??? Ok I am fairly clueless about how to figure out these. I will start with the fact that I am new to forums and avast was introduced to me by someone else whom I don’t speak to anymore…so you see my bind. I have some things in my computer that avast is not picking up on and I have done boot scans and scaned archive files. I have an msn messenger symbol in my tool bar and I did not download it. I also have some fake antivirus symbols that show up now and then as well. I don’t know if this is a residual problem as I did have some issues with fake antivirus symbols before and thought I cleared them out but maybe not.
I also have 3 decompression bombs that are torrents. I deleted the torrents (to my recycle bin) and have yet to scan again to see if they are still in my system. Also I am looking for the best advice on where or how to find the best linux system as I am trying to switch from my windows xp. I have not been able to find one that works well with my system. If you can help on any of these I would be very appreciative.
Download Hijackthis, open,choose, scan and save a log file. copy/paste the txt log results here.Also download Malwarebytes Antimalware and Superantispyware,install, UPDATE, scan,fix, and post the results here
http://filehippo.com/download_hijackthis/
The actual fake security application although not a virus, don’t visit the site, etc. as you will become properly infected.
If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode and report the findings (it should product a log file).
-
- SUPERantispyware On-Demand only in free version. - 2. MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
See booting into safe mode http://www.pchell.com/support/safemode.shtml.
– Decompression Bomb, a file that is highly compressed, which could be very large when decompressed. This used to be a tactic long ago to swamp the system, also see http://forum.avast.com/index.php?topic=15389.msg131213#msg131213.
The name really is the most dangerous thing about this and I wish they would change it or simply not report it, a real PITA.
I have already read up on some of your previous posts about decompression bombs DavidR. I think mine may be part of the reason my system is running slower then usual as the bomb is taking up my memory. I may be wrong. Thank you both and I will download, scan and report results shortly. It may be tomorrow but all comments are appreciated and encouraged.
No, this is not a constant behavior… while being expanded, the file could take a lot of resources, but not continuously. Maybe you’re slower for other reasons, lack of resources, two many applications running, infection…
Personally I don’t believe so as you said that these were torrents, which I can only assume were very large, which is normal.
The other issue is if you are using uTorrent and enabled the avast P2P shield to scan utorrent content, then this puts a heavy hit on system performance because of the way utorrent works. Unlike many other P2P applications, it breaks the download up into hundreds (or more) little files depending on the size of the file and ‘all’ of those little files have to be scanned.
I use azureus. I don’t know what p2p shield is so I don’t believe I have activated it. These particular downloads when shown in the error message have a constant repeat of the file name, in this case a movie. So I think they are legitimately decompression bombs. Should I have this p2p shield?
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:11:23 PM, on 3/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\WINDOWS\arservice.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://windowsisearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://windowsisearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windowsisearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windowsisearch.com/ie6.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://windowsisearch.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windowsisearch.com/ie6.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://windowsisearch.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windowsisearch.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://windowsisearch.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: 829275 helper - {616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB} - C:\WINDOWS\system32\829275\829275.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: (no name) - {CFEE97A3-4911-444D-8BE8-E243A23D3DE2} - C:\Program Files\Applications\iebt.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
O4 - HKLM..\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM..\Run: [nwiz] nwiz.exe /install
O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM..\Run: [CmPCIaudio] RunDll32 CMICNFG3.CPL,CMICtrlWnd
O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU..\Run: [MSMSGS] “C:\Program Files\Messenger\msmsgs.exe” /background
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [Uniblue RegistryBooster 2009] C:\Program Files\Uniblue\RegistryBooster\RegistryBooster.exe /S
O4 - HKCU..\Run: [wblogon] C:\WINDOWS\system32\algg.exe
O4 - HKCU..\Run: [DriverUpdaterPro] C:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - HKLM..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exe
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User ‘Default user’)
O4 - Global Startup: Adobe Reader 7.0.lnk = ?
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Reality Fusion GameCam