What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help-kinari

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hey I'm having problems with IExplore & Mozilla opening randomly to drivecleaner, as well as WinAntiSPyware. Looked at the self-help sticky so here is my log from AVG:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 8:36:24 PM 8/8/2007

+ Scan result:



C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Adware.Aws : Marked for delete on rebootUnkown Error
HKU\S-1-5-21-2800509490-3233852318-2805738209-500\Software\Microsoft\Windows\ShellNoRoam\BagMRU\2\17\\12\\NodeSlot -> Adware.BetterInternet : Marked for delete on rebootUnkown Error
HKLM\SOFTWARE\Classes\WR -> Adware.Generic : Marked for delete on rebootUnkown Error
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\runner1 -> Adware.Generic : Marked for delete on rebootUnkown Error
C:\Program Files\UpromiseRemindU\System\Code\bf.class -> Adware.MoeMoney : Marked for delete on rebootUnkown Error
C:\WINDOWS\IECodecPlg.dll -> Adware.Webdir : Marked for delete on rebootUnkown Error
C:\WINDOWS\TISKY009.exe -> Adware.ZenoSearch : Marked for delete on rebootUnkown Error
C:\WINDOWS\retadpu.exe -> Downloader.Agent.bls : Marked for delete on rebootUnkown Error
C:\WINDOWS\retadpu572.exe.tmp -> Downloader.Agent.bls : Marked for delete on rebootUnkown Error
C:\WINDOWS\b104.exe -> Downloader.Small.buy : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\hnemykmj.exe -> Downloader.Tiny.id : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\pqunqklm.exe -> Downloader.Tiny.id : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\qvsjfttc.exe -> Downloader.Tiny.id : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\snqpjuvr.exe -> Downloader.Tiny.id : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\viaomvae.exe -> Downloader.Tiny.id : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\wtwwgvdv.exe -> Downloader.Tiny.id : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\b02FdUe\b02FdUe1065.exe -> Downloader.VB.awj : Marked for delete on rebootUnkown Error
C:\WINDOWS\cualqhc.exe -> Dropper.Agent.mu : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\Z11\z53.exe -> Dropper.Agent.mu : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\ramsfeld1.dll -> Logger.Banker.cnx : Marked for delete on rebootUnkown Error
C:\WINDOWS\Downloaded Program Files\UWA7P_0001_N91M0809NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Marked for delete on rebootUnkown Error
:mozilla.26:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Advertising : Marked for delete on rebootUnkown Error
:mozilla.27:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Advertising : Marked for delete on rebootUnkown Error
:mozilla.28:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Advertising : Marked for delete on rebootUnkown Error
:mozilla.29:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Advertising : Marked for delete on rebootUnkown Error
:mozilla.33:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Atdmt : Marked for delete on rebootUnkown Error
:mozilla.25:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Doubleclick : Marked for delete on rebootUnkown Error
:mozilla.24:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Mediaplex : Marked for delete on rebootUnkown Error
:mozilla.11:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Yieldmanager : Marked for delete on rebootUnkown Error
:mozilla.12:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Yieldmanager : Marked for delete on rebootUnkown Error
:mozilla.13:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Yieldmanager : Marked for delete on rebootUnkown Error
:mozilla.14:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Yieldmanager : Marked for delete on rebootUnkown Error
:mozilla.15:C:\Documents and Settings\Mukesh\Application Data\Mozilla\Firefox\Profiles\qqxvdxcz.default\cookies.txt -> TrackingCookie.Yieldmanager : Marked for delete on rebootUnkown Error
C:\WINDOWS\system32\qwerty12.exe -> Trojan.Agent.aoy : Marked for delete on rebootUnkown Error


::Report end

HERE's Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 9:45:49 PM, on 8/8/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\atiptaxx.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CMPDPSRV.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\qwerty12.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.syosseths.com
O3 - Toolbar: Mirar - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - C:\WINDOWS\System32\WinNB58.dll
O4 - HKLM\..\Run: [ATIPTA] atiptaxx.exe
O4 - HKLM\..\Run: [CMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\CMPDPSRV.EXE
O4 - HKLM\..\Run: [cualqhcA] C:\WINDOWS\cualqhcA.exe
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\System32\yjjuefme.dll",forkonce
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O15 - Trusted Zone: *.drivecleaner.com
O15 - Trusted Zone: *.errorprotector.com
O15 - Trusted Zone: *.systemdoctor.com
O15 - Trusted Zone: *.winantispyware.com
O15 - Trusted Zone: *.winantivirus.com
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {0246ECA8-996F-11D1-BE2F-00A0C9037DFE} -
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} -
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://notes2.cc.sunysb.edu/iNotes6W.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1142446326093
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\qwerty12.exe
O23 - Service: RemoteShutDown Service (RemShutDownSvc) - Unknown owner - C:\WINDOWS\System32\remsdnsv.exe



Thank you so much…
Post #2
Hi and welcome to the forums. :) I'm Markka and I will be helping you with your malware issues. I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by teachers of Malware Removal University. Please be patient. :)
Post #3
Hello :)

Looking over your log, it seems you don't have any evidence of a third party firewall.

As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

1) ZoneAlarm
2) Agnitum
3) Sunbelt/Kerio
4) Comodo

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.
________________________

Rename HijackThis.exe to Scanner.exe by doing the following;
  • Navigate to here; "The Path of the HijackThis!"
  • Right-click on the HijackThis.exe
  • Choose from the pull-down menu; "Rename"
  • And now Rename HijackThis.exe to Scanner.exe
  • When you're renamed HijackThis, then open it..
  • Take a fresh HijackThis log (Do a system scan and save a log file)
  • Post the fresh HijackThis log to here.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI