Clive Posted December 8, 2008 ID:38939 Share Posted December 8, 2008 I have been driven mad by this horrible thing!I posted my logs here yesterday but so far no one has come back to me - so I will try again as by now I have pulled out most of my hair!!My logs are as follows - I have tried looking at other responses to this but so far nothing has helped - I no longer have the annoying pop-up but my home pasg in IE is still re-directing everything to either the so called Microsoft page asking me to buy spyware product or to some site in what looks like ChineseMy logs are as followsHere is the first MBAM scanMalwarebytes' Anti-Malware 1.31Database version: 1467Windows 6.0.6001 Service Pack 106/12/2008 22:35:55mbam-log-2008-12-06 (22-35-55).txtScan type: Quick ScanObjects scanned: 44370Time elapsed: 2 minute(s), 14 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Explore (Trojan.Agent) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exeC:\Windows\system32\igfxsrvc.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exeC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\Windows Media Player\wmpnetwk.exeC:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXEC:\Program Files\Hewlett-Packard\Shared\HpqToaster.exeC:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Synaptics\SynTP\SynTPHelper.exeC:\Program Files\Webroot\WebrootSecurity\SSU.EXEC:\Program Files\Internet Explorer\ieuser.exec:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exeC:\Program Files\AIM6\aim6.exeC:\Program Files\AIM6\aolsoftware.exeC:\Program Files\PrevxCSI\prevxcsi.exeC:\Program Files\PrevxCSI\prevxcsi.exeC:\Windows\system32\Macromed\Flash\FlashUtil9e.exeC:\Windows\system32\taskeng.exeC:\Program Files\Internet Explorer\iexplore.exec:\program files\aol\aol toolbar 5.0\AolTbServer.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Windows\system32\SearchProtocolHost.exeC:\Windows\system32\SearchFilterHost.exeC:\Windows\system32\wbem\wmiprvse.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.o2.co.uk/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnbR0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.google.comO1 - Hosts: 61.157.217.210 www.google.co.ukO1 - Hosts: 61.157.217.210 www.myspace.comO1 - Hosts: 61.157.217.210 www.youtube.comO1 - Hosts: 61.157.217.210 www.facebook.comO1 - Hosts: 61.157.217.210 www.antispy.comO1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.yahoo.co.ukO1 - Hosts: 61.157.217.210 www.antispyware.comO1 - Hosts: 61.157.217.210 antispyware.comO1 - Hosts: 61.157.217.210 antispy.comO1 - Hosts: 61.157.217.210 www.msn.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.gg.comO1 - Hosts: 123.251.143.110 www.ghfhj.comO1 - Hosts: 123.251.143.110 www.cvnbcvnb.comO1 - Hosts: 123.251.143.110 www.1.comO1 - Hosts: 123.251.143.110 www.3.comO1 - Hosts: 123.251.143.110 www.asdf4asdfd.comO1 - Hosts: 123.251.143.110 www.asdfawsdfd.comO1 - Hosts: 123.251.143.110 www.asdfatsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfadsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfafsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfagsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasgdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdhfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfjd.comO1 - Hosts: 123.251.143.110 www.asdfasdfkd.comO1 - Hosts: 123.251.143.110 www.asdfasdfld.comO1 - Hosts: 123.251.143.110 www.asdfasdf,d.comO1 - Hosts: 123.251.143.110 www.asxdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdzfasdfd.comO1 - Hosts: 123.251.143.110 www.asdcfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfvasdfd.comO1 - Hosts: 123.251.143.110 www.asdfabsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasndfd.comO1 - Hosts: 123.251.143.110 www.asdfasdmfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.11asdfasdfd.comO1 - Hosts: 123.251.143.110 www.as222dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfa33sdfd.comO1 - Hosts: 123.251.143.110 www.asdfasd44fd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd5.comO1 - Hosts: 123.251.143.110 www.as66dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdf77asdfd.comO1 - Hosts: 123.251.143.110 www.asdf8asdfd.comO1 - Hosts: 123.251.143.110 www.asdf9asdfd.comO1 - Hosts: 123.251.143.110 www.asdf0asdfd.comO1 - Hosts: 123.251.143.110 www.asdf-asdfd.comO1 - Hosts: 123.251.143.110 www.aqqsdfasdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.16.197.121 