IE problems

halo2_godhalo2_god New York state
edited January 2008 in Spyware & Virus Removal
Umm, ok well my brother doesnt like the opera browser. So he uses the really bad internet explorer and well there was a problem he told me so i checked it out... And What happend was whenever you went to a website like yahoo or even click on google.(or even just going to a diffrent website) if i clicked the white space it would open a new tab which would link to an ad, an IP, or a message box would apear saying your computer is infected then i hit "X" and another one poped up are you sure you would like to leav this site youre still infexted... So i did avast cleaner nothing came up so then i did a full system scan and alot came up (runsquence.exe: win32:DSSdoor-C[trj], gosCE76.tmp: Win32.Dialer-FU [trj]) But what i did move to chest delet then i cleaned all temp files and temporary internet files that seemed to fix the problem. but just to be sure here is HJTL
Logfile of HijackThis v1.99.1
Scan saved at 2:43:04 PM, on 12/28/2007
Platform: Unknown Windows (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
C:\Windows\ehome\ehtray.exe
C:\Users\Owner\AppData\Local\Temp\weofbphb.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\explorer.exe
C:\Program Files\Opera\Opera.exe
C:\Install\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Owner\AppData\Local\Temp\jkkli.dll,#1
O4 - HKCU\..\Run: [DDC] C:\Users\Owner\AppData\Local\Temp\weofbphb.exe
O4 - HKCU\..\Run: [20be8da5] rundll32.exe "C:\Users\Owner\AppData\Local\Temp\dhpexkhi.dll",b
O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Owner\AppData\Local\Temp\pmnli.dll,c
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll
O11 - Options group: [INTERNATIONAL] International*
O13 - Gopher Prefix:
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: @%SystemRoot%\ehome\ehstart.dll,-101 (ehstart) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)

Comments

  • halo2_godhalo2_god New York state
    edited December 2007
    Please help my threat has escalated i have i dentified this to by infecting my computer!!!
    Component Name: pmnli.dll

    Description of pmnli.dll
    This is a component of Virtumonde. Virtumonde is a spyware application that regenerates itself each time you try to terminate the process and remove its files. It delivers ads to your computer screen continuously, interfering with your surfing habits and slowing down your usual computer activities.

    Recommendation for pmnli.dll
    This is a serious threat to your system. Removal is the best option for this spyware.
  • TroganTrogan London, UK
    edited December 2007
    Hi halo,

    You're running an older version of HijackThis. Go into Add/Remove programs and uninstall HijackThis.

    Next, Download the latest version of HJTInstall.exe to your Desktop.
    • Doubleclick HJTInstall.exe to install it.
    • By default it will install to C:\Program Files\Trend Micro\HijackThis .
    • Click on Install.
    • It will create a HijackThis icon on the desktop.
    • Once installed, it will launch Hijackthis.
    • Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
    • Save the log to a convenient location and then copy and paste the contents back here.
    • Don't use the Analyse This button, its findings are dangerous if misinterpreted.
    • Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

    Do not run any other scans or programs!!!
  • halo2_godhalo2_god New York state
    edited December 2007
    OK, well i sligtly cleaned it up by booting in safemode and running dr. web im uninstalling it right now though because i already have avast profesional. Also it deleted something like 13 Infections... I also ran smitfraud!
    here is HJT
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:21:57 PM, on 12/29/2007
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16575)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\DrWeb\spiderui.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
    C:\Program Files\DrWeb\spiderml.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Opera\Opera.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\explorer.exe
    C:\Windows\notepad.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\notepad.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
    O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
    O4 - HKLM\..\Run: [SpIDerMail] "C:\Program Files\DrWeb\spiderml.exe"
    O4 - HKLM\..\Run: [SpIDerNT] C:\PROGRA~1\DrWeb\spiderui.exe /agent
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
    O23 - Service: SpIDer Guard for Windows (SPIDERNT) - Doctor Web, Ltd. - C:\PROGRA~1\DrWeb\spidernt.exe

    --
    End of file - 3699 bytes
  • TroganTrogan London, UK
    edited December 2007
    I'm not using Vista, so you will have to help me out a little.

    You have some items disabled on startup. Please enable all of these and then post a new HijackThis log.

