something is wrong

fox · October 22, 2008

I am sorry if i need to be given an ok to post here but it is 2am, nobody seem to be around. there is some thing wrong even with the hijackthis. It gives me some weird message saying some thing. I write what it says in a while. I know that malware scan shows nothing but there is some thing wrong. I know that I need to update it. I will give you that log in a while. Here is my logs. please help me.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:08:09 PM, on 10/19/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16757)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\HP Connections\6811507\Program\HP Connections.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Windows\ehome\ehmsas.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE

C:\Windows\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)

O1 - Hosts: ::1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: XBTP01621 - {F6104497-54FD-4688-9162-5115CC8AB0FB} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing)

O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSRMon.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe

O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe

O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O13 - Gopher Prefix:

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--

End of file - 10515 bytes

Malwarebytes' Anti-Malware 1.29

Database version: 1298

Windows 6.0.6000

10/22/2008 1:22:12 AM

mbam-log-2008-10-22 (01-22-12).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 197793

Time elapsed: 48 minute(s), 42 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

fox · October 22, 2008

the message said:

for some reason your system denied write access to host file. if any high jacked domains are in this files are in this file highjackthis may NOT be able to fix this. if this happens, you need to edit files yourself... for vista users right click hjt and run as administrator.

so what should I do. I have not run my anti virus yet.

fox · October 22, 2008

Is any body going to help me? .......

I ran avast and there was no infected files. I want to know why did hjt gave me that message and if I should worry about that there might be a real problem with my computer.

JeanInMontana · October 22, 2008

Hello fox and welcome to Malwarebytes. Please be patient and follow all instructions.

Make sure your running as an administrator on the machine. Allow email from Malwarebytes.org and set your preferences in the User Control Panel to email notifications for replies to your topics. This ensures you make prompt replies back and we get you cleaned in the fastest way possible.

Please set your system to show

all files; Click Start.

Open My Computer.

Select the Tools menu and click Folder Options.

Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.

Uncheck the Hide protected operating system files (recommended) option.

Click Yes to confirm.

Click OK.

If you haven't already, please get these programs, update and run a complete scan removing all items found.

Spybot Search & Destroy Be sure to use the immunize feature. But do not enable TeaTimer at this time.

Open SB S&D

Make sure you are in Advanced Mode. Click on the Mode link at the top of the program and then Advanced Mode.

Click on the Tools section and then Resident.

You will see two items.

1. Resident "SD helper" (Internet Explorer bad download blocker.) active

2. Resident "Tea Timer" (Protection of over-all system settings.) active.

Uncheck number 2..

Leave number 1 checked always.

You can enable Tea Timer again if you wish once all special fixes have been done.

Please run a quick scan of your main drive, usually C with MBAM making sure you check all items found for removal. Please post that log in your next reply.

Then go here and run a scan PandaActive Scan There is a full tutorial on how to to this at the top of this forum.

Post the logs from the Panda and MBAM scans please, along with a log from this program HiJack This!

You will post three logs. 1. MBAM scan. 2. Panda Active Scan. 3. HiJack This scan. Please run and post the scans in this order. You will finish the MBAM first so go ahead and post that log, then move on to Panda and so forth.

I will analyze the logs and give you further instructions. Be sure to set your email to allow mail from Malwarebytes.org and your personal settings to send an email on reply to your topic. This will let you know when there has been an update to your topic and you can come and see what has been said.

Be patient and persistent. These things can take time and many procedures.

fox · October 22, 2008

for the panda scan do I have to register? I read the sticky for panda scan and I am stumped. I get it, but when I get to the site I just get stumped.

fox · October 23, 2008

Im going to have some trouble getting the hjt log. like I stated early I'm going to get that error message. I have not tried it since 2am. I did put up a scan I did in safe mode.

fox · October 23, 2008

I'm not sure if I can get you the hjt scan. Here are some of the scans:

panda scan

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-10-22 21:23:24

PROTECTIONS: 1

MALWARE: 36

SUSPECTS: 2

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Windows Defender 1.1.4005.0 No No

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@trafficmp[1].txt

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.trafficmp.com/]

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@trafficmp[2].txt

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.trafficmp.com/]

00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@casalemedia[2].txt

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@doubleclick[1].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@atdmt[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.atdmt.com/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@atdmt[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.atdmt.com/]

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.247realmedia.com/]

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@fastclick[1].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.tribalfusion.com/]

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@tribalfusion[2].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@tribalfusion[2].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@mediaplex[2].txt

00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@revenue[2].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.com.com/]

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@com[1].txt

00167672 Cookie/DomainSponsor TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@landing.domainsponsor[2].txt

00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@xiti[2].txt

00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@toplist[1].txt

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@perf.overture[1].txt

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@perf.overture[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[ad.yieldmanager.com/]

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@ad.yieldmanager[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[ad.yieldmanager.com/]

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@apmebf[2].txt

00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@burstnet[2].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@serving-sys[2].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@serving-sys[2].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.serving-sys.com/]

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.bs.serving-sys.com/]

