Clive Posted December 7, 2008 ID:38565 Share Posted December 7, 2008 This thing is dsriving me crazyI have a new laptop which has been infected & I am having difficulty following all the instructionsI have done MBAM scan which is OK twice & also Panda - but I can't get onto the site to download HiJack because of the infection it keeps taling me to the silli chinese site again & now all references to Trend in any wording on my computer are highlighted in yellow & take me back to the chinese wordingWhat can I do? Link to post Share on other sites More sharing options...
Clive Posted December 7, 2008 Author ID:38566 Share Posted December 7, 2008 Here is the first MBAM scanMalwarebytes' Anti-Malware 1.31Database version: 1467Windows 6.0.6001 Service Pack 106/12/2008 22:35:55mbam-log-2008-12-06 (22-35-55).txtScan type: Quick ScanObjects scanned: 44370Time elapsed: 2 minute(s), 14 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Explore (Trojan.Agent) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Clive Posted December 7, 2008 Author ID:38703 Share Posted December 7, 2008 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exeC:\Windows\system32\igfxsrvc.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXEC:\Program Files\Hewlett-Packard\Shared\HpqToaster.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program Files\Webroot\WebrootSecurity\SSU.EXEC:\Program Files\Internet Explorer\ieuser.exec:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exeC:\Program Files\AIM6\aim6.exeC:\Program Files\AIM6\aolsoftware.exeC:\Program Files\PrevxCSI\prevxcsi.exeC:\Program Files\PrevxCSI\prevxcsi.exeC:\Windows\system32\Macromed\Flash\FlashUtil9e.exeC:\Windows\system32\taskeng.exeC:\Program Files\Internet Explorer\iexplore.exec:\program files\aol\aol toolbar 5.0\AolTbServer.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\system32\wbem\wmiprvse.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.o2.co.uk/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.google.comO1 - Hosts: 61.157.217.210 www.google.co.ukO1 - Hosts: 61.157.217.210 www.myspace.comO1 - Hosts: 61.157.217.210 www.youtube.comO1 - Hosts: 61.157.217.210 www.facebook.comO1 - Hosts: 61.157.217.210 www.antispy.comO1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.yahoo.co.ukO1 - Hosts: 61.157.217.210 www.antispyware.comO1 - Hosts: 61.157.217.210 antispyware.comO1 - Hosts: 61.157.217.210 antispy.comO1 - Hosts: 61.157.217.210 www.msn.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.gg.comO1 - Hosts: 123.251.143.110 www.ghfhj.comO1 - Hosts: 123.251.143.110 www.cvnbcvnb.comO1 - Hosts: 123.251.143.110 www.1.comO1 - Hosts: 123.251.143.110 www.3.comO1 - Hosts: 123.251.143.110 www.asdf4asdfd.comO1 - Hosts: 123.251.143.110 www.asdfawsdfd.comO1 - Hosts: 123.251.143.110 www.asdfatsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfadsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfafsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfagsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasgdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdhfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfjd.comO1 - Hosts: 123.251.143.110 www.asdfasdfkd.comO1 - Hosts: 123.251.143.110 www.asdfasdfld.comO1 - Hosts: 123.251.143.110 www.asdfasdf,d.comO1 - Hosts: 123.251.143.110 www.asxdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdzfasdfd.comO1 - Hosts: 123.251.143.110 www.asdcfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfvasdfd.comO1 - Hosts: 123.251.143.110 www.asdfabsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasndfd.comO1 - Hosts: 123.251.143.110 www.asdfasdmfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.11asdfasdfd.comO1 - Hosts: 123.251.143.110 www.as222dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfa33sdfd.comO1 - Hosts: 123.251.143.110 www.asdfasd44fd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd5.comO1 - Hosts: 123.251.143.110 www.as66dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdf77asdfd.comO1 - Hosts: 123.251.143.110 www.asdf8asdfd.comO1 - Hosts: 123.251.143.110 www.asdf9asdfd.comO1 - Hosts: 123.251.143.110 www.asdf0asdfd.comO1 - Hosts: 123.251.143.110 www.asdf-asdfd.comO1 - Hosts: 123.251.143.110 www.aqqsdfasdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.16.197.121 www.asdhhfasdfdyy.comO1 - Hosts: 61.157.217.210 www.live.comO1 - Hosts: 123.251.143.110 www.asdwwwfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfeasdfd.comO1 - Hosts: 123.251.143.110 www.asdfrrasdfd.comO1 - Hosts: 123.251.143.110 www.asdfttasdfd.comO1 - Hosts: 123.251.143.110 www.asdfyyasdfd.comO1 - Hosts: 123.251.143.110 www.asdfuuuasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaiisdfd.comO1 - Hosts: 123.251.143.110 www.asdfaoosdfd.comO1 - Hosts: 123.251.143.110 www.asdfappsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasssdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdeefasdfd.comO1 - Hosts: 123.251.143.110 www.asdfffasdfd.comO1 - Hosts: 123.251.143.110 www.asdfavvvsdfd.comO1 - Hosts: 123.251.143.110 www.asnnndfasdfd.comO1 - Hosts: 123.251.143.110 www.asdmmmfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaffsdfd.comO1 - Hosts: 123.251.143.110 www.asdhhfasdfd.comO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dllO3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dllO3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dllO4 - HKLM\..\Run: [synTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"O4 - HKLM\..\Run: [igfxTray] "C:\Windows\system32\igfxtray.exe"O4 - HKLM\..\Run: [HotKeysCmds] "C:\Windows\system32\hkcmd.exe"O4 - HKLM\..\Run: [Persistence] "C:\Windows\system32\igfxpers.exe"O4 - HKLM\..\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKLM\..\Run: [QlbCtrl.exe] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /StartO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [HP Health Check Scheduler] "c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe"O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"O4 - HKLM\..\Run: [RCAutoLiveUpdate] "C:\Program Files\Max Registry Cleaner\MaxLiveUpdateRC.exe" -AUTOO4 - HKLM\..\Run: [RCSystemTray] "C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe"O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintrayO4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRunO4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hiddenO4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"O4 - HKCU\..\Run: [Arovax AntiSpyware] "C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe" /sO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-GB\local\search.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoftware.com/activescan (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix: O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exeO23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exeO23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exeO23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exeO23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXEO23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exeO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exeO23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exeO23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exeO23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 16667 bytesMy Hijack Log - hope this is helpful Link to post Share on other sites More sharing options...
Recommended Posts