    Also, I need to see another log from HijackThis.
    • Run Hijackthis.
    • Click on Open the Misc Tools section.
    • Next click on Open uninstall manager.
    • Press the Save list button.
    • Save the file to your desktop, with the default name of uninstall_list
    • Copy & Paste the entire contents of that file in your in your next post.
  • halo2_godhalo2_god New York state
    edited December 2007
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:21:57 PM, on 12/29/2007
    Platform: Windows Vista (WinNT 6.00.1904)
    MSIE: Internet Explorer v7.00 (7.00.6000.16575)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files\DrWeb\spiderui.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Alwil Software\Avast4\ashDisp.exe
    C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
    C:\Program Files\DrWeb\spiderml.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Opera\Opera.exe
    C:\Windows\system32\cmd.exe
    C:\Windows\explorer.exe
    C:\Windows\notepad.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\notepad.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
    O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
    O4 - HKLM\..\Run: [SpIDerMail] "C:\Program Files\DrWeb\spiderml.exe"
    O4 - HKLM\..\Run: [SpIDerNT] C:\PROGRA~1\DrWeb\spiderui.exe /agent
    O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
    O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
    O23 - Service: SpIDer Guard for Windows (SPIDERNT) - Doctor Web, Ltd. - C:\PROGRA~1\DrWeb\spidernt.exe

    --
    End of file - 3699 bytes


    Adobe Flash Player ActiveX
    Adobe Flash Player Plugin
    Adobe Reader 8.1.1
    avast! Antivirus
    Belarc Advisor 7.2
    Bit Che
    Citrix Presentation Server Client
    Gears of War
    HijackThis 2.0.2
    HP Product Detection
    Macro Wizard 4.1 - VsiSystems.com
    MapleStory
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Office Professional Edition 2003
    Microsoft Xbox 360 Accessories 1.1
    NVIDIA Drivers
    Opera 9.24
    Recorder
    System Requirements Lab
    Trillian
    VideoLAN VLC media player 0.8.6d
    Vista Manager
    WinRAR archiver
  • TroganTrogan London, UK
    edited January 2008
    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
        Extended (if available otherwise Standard)
      • Scan Options:
        Scan Archives
        Scan Mail Bases
        [*]Click OK
        [*]Now under select a target to scan:
          Select
        My Computer
        [*]This will program will start and scan your system.
        [*]The scan will take a while so be patient and let it run.
        [*]Once the scan is complete it will display if your system has been infected.
        • Now click on the Save as Text button:
        [*]Save the file to your desktop.
        Post the Kaspersky report back here.
      • halo2_godhalo2_god New York state
        edited January 2008
        OK, sorry it took me so long to get back i was busy with school and stuff. But i can't run internet explorer. it says "Internet Explorer has stopped working"
      • TroganTrogan London, UK
        edited January 2008
        Try this - it can be run in Firefox:

        TotalScan
        Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
        Please go to this site Link >> TotalScan << LINK
        • Under Scan Now click the Full Scan button
        • Follow the prompts to install the Active X if necessary
        • Go and make a cup of tea/coffee/beverage of your choice and watch some TV :)
        • When the scan is finished, a report will be generated
        • Next to Scan Details click the small Save button and save the report to your desktop.
        • Please post the report in your reply.
      • halo2_godhalo2_god New York state
        edited January 2008
        OK, im back and i managed to open Internet Explorer... Im about to do my laundry and im running the "TotalScan" do you stil want me to run the panda one after tolat scan finishes? and i had to disable avast because it kept saying worm/virus, trojan detected and some other c**p.
        BTW i use opera its tended not be targeted as much as the other browsers. And when i need to and im sure im viewing a secure site i can switch over to IE. (plus my hosts file gets updated by Spybot search and destroy i just recently started doing this)
      • halo2_godhalo2_god New York state
        edited January 2008
        OK, well i finished the scan
        and umm spybot search and destroy removed some crap... i also didnt click the clean option.
        ;***********************************************************************************************************************************************************************************
        ANALYSIS: 2008-01-10 00:24:15
        PROTECTIONS: 1
        MALWARE: 9
        SUSPECTS: 0
        ;***********************************************************************************************************************************************************************************
        PROTECTIONS
        Description Version Active Updated
        ;===================================================================================================================================================================================
        avast! antivirus 4.7.1098 [VPS 080109-0] 4.7.1098 No Yes
        ;===================================================================================================================================================================================
        MALWARE
        Id Description Type Active Severity Disinfectable Disinfected Location
        ;===================================================================================================================================================================================
        00049303 Joke/Idiot Jokes No 0 Yes No C:\RECYCLER\S-1-5-21-515967899-725345543-2076133242-1003\Dc21\idiot.zip[idiot.exe]
        00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@fileforum.betanews[1].txt
        00139535 Application/Processor HackTools No 0 Yes No C:\Windows\System32\Process.exe
        00139535 Application/Processor HackTools No 0 Yes No C:\Users\Owner\Desktop\SmitfraudFix\Process.exe
        00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@tribalfusion[1].txt
        00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@com[1].txt
        00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@ad.yieldmanager[2].txt
        00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Users\Owner\AppData\Roaming\Microsoft\Windows\Cookies\owner@www6.addfreestats[1].txt
        00517584 Application/SuperFast HackTools No 0 Yes No C:\Users\Owner\Desktop\SmitfraudFix\restart.exe
        02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\Users\Owner\Desktop\SmitfraudFix\Reboot.exe
        ;===================================================================================================================================================================================
        SUSPECTS
        Location
        ;===================================================================================================================================================================================
        ;===================================================================================================================================================================================
      • TroganTrogan London, UK
        edited January 2008
        Please post a new HijackThis log, and let me know what problems remain.
      • halo2_godhalo2_god New York state
        edited January 2008
        Hey, here is the hijackthis log and also i had a few quick questions. Firstly do you know of a much better anti malware program than avast also i don't care how much it coast. Secondly i dont use a software firewall because i have the linksys WRT54G router that comes with the SPI firewall should i get a software firewall any ways also would you know anything about the hardware firewall called Alphashield(would it help anything because i already have the router)? and third ummm you know in the hijackthis log file posted below it shows ("C:\Program Files\DrWeb\spiderui.exe", "C:\Program Files\DrWeb\spiderml.exe", ("O4 - HKLM\..\Run: [SpIDerMail] "C:\Program Files\DrWeb\spiderml.exe",) "O4 - HKLM\..\Run: [SpIDerNT] C:\PROGRA~1\DrWeb\spiderui.exe /agent" and last "O23 - Service: SpIDer Guard for Windows (SPIDERNT) - Doctor Web, Ltd. - C:\PROGRA~1\DrWeb\spidernt.exe" why are those still there even tho when i navigate to the path nothing is there or when i search for them they dont show up????. Or you can just look at the ones with *Starts* next to them.