www.asdhhfasdfdyy.comO1 - Hosts: 61.157.217.210 www.live.comO1 - Hosts: 123.251.143.110 www.asdwwwfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfeasdfd.comO1 - Hosts: 123.251.143.110 www.asdfrrasdfd.comO1 - Hosts: 123.251.143.110 www.asdfttasdfd.comO1 - Hosts: 123.251.143.110 www.asdfyyasdfd.comO1 - Hosts: 123.251.143.110 www.asdfuuuasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaiisdfd.comO1 - Hosts: 123.251.143.110 www.asdfaoosdfd.comO1 - Hosts: 123.251.143.110 www.asdfappsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasssdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdeefasdfd.comO1 - Hosts: 123.251.143.110 www.asdfffasdfd.comO1 - Hosts: 123.251.143.110 www.asdfavvvsdfd.comO1 - Hosts: 123.251.143.110 www.asnnndfasdfd.comO1 - Hosts: 123.251.143.110 www.asdmmmfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaffsdfd.comO1 - Hosts: 123.251.143.110 www.asdhhfasdfd.comO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dllO2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: AOL Toolbar BHO - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dllO3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dllO3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dllO3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dllO4 - HKLM\..\Run: [synTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"O4 - HKLM\..\Run: [igfxTray] "C:\Windows\system32\igfxtray.exe"O4 - HKLM\..\Run: [HotKeysCmds] "C:\Windows\system32\hkcmd.exe"O4 - HKLM\..\Run: [Persistence] "C:\Windows\system32\igfxpers.exe"O4 - HKLM\..\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKLM\..\Run: [QlbCtrl.exe] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /StartO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [HP Health Check Scheduler] "c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe"O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"O4 - HKLM\..\Run: [RCAutoLiveUpdate] "C:\Program Files\Max Registry Cleaner\MaxLiveUpdateRC.exe" -AUTOO4 - HKLM\..\Run: [RCSystemTray] "C:\Program Files\Max Registry Cleaner\MaxRCSystemTray.exe"O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\WebrootSecurity\SpySweeperUI.exe" /startintrayO4 - HKCU\..\Run: [sidebar] "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRunO4 - HKCU\..\Run: [LightScribe Control Panel] "C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" -hiddenO4 - HKCU\..\Run: [WMPNSCFG] "C:\Program Files\Windows Media Player\WMPNSCFG.exe"O4 - HKCU\..\Run: [Arovax AntiSpyware] "C:\Program Files\Arovax AntiSpyware\arovaxantispyware.exe" /sO4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O8 - Extra context menu item: &AOL Toolbar Search - C:\ProgramData\AOL\ieToolbar\resources\en-GB\local\search.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Panda ActiveScan - {653D93AF-C741-4e5e-8C1B-59BA43F93E16} - http://www.pandasoftware.com/activescan (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix: O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exeO23 - Service: CSIScanner - Prevx - C:\Program Files\PrevxCSI\prevxcsi.exeO23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exeO23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exeO23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXEO23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeO23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exeO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exeO23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exeO23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. (www.webroot.com) - C:\Program Files\Webroot\WebrootSecurity\SpySweeper.exeO23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\WebrootSecurity\WRConsumerService.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe--End of file - 16667 bytesI realise that you are busy - but I would be so grateful for your helpClive Link to post Share on other sites More sharing options...
Tigger93 Posted December 8, 2008 ID:38952 Share Posted December 8, 2008 Hello.Please read and follow the instructions provided here: Pre- HJT Post InstructionsWhen ready please post your logs here: Malware Removal - HijackThis LogsSomeone will be happy to assist you further with cleaning your system.During this scan and cleanup process you should not install any other software unless requested to do so. Link to post Share on other sites More sharing options...
Recommended Posts