Bualc Posted October 30, 2007 ID:9304 Share Posted October 30, 2007 there is a pop up that will not leave me alonehere is my hijack this logcan you help me?Logfile of Trend Micro HijackThis v2.0.0 (BETA)Scan saved at 5:05:26 PM, on 10/30/2007Platform: Windows XP SP2 (WinNT 5.01.2600)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\arservice.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\RTHDCPL.EXEC:\Program Files\HP\HP Software Update\HPwuSchd2.exeC:\WINDOWS\ehome\ehtray.exeC:\Program Files\HP DigitalMedia Archive\DMAScheduler.exeC:\Program Files\DISC\DiscUpdMgr.exeC:\Program Files\DISC\DISCover.exeC:\WINDOWS\ARPWRMSG.EXEC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\BellSouth\Alert Manager\BellSouthAlertManager.exeC:\Program Files\Java\jre1.6.0_03\bin\jusched.exeC:\Program Files\Bellsouth\HelpCenter\bin\sprtcmd.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Zango\bin\10.0.370.0\OEAddOn.exeC:\Program Files\Zango\bin\10.0.370.0\ZangoSA.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\MYWEBS~1\bar\2.bin\m3SrchMn.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Messenger\msmsgs.exeC:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exeC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\DISC\DiscStreamHub.exeC:\Program Files\iPod\bin\iPodService.exeC:\HP\KBD\KBD.EXEC:\Program Files\MalwareAlarm\MalwareAlarm.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Updates from HP\9972322\Program\Updates from HP.exeC:\Program Files\LimeWire\LimeWire.exeC:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exec:\windows\system\hpsysdrv.exeC:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\RogueRemover FREE\RogueRemover.exeC:\WINDOWS\system32\svchost.exeC:\Documents and Settings\alex\Local Settings\Temporary Internet Files\Content.IE5\2I0Z4WD7\HiJackThis_v2[1].exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://*.trymedia.com (HKLM)O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f...p1.0.0.15-3.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1157837934984O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cabO16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cabO16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cabO17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.114O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.114O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dllO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dllO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Pacsptisvr.exeO23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\Sptisrv.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exeO24 - Desktop Component 0: (no name) - http://sjl-static8.sjl.youtube.com/vi/4dSKr0dc6VU/2.jpg--End of file - 14647 bytes Link to post Share on other sites More sharing options...
SirJon Posted October 31, 2007 ID:9323 Share Posted October 31, 2007 Hello Bualc Welcome to the Malwarebytes forum. Sorry you are having malware trouble.1. Please download FixWareout from here 2. Please download ComboFix from here.3. Please save both removal tools to your desktop. Please do not run either tool yet.4. Disconnect your PC from all Internet access.5. Please temporarily disable your Norton Internet Security realtime protection. Procedure instructions can be found here. and here.6. Go to Control Panel, Add or Remove Programs, and uninstall My Web Search, MalwareAlarm and all Zango programs. 7. After uninstalling the programs, reboot PC.8. Double-click on the FixWareout.exe icon. 9. After double-clicking on the icon you will be presented with the first setup screen.10. Simply press the Next button to continue the installation.11. You will now be presented with the next installation screen.12. Press the Install button to install FixWareout to the C:\FixWareout folder. 13. You will now be at the last screen of the FixWareout setup. Make sure that the checkbox labeled Run fixit is checked. 14. Then click on the Finish button to automatically start FixWareout.15. FixWareout will start and you will see a screen.16. Press any key on your keyboard to start the removal process.17. FixWareout will now display a prompt stating that you will need to reboot your computer to continue with the fix.18. Click on the OK button to start the reboot process.19. Your computer will now reboot. Please be aware that the reboot time of your computer may be longer than normal due to the running of this fix. Before your desktop appears, you will see a prompt.20. Press the OK button to continue with the removal process. This process can take a while, so please be patient.21. Finally you will see a prompt stating that FixWareout has finished.22. When the desktop appears a file called report.txt will automatically open in Notepad. This contains a list of some of the files that FixWareout found and removed on your computer.23. Open Hijackthis, check both boxes below and select Fix checked O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.114O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.42 85.255.112.11424. Close HijackThis, and click OK. 25. Go to the Control Panel. If you are using Windows XP's Category View, select the Network and Internet Connections category. If you are in Classic View, go to the step 22. 26. Double-click the Network Connections icon 27. Right-click the Local Area Connection icon and select Properties. 28. Highlight Internet Protocol (TCP/IP) and click the Properties button. 29. Be sure Obtain DNS server address automatically is selected. 30. Click OK. 31. Go to Start, Run and type in cmd 32. Click OK. This will open the command prompt. 33. Type or copy and paste the following line in the command window: ipconfig /flushdns 34. Hit Enter. 35. Close the command window. 36. Reboot your PC again. 37. Please post the contents of the logfile C:\fixwareout\report.txt along with a new HijackThis log.38. Do not run the ComboFix tool yet. Link to post Share on other sites More sharing options...
JeanInMontana Posted November 12, 2007 ID:9895 Share Posted November 12, 2007 Thank you SirJon for your assistance. Due to no reply I will close the topic to prevent others from posting into it.The fixes in this topic are for this system only. Do not apply to any other. For assistance please open a new topic and someone will be happy to help. Link to post Share on other sites More sharing options...
Recommended Posts