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 6:21:57 PM, on 12/29/2007
        Platform: Windows Vista (WinNT 6.00.1904)
        MSIE: Internet Explorer v7.00 (7.00.6000.16575)
        Boot mode: Normal

        Running processes:
        C:\Windows\system32\taskeng.exe
        C:\Windows\system32\Dwm.exe
        C:\Program Files\DrWeb\spiderui.exe*
        C:\Program Files\Windows Defender\MSASCui.exe
        C:\Program Files\Alwil Software\Avast4\ashDisp.exe
        C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
        C:\Program Files\DrWeb\spiderml.exe*
        C:\Windows\ehome\ehtray.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Windows\ehome\ehmsas.exe
        C:\Program Files\Windows Sidebar\sidebar.exe
        C:\Program Files\Opera\Opera.exe
        C:\Windows\system32\cmd.exe
        C:\Windows\explorer.exe
        C:\Windows\notepad.exe
        C:\Program Files\Windows Media Player\wmpnscfg.exe
        C:\Windows\system32\SearchFilterHost.exe
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
        C:\Windows\notepad.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
        O1 - Hosts: ::1 localhost
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [XboxStat] "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
        O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
        O4 - HKLM\..\Run: [SpIDerMail] "C:\Program Files\DrWeb\spiderml.exe"*
        O4 - HKLM\..\Run: [SpIDerNT] C:\PROGRA~1\DrWeb\spiderui.exe /agent*
        O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
        O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
        O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
        O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
        O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
        O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O13 - Gopher Prefix:
        O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
        O22 - SharedTaskScheduler: Windows DreamScene - {E31004D1-A431-41B8-826F-E902F9D95C81} - C:\Windows\System32\DreamScene.dll
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
        O23 - Service: SpIDer Guard for Windows (SPIDERNT) - Doctor Web, Ltd. - C:\PROGRA~1\DrWeb\spidernt.exe*

        --
        End of file - 3699 bytes
      • TroganTrogan London, UK
        edited January 2008
        Hey,
        Firstly do you know of a much better anti malware program than avast
        Avast is an Anti-Virus program. Here are some good Free and Paid ones...

        Free:
        AntiVir << I recommend this
        AVG Free Edition

        Paid:
        http://www.kaspersky.com/
        Secondly i dont use a software firewall because i have the linksys WRT54G router that comes with the SPI firewall should i get a software firewall
        A hardware firewall should be fine.
        any ways also would you know anything about the hardware firewall called Alphashield(would it help anything because i already have the router)?
        Never heard of it. But you won't need it since you have one hardware Firewall.
        ummm you know in the hijackthis log file posted below it shows...
        The O4 are what startup with Windows. The O23 are Services. If the program (DrWeb) is installed on the computer, you should be able to find it.


        Anyway, the HijackThis log is clean. Let me know if you have any other questions.
      • halo2_godhalo2_god New York state
        edited January 2008
        OK, well i had another question. I use to setup my router to run all my computers threw OPENDNS. Is that faster then my ISP's or would it be more secure????
      • TroganTrogan London, UK
        edited January 2008
        To be honest, I don't know.

        Ask in the networking forum.
      This discussion has been closed.