jmhall
Topic Starter
Today my browsers (ie7 and Mozilla) load Google in Spanish. I type in google.com and I'm redirected to google.es. Here is my hijackthis log. Thanks in advance to anyone who can help.
Logfile of HijackThis v1.99.1
Scan saved at 3:39:52 AM, on
6/12/2007
Platform: Windows XP SP2 (WinNT
5.01.2600)
MSIE: Internet Explorer v7.00
(7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common
Files\Symantec
Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop
Elements 5.0
\PhotoshopElementsFileAgent.exe
C:\Program Files\Amazon\Amazon
Unbox
Video\ADVWindowsClientService.exe
C:\Program
Files\Symantec\LiveUpdate\ALUSchedu
lerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G
PCI Adapter\WLService.exe
C:\Program Files\Linksys Wireless-G
PCI Adapter\WMP54Gv4.exe
C:\Program Files\ATI
Technologies\ATI Control
Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgcc.exe
C:\Program Files\Java\jre1.6.0_01
\bin\jusched.exe
C:\Program
Files\Logitech\MouseWare\system\em_
exec.exe
C:\Program
Files\QuickTime\qttask.exe
C:\Program
Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop
Elements 5.0\apdproxy.exe
C:\Program Files\Common
Files\Symantec Shared\ccApp.exe
C:\Program
Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media
Player\WMPNSCFG.exe
C:\Program Files\Amazon\Amazon
Unbox
Video\ADVWindowsClientSystemTray.ex
e
C:\Program
Files\InterVideo\Common\Bin\WinCine
maMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program
Files\iPod\bin\iPodService.exe
C:\Program
Files\hijackthis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link
Helper - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 7.0
\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-
6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-
D4DAF1D92D43} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA]
C:\Program Files\ATI
Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Logitech
Utility] Logi_MwX.Exe
O4 - HKLM\..\Run:
[SunJavaUpdateSched] "C:\Program
Files\Java\jre1.6.0_01
\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Program
Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [iTunesHelper]
"C:\Program
Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo
Downloader] "C:\Program
Files\Adobe\Photoshop Elements 5.0
\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp]
"C:\Program Files\Common
Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck]
"C:\Program Files\Norton
AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [MSMSGS]
"C:\Program
Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG]
C:\Program Files\Windows Media
Player\WMPNSCFG.exe
O4 - Global Startup: Adobe Reader
Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0
\Reader\reader_sl.exe
O4 - Global Startup: Amazon
Unbox.lnk = ?
O4 - Global Startup: InterVideo
WinCinema Manager.lnk = C:\Program
Files\InterVideo\Common\Bin\WinCine
maMgr.exe
O4 - Global Startup: Microsoft
Office.lnk = C:\Program
Files\Microsoft
Office\Office\OSA9.EXE
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun
Java Console - {08B0E5C0-4FCB-11CF
-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research -
{92780B25-18CC-41C8-B9BE-
3C9C571A8263} - C:\PROGRA~1
\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-
f2ba38496583} - %windir%\Network
Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra 'Tools' menuitem:
@xpsp3res.dll,-20001 - {e2e2dd38-
d088-4134-82b7-f2ba38496583} - %
windir%\Network
Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem:
Windows Messenger - {FB5F1910-F110
-11d2-BB9E-00C04F795683} -
C:\Program
Files\Messenger\msmsgs.exe
O11 - Options group:
[INTERNATIONAL] International*
O16 - DPF: {200B3EE9-7242-4EFD-
B1E4-D97EE825BA53} (VerifyGMN
Class) -
http://h20270.www2.hp.com/ediags/gm
n/install/hpobjinstaller_gmn.cab
O20 - Winlogon Notify: WgaLogon -
C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj -
{AAA288BA-9A4C-45B0-95D7-
94D524869DB5} -
C:\WINDOWS\system32
\WPDShServiceObj.dll
O23 - Service: Adobe Active File
Monitor V5
(AdobeActiveFileMonitor5.0) -
Unknown owner - C:\Program
Files\Adobe\Photoshop Elements 5.0
\PhotoshopElementsFileAgent.exe
O23 - Service: Amazon Unbox Video
Service (ADVService) - Amazon.com -
C:\Program Files\Amazon\Amazon
Unbox
Video\ADVWindowsClientService.exe
O23 - Service: Ati HotKey Poller -
Unknown owner -
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown
owner - C:\WINDOWS\system32
\ati2sgag.exe
O23 - Service: Automatic LiveUpdate
Scheduler - Symantec Corporation -
C:\Program
Files\Symantec\LiveUpdate\ALUSchedu
lerSvc.exe
O23 - Service: AVG7 Alert Manager
Server (Avg7Alrt) - GRISOFT, s.r.o.
- C:\PROGRA~1\Grisoft\AVGFRE~1
\avgamsvr.exe
O23 - Service: AVG7 Update Service
(Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgupsvc.exe
O23 - Service: Symantec Event
Manager (ccEvtMgr) - Unknown owner
- C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe"
/h ccCommon (file missing)
O23 - Service: Symantec Settings
Manager (ccSetMgr) - Unknown owner
- C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe"
/h ccCommon (file missing)
O23 - Service: Symantec Lic
NetConnect service
(CLTNetCnService) - Unknown owner -
C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe"
/h ccCommon (file missing)
O23 - Service: InstallDriver Table
Manager (IDriverT) - Macrovision
Corporation - C:\Program
Files\Common
Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iPod Service - Apple
Computer, Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password
Validation (ISPwdSvc) - Symantec
Corporation - C:\Program
Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate -
Symantec Corporation - C:\PROGRA~1
\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Remote Packet
Capture Protocol v.0 (experimental)
(rpcapd) - Unknown owner - %
ProgramFiles%\WinPcap\rpcapd.exe"
-d -f "%ProgramFiles%
\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec Core LC -
Symantec Corporation - C:\Program
Files\Common Files\Symantec
Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore
Service (SymAppCore) - Symantec
Corporation - C:\Program
Files\Common Files\Symantec
Shared\AppCore\AppSvc32.exe
O23 - Service: WMP54Gv4SVC -
Unknown owner - C:\Program
Files\Linksys Wireless-G PCI
Adapter\WLService.exe"
"WMP54Gv4.exe (file missing)
Logfile of HijackThis v1.99.1
Scan saved at 3:39:52 AM, on
6/12/2007
Platform: Windows XP SP2 (WinNT
5.01.2600)
MSIE: Internet Explorer v7.00
(7.00.6000.16441)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common
Files\Symantec
Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop
Elements 5.0
\PhotoshopElementsFileAgent.exe
C:\Program Files\Amazon\Amazon
Unbox
Video\ADVWindowsClientService.exe
C:\Program
Files\Symantec\LiveUpdate\ALUSchedu
lerSvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G
PCI Adapter\WLService.exe
C:\Program Files\Linksys Wireless-G
PCI Adapter\WMP54Gv4.exe
C:\Program Files\ATI
Technologies\ATI Control
Panel\atiptaxx.exe
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgcc.exe
C:\Program Files\Java\jre1.6.0_01
\bin\jusched.exe
C:\Program
Files\Logitech\MouseWare\system\em_
exec.exe
C:\Program
Files\QuickTime\qttask.exe
C:\Program
Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Photoshop
Elements 5.0\apdproxy.exe
C:\Program Files\Common
Files\Symantec Shared\ccApp.exe
C:\Program
Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media
Player\WMPNSCFG.exe
C:\Program Files\Amazon\Amazon
Unbox
Video\ADVWindowsClientSystemTray.ex
e
C:\Program
Files\InterVideo\Common\Bin\WinCine
maMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program
Files\iPod\bin\iPodService.exe
C:\Program
Files\hijackthis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link
Helper - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program
Files\Adobe\Acrobat 7.0
\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-
6F74-2D53-2644-206D7942484F} -
C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-
D4DAF1D92D43} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA]
C:\Program Files\ATI
Technologies\ATI Control
Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AVG7_CC]
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Logitech
Utility] Logi_MwX.Exe
O4 - HKLM\..\Run:
[SunJavaUpdateSched] "C:\Program
Files\Java\jre1.6.0_01
\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task]
"C:\Program
Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [iTunesHelper]
"C:\Program
Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Photo
Downloader] "C:\Program
Files\Adobe\Photoshop Elements 5.0
\apdproxy.exe"
O4 - HKLM\..\Run: [ccApp]
"C:\Program Files\Common
Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck]
"C:\Program Files\Norton
AntiVirus\osCheck.exe"
O4 - HKCU\..\Run: [MSMSGS]
"C:\Program
Files\Messenger\msmsgs.exe"
/background
O4 - HKCU\..\Run: [ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG]
C:\Program Files\Windows Media
Player\WMPNSCFG.exe
O4 - Global Startup: Adobe Reader
Speed Launch.lnk = C:\Program
Files\Adobe\Acrobat 7.0
\Reader\reader_sl.exe
O4 - Global Startup: Amazon
Unbox.lnk = ?