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@bs.serving-sys[2].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@bs.serving-sys[1].txt

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[www.burstbeacon.com/]

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[server.iad.liveperson.net/]

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.advertising.com/]

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@advertising[2].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.advertising.com/]

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@advertising[2].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.advertising.com/]

00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@statse.webtrendslive[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.ads.pointroll.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@ads.pointroll[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@ads.pointroll[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.ads.pointroll.com/]

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.overture.com/]

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@overture[2].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.realmedia.com/]

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@realmedia[2].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.realmedia.com/]

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\carlos@questionmarket[2].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.questionmarket.com/]

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@questionmarket[1].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.questionmarket.com/]

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@zedo[2].txt

00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@bluestreak[1].txt

00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@adrevolver[2].txt

00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[searchportal.information.com/]

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@target[2].txt

00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.did-it.com/]

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Mozilla\Firefox\Profiles\4vht8cms.default\cookies.txt[.atwola.com/]

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@atwola[1].txt

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Users\CARLOS\AppData\Roaming\Microsoft\Windows\Cookies\Low\carlos@citi.bridgetrack[1].txt

02004913 Application/MyWebSearch HackTools No 0 Yes No C:\Users\CARLOS\Desktop\WebfettiSetup2.3.50.10.exe

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location D4

;===============================================================================

================================================================================

=

===================

No C:\HP\BIN\KillIt.exe D4

No C:\Program Files\Online Services\Vonage\smb\Xtras\regxtra121.x32 D4

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description D4

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

Malwarebytes' Anti-Malware 1.29

Database version: 1305

Windows 6.0.6000

10/22/2008 9:32:40 PM

mbam-log-2008-10-22 (21-32-40).txt

Scan type: Quick Scan

Objects scanned: 45095

Time elapsed: 3 minute(s), 48 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

fox · October 24, 2008

I did every thing that you said, but I can't get hjt log. I got the message again from the hjt. Jean please tell me what to do next.

this is the full message that I am getting:

for some reason your system denied write access to host file. if any high jacked domains are in this files are in this file highjackthis may NOT be able to fix this. if this happens, you need to edit files yourself

to this click start,run and type: notepad C:\windows\system32\drivers\etc\hosts

and press enter. find the lines(s) hijack this reports and delete them. save the file as 'host.' (with quotes), and reboot.

for vista: simply exit hjt, right click on the icon choose to "run as administrator".

JeanInMontana · October 24, 2008

Well, how did you run HJT the first time? Get rid of the P2P stuff "Limewire" downloading without paying is illegal and Malwarebytes will not be connected in anyway to illegal activities. You have no malware showing in any logs so I don't know what to do for you. You haven't given any symptoms to indicate you have malware either. "Something is wrong." doesn't tell me anything.

fox · October 24, 2008

I ran it the way I was told. I'm going to put a link to my last topic that was the first time that I use hjt.

http://www.malwarebytes.org/forums/index.php?showtopic=6940

this is not my computer it my sister's. I'll talk to her about deleting limewire.

I'm sorry, I was sure that i put the symptoms.

these are the main symptoms.

the symptoms:

1. the firefox history tab does not really keep track of the past few pages i look at.

2. I keep getting pop up once and a while from yahoo search protection. It ask if I should run the program. this has been happening every few days for the pass 2 weeks.

3. a web page show show up blank all white or it shows up like it was not connected to the internet.

JeanInMontana · October 24, 2008

I don't search the site for all posts by a user. What you put in this forum is all the info I had. The errors you state in the other post can be in FF and the Yahoo search ... what program is it referring to? What are the settings for saving history in FF? It can be set to not save at all.

You didn't answer how did you get a HJT log the first time? Have you tried doing as the program says? You need to update MBAM to 1.30 run a quick scan see if that allows you to then run HJT.

fox · October 24, 2008

I installed 1.30 ver and ran the scan and hjt give me that error message. I have not tried what it says. It should still work the same, right?

my settings for firefox ver. 2.0.0.16:

remember visited pages for the last 9 days.

remember what I enter in forms and search bar.

remember what I downloaded.

The errors you state in the other post can be in FF and the Yahoo search ... what program is it referring to?

I don't under stand what you saying.

this is the instructions that I was given from AdvancedSetup:

You run the installer and do a scan. Very easy to use.

Update TrendMicro

fox · October 25, 2008

I did what it said. here is the new log. I'm sorry for waiting this long to do this, but I did not want some thing to go wrong.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:23:08 PM, on 10/24/2008

Platform: Windows Vista (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16757)

Boot mode: Normal

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\HpqSRmon.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Windows\System32\rundll32.exe

C:\Windows\WindowsMobile\wmdc.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\HP Connections\6811507\Program\HP Connections.exe

C:\Program Files\LimeWire\LimeWire.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\Windows\ehome\ehmsas.exe

C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE

C:\Windows\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: (no name) - {1BB22D38-A411-4B13-A746-C2A4F4EC7344} - (no file)

O1 - Hosts: ::1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll