may take longer than usual to load; this is normal.
• At the end of the fix, you may need to restart your computer again.

Now run a scan with HJT, and check the following entries (if found).

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)

O17 - HKLM\System\CCS\Services\Tcpip\..\{B57F3576-AF25-4523-BB59-E4900A94D92D}: NameServer = 85.255.115.83,85.255.112.206
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.83 85.255.112.206
O17 - HKLM\System\CS1\Services\Tcpip\..\{B57F3576-AF25-4523-BB59-E4900A94D92D}: NameServer = 85.255.115.83,85.255.112.206
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.83 85.255.112.206


Click Fix Checked to remove them.

Now lets check some settings on your system.

• Click Start > Connect to > Show all connections.
• Right click on your default connection, usually local area connection for cable and dsl.
• Left click on Properties.
• Click the Networking tab.
• Double-click on the Internet Protocol (TCP/IP) item and select the radio dial that says Obtain DNS servers automatically.
• Press OK twice to get out of the properties screen and reboot if it asks. (That option might not be avaiable on some systems).

Next!

• Click Start > Run type cmd and hit OK.
• Type ipconfig /flushdns then hit enter, (Note: there is a space between ipconfig and /flushdns).
• Type exit hit enter.

Now can you send me the following logs please:

• New HijackThis log
• Contents of the logfile C:\fixwareout\report.txt

Hi gfbfh,

Your HJT log looks to be clear now.

OK, sounds like your ISP doesn't quite set up your connection in a "standard" manner (which is not particularly unusual). If you're no longer being re-directed then it isn't necessary for us to reset your DNS settings.

If you are still being re-directed let me know and we'll try to find out how to reset DNS on your machine.

I'd like you to run an online scan, there are areas of your system that HJT does not scan and I'd like to ensure there's nothing else untoward hiding on your computer.

Please do an online scan with Kaspersky Online Scanner

Note: You must be using Internet Explorer as your browser as it will be necessary to install an Active X component to your computer.

Important If you have previously used Kaspersky Online Scanner (before 8th Aug 2006), you will have to uninstall the old version using Add/Remove Programs in Control Panel before you can use the new version.

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then start to download the latest definition files.
• Once the scanner is installed and the definitions downloaded, click Next.
• Now click on Scan Settings.
• In the scan settings make sure that the following are selected:
  • Scan using the following Anti-Virus database:
    • Extended (If available otherwise Standard)
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK.
• Now under select a target to scan select My Computer.
• The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post please.

Note: The Kaspersky online scanner is not yet fully compatible with IE7. You may get returned to a window without the Accept/Decline buttons after allowing the ActiveX control. The buttons are there - you just can't see them! Click on the zoom button (bottom, right of the window) and change it from 100% to 75%. You should now see the buttons. Reset to 100% once the license has been accepted.

Great job dude. I was still being redirected after running the HJT and the fixwareout programs but after using the kaspersky bot I am no longer being redirected. It caught a trojan embedded in an old email back when we were using Outlook. Do you guys get paid anything for doing this? Thanks a lot for the help. Is there anything left to do?

Kaspersky just scans, it shouldn't have cleaned or fixed anything. Can you post the log here so I can have a look at it please.

I'm an idiot..I used Kaspersky internet security…doing the online scanner now…Ill post it in a bit

No worries, KIS uses essentially the same scanner as the Online Scan, but also will clean what it finds. I was just concerned that there appeared to be no reason for your problem disappearing, the fact that you used KIS explains all. If you get an online scan please post it just so I can look it over and ensure there's nothing else lurking that needs taking care of.

Ok, after I ran the kaspersky internet security the redirection of my browser stopped for a short time and now it is back to the same old thing. Here is the Kaspersky Online scanner report. ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Sunday, April 22, 2007 8:34:29 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 22/04/2007 Kaspersky Anti-Virus database records: 300486 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ Scan Statistics: Total number of scanned objects: 69854 Number of viruses found: 1 Number of infected objects: 24 / 0 Number of suspicious objects: 0 Duration of the scan process: 01:11:41 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip/bin/hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Administrator\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi Embedded: infected - 3 skipped C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd002.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_50e417e0-e461-474b-96e2-077b80325612 Object is locked skipped C:\Documents and Settings\Brent\Application Data\$_hpcst$.hpc Object is locked skipped C:\Documents and Settings\Brent\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt.log Object is locked skipped C:\Documents and Settings\Brent\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\DSAgnt_GTActions.log Object is locked skipped C:\Documents and Settings\Brent\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\gdql_d_DSAgnt.log Object is locked skipped C:\Documents and Settings\Brent\Application Data\Gtek\GTUpdate\AUpdate\DellSupport\glog.log Object is locked skipped C:\Documents and Settings\Brent\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip/bin/hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Brent\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Brent\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Brent\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi Embedded: infected - 3 skipped C:\Documents and Settings\Brent\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Brent\Local Settings\History\History.IE5\MSHist012007042220070423\index.dat Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Temp\WCESLog.log Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Temp\~DF9792.tmp Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Brent\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Brent\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Brent\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Brent\UserData\index.dat Object is locked skipped C:\Documents and Settings\Default User\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip/bin/hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Default User\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Default User\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Documents and Settings\Default User\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi Embedded: infected - 3 skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Data\settings.dat Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS02AA8727-E7BC-4898-8B16-EEA0DF36C14F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS039DAECE-1483-4000-9B58-C1835E4A01DC.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0405F9E8-014B-4D6F-8918-C77EB50D5821.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS08ED403F-A980-4722-AD43-24E7F66F1490.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0EAA1F32-43D0-4C57-84F3-3BD3064FC0B3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS0F70F788-8428-4B72-A3A3-D135B6523175.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS10F3B108-ED5D-4E2C-9AA9-44214F69BD58.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2A75E732-2137-4AEF-91D9-89FB9F5F8322.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2B5881E7-8EC2-4D9E-B67D-EF556AEACBD8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2C4A0263-AD85-4019-A92F-356476305919.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2D83FE54-DB85-4112-8A4E-AD50336A222F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS2E246F41-BD66-4C2C-93AA-F45AB249EC23.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS32A2A696-C97A-4C6C-91A5-6ADCC7E85D8F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS38878753-9A7D-4883-B05F-87AD98DCF884.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS391BF061-2784-43BC-9B9A-23A64A86F284.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3AD88E1E-10A1-437E-B2AB-28E7BF600967.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS3B5C2DD4-C4EE-4909-993E-E344607B5A84.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS45179DD2-3E09-4323-B8D3-99B4E2E9A4A2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4CEE5B89-018A-4167-B3CF-D1C33313471C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS4E053258-24AA-4C9D-8D20-72FAB3B1118F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5AA7CC79-2F95-4E36-B2FF-B30414AD083B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS5F86D22D-ABFA-44BB-92A1-DD48CE573468.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS62330FC9-5F90-4C39-91F5-3E0CD48A4BEB.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS649FD84E-CCCC-42EC-A76B-C6BDDAF1F260.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6DAF4B7F-D37C-4FDD-B555-35F415C7DF6E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS6F774CE5-55B8-43CC-AF46-302F358F83B8.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS733FBEEB-A989-4DBC-B1B0-3A74579E5CD0.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS7DA4DA7C-EB96-4039-9D6D-066657321596.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS825FFE38-33D3-45F1-A316-BF4F18328DC5.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS82D01EA2-D95A-4E17-9269-E781D3D5A14C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS83B5B231-3D71-45DE-BA9F-71B96B55E4DD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8503A358-856F-4150-B629-92DB1A43127E.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS88BAEC33-8B8C-4859-BEF1-DDE4F86CB0CC.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS899E731C-CF18-410D-8B7D-C9BE472DEE8C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS89C9AA37-11CD-4A0A-8B8A-4719B3EE1EBA.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS8C373935-8743-4124-B422-F89666CE2BF1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS910AFB75-4750-4FDD-B240-39C77B95EFAF.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS91585093-4725-458A-8278-F7E40F4F7F9C.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS923214FF-18BE-4164-800B-87175B36036F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS99BB8F4F-8EC1-435D-9ED3-146102956E04.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9C77644F-E66E-4493-B62F-054B4F627820.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCS9F45C74D-6B08-4EFC-8F44-BAAE933845BD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA1921B28-A363-4B3D-BDE5-1635A1F03A98.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA2EB9AD9-BEC8-41F9-900E-2D85C50E26C0.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA35776D9-E3FB-41C2-9BD7-61A6BA53E53D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA495824B-13A2-4932-A5DC-B198B9FD7088.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSA9B0477A-E261-46A8-8309-95B0AF01C535.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSAE57EAA0-DF39-41C4-9804-D46239902F4D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB2CDC5FA-75F8-491F-A4BE-97450011B38B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB33911E7-1E43-4262-92D6-BBBF69984273.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSB5A08248-198F-43E4-862D-93623E5F0725.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC14448DF-CE05-4D4C-A63C-0F5D6BC7D48F.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC1ECA6FA-C76F-4D7B-BC72-618853A3800A.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSC6A2437D-E549-40F8-9DF5-06387D349CF2.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSCC694A80-5A7B-4C3A-8AB3-D56D1C7EE733.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSD4F7B923-2DE0-4109-A97D-7FC56C88A870.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDCB55CBF-65F7-479C-B144-5C6B6F2CAD6B.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDD4CEC32-0A90-489C-A939-B032A4B60ABD.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSDDF3C03C-96FD-4B11-8276-FA9D6AA294A1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE2350E45-BC07-4DC3-9035-4EFB6CA23F17.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSE9DD57EE-095B-45FF-948C-8FCDC1ECE1C6.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSEB8EE99F-F003-4DA9-88CB-3A9110965B07.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF2AB7F3D-7FCB-45F3-8FE4-0179939CDDE7.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF5825EEC-401D-43AE-95F7-518B5C6CC38D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF5BC256D-23A8-481D-9C62-607B6A4E890D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSF8947C11-92E7-4475-9E26-947851D7EBE1.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFCFA850E-4929-403E-B544-98B65974B7A3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFDC102C5-84B2-4705-AE7B-DADA91C7B9B3.tmp Object is locked skipped C:\Documents and Settings\LocalService\Application Data\Webroot\Spy Sweeper\Temp\SSCSFE5CD004-BA95-429E-9708-CDA8896EFB8D.tmp Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\I386\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip/bin/hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\I386\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\I386\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\I386\Java 2 Runtime Environment, SE v1.4.2_03.msi Embedded: infected - 3 skipped C:\Program Files\Common Files\Java\Update\Base Images\j2re1.4.2-b28\core1.zip/bin/hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Program Files\Common Files\Java\Update\Base Images\j2re1.4.2-b28\core1.zip ZIP: infected - 1 skipped C:\Program Files\Java\j2re1.4.2_03\bin\hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Program Files\Java\j2re1.4.2_06\bin\hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.bak Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\Masters.const Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters\masters.mst Object is locked skipped C:\Program Files\Webroot\Spy Sweeper\Masters.base Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP858\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip/bin/hpi.dll Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab/core1.zip Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi/Data1.cab Infected: Trojan-Downloader.Win32.Agent.bng skipped C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Application Data\{7148F0A6-6813-11D6-A77B-00B0D0142030}\Java 2 Runtime Environment, SE v1.4.2_03.msi Embedded: infected - 3 skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.idx Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat Object is locked skipped C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.idx Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_528.dat Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Can you send me a new HJT log please.