O4 - Global Startup: InterVideo
WinCinema Manager.lnk = C:\Program
Files\InterVideo\Common\Bin\WinCine
maMgr.exe
O4 - Global Startup: Microsoft
Office.lnk = C:\Program
Files\Microsoft
Office\Office\OSA9.EXE
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun
Java Console - {08B0E5C0-4FCB-11CF
-AAA5-00401C608501} - C:\Program
Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research -
{92780B25-18CC-41C8-B9BE-
3C9C571A8263} - C:\PROGRA~1
\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) -
{e2e2dd38-d088-4134-82b7-
f2ba38496583} - %windir%\Network
Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra 'Tools' menuitem:
@xpsp3res.dll,-20001 - {e2e2dd38-
d088-4134-82b7-f2ba38496583} - %
windir%\Network
Diagnostic\xpnetdiag.exe (file
missing)
O9 - Extra button: Messenger -
{FB5F1910-F110-11d2-BB9E-
00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem:
Windows Messenger - {FB5F1910-F110
-11d2-BB9E-00C04F795683} -
C:\Program
Files\Messenger\msmsgs.exe
O11 - Options group:
[INTERNATIONAL] International*
O16 - DPF: {200B3EE9-7242-4EFD-
B1E4-D97EE825BA53} (VerifyGMN
Class) -
http://h20270.www2.hp.com/ediags/gm
n/install/hpobjinstaller_gmn.cab
O20 - Winlogon Notify: WgaLogon -
C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj -
{AAA288BA-9A4C-45B0-95D7-
94D524869DB5} -
C:\WINDOWS\system32
\WPDShServiceObj.dll
O23 - Service: Adobe Active File
Monitor V5
(AdobeActiveFileMonitor5.0) -
Unknown owner - C:\Program
Files\Adobe\Photoshop Elements 5.0
\PhotoshopElementsFileAgent.exe
O23 - Service: Amazon Unbox Video
Service (ADVService) - Amazon.com -
C:\Program Files\Amazon\Amazon
Unbox
Video\ADVWindowsClientService.exe
O23 - Service: Ati HotKey Poller -
Unknown owner -
C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown
owner - C:\WINDOWS\system32
\ati2sgag.exe
O23 - Service: Automatic LiveUpdate
Scheduler - Symantec Corporation -
C:\Program
Files\Symantec\LiveUpdate\ALUSchedu
lerSvc.exe
O23 - Service: AVG7 Alert Manager
Server (Avg7Alrt) - GRISOFT, s.r.o.
- C:\PROGRA~1\Grisoft\AVGFRE~1
\avgamsvr.exe
O23 - Service: AVG7 Update Service
(Avg7UpdSvc) - GRISOFT, s.r.o. -
C:\PROGRA~1\Grisoft\AVGFRE~1
\avgupsvc.exe
O23 - Service: Symantec Event
Manager (ccEvtMgr) - Unknown owner
- C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe"
/h ccCommon (file missing)
O23 - Service: Symantec Settings
Manager (ccSetMgr) - Unknown owner
- C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe"
/h ccCommon (file missing)
O23 - Service: Symantec Lic
NetConnect service
(CLTNetCnService) - Unknown owner -
C:\Program Files\Common
Files\Symantec Shared\ccSvcHst.exe"
/h ccCommon (file missing)
O23 - Service: InstallDriver Table
Manager (IDriverT) - Macrovision
Corporation - C:\Program
Files\Common
Files\InstallShield\Driver\11\Intel
32\IDriverT.exe
O23 - Service: iPod Service - Apple
Computer, Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password
Validation (ISPwdSvc) - Symantec
Corporation - C:\Program
Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: LiveUpdate -
Symantec Corporation - C:\PROGRA~1
\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Remote Packet
Capture Protocol v.0 (experimental)
(rpcapd) - Unknown owner - %
ProgramFiles%\WinPcap\rpcapd.exe"
-d -f "%ProgramFiles%
\WinPcap\rpcapd.ini (file missing)
O23 - Service: Symantec Core LC -
Symantec Corporation - C:\Program
Files\Common Files\Symantec
Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore
Service (SymAppCore) - Symantec
Corporation - C:\Program
Files\Common Files\Symantec
Shared\AppCore\AppSvc32.exe
O23 - Service: WMP54Gv4SVC -
Unknown owner - C:\Program
Files\Linksys Wireless-G PCI
Adapter\WLService.exe"
"WMP54Gv4.exe (file missing)