problem removing Hijack WindowsUpdates please help?!

[henrik]

Hi,

MalwareBytes has found two alerts called Hijack WindowsUpdates. I let malwarebytes remove them but after another search malwarebytes finds them again. So how do I remove them?

the malwarebytes log is in swedish but i hope you will be able to understand it anyway?

thanks!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:27:44, on 2009-10-09

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\acs.exe

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\Program\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\Program\Toshiba\Windows Utilities\Hotkey.exe

C:\WINDOWS\system32\TPSMain.exe

C:\Program\TOSHIBA\Toshibas zoomningsfunktion\SmoothView.exe

C:\Program\TOSHIBA\Touch and Launch\PadExe.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program\HighCriteria\TotalRecorder\TotRecSched.exe

C:\Program\Bredbandsbolaget\Servicecenter\Bredbandsbolaget.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\Program\AVG\AVG8\avgtray.exe

C:\Program\Synaptics\SynTP\Toshiba.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program\Spybot - Search & Destroy\TeaTimer.exe

C:\Program\Malwarebytes' Anti-Malware\mbam.exe

C:\Program\Java\jre6\bin\jucheck.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L

[henrik]

Hi,

MalwareBytes has found two alerts called Hijack WindowsUpdates. I let malwarebytes remove them but after another search malwarebytes finds them again. So how do I remove them?

the malwarebytes log is in swedish but i hope you will be able to understand it anyway?

thanks!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:27:44, on 2009-10-09

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16876)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\acs.exe

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\Program\TOSHIBA\ConfigFree\CFSvcs.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\Program\Toshiba\Windows Utilities\Hotkey.exe

C:\WINDOWS\system32\TPSMain.exe

C:\Program\TOSHIBA\Toshibas zoomningsfunktion\SmoothView.exe

C:\Program\TOSHIBA\Touch and Launch\PadExe.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program\HighCriteria\TotalRecorder\TotRecSched.exe

C:\Program\Bredbandsbolaget\Servicecenter\Bredbandsbolaget.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\Program\AVG\AVG8\avgtray.exe

C:\Program\Synaptics\SynTP\Toshiba.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Program\Spybot - Search & Destroy\TeaTimer.exe

C:\Program\Malwarebytes' Anti-Malware\mbam.exe

C:\Program\Java\jre6\bin\jucheck.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gmail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L

[henrik]

It's been fixed!

I ran WUS_Fix.exe which took care of it.