OK,

Run a scan with HJT and check the following items.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com


Close all open windows and click Fix Checked to remove them.

• Click Start > Run type cmd and hit OK.
• Type ipconfig /flushdns then hit enter, (Note: there is a space between ipconfig and /flushdns).
• Type exit hit enter.

Now can you post a new HJT log, and let me know if you're still being re-directed please.

I need a little information.

• Click Start > Run type Notepad click OK.
• This will open an empty Notepad file.
• Copy/Paste the contents of the box below into Notepad.

@ echo off

ipconfig /all >> "%userprofile%"\Desktop\DNS.txt

Notepad.exe %userprofile%\Desktop\DNS.txt

• Click Format and ensure Wordwrap is unchecked.
• Save as GetDNS.bat
• Save as file type All Files or it won't work.
• Now double click on GetDNS.bat to run it.
• A file DNS.txt will open on your Desktop, please post the contents in your next reply.

You can delete GetDNS.bat and DNS.txt from your Desktop once you've posted.

DNS.txt Windows IP Configuration Host Name . . . . . . . . . . . . : DC7D5P61 Primary Dns Suffix . . . . . . . : Node Type . . . . . . . . . . . . : Hybrid IP Routing Enabled. . . . . . . . : No WINS Proxy Enabled. . . . . . . . : No Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : Intel® PRO/100 VE Network Connection Physical Address. . . . . . . . . : 00-11-11-B4-88-6C Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : [removed] Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : [removed] DHCP Server . . . . . . . . . . . : 172.24.120.60 DNS Servers . . . . . . . . . . . : [removed] 208.180.42.100 Lease Obtained. . . . . . . . . . : Monday, April 23, 2007 9:50:36 PM Lease Expires . . . . . . . . . . : Tuesday, April 24, 2007 9:43:00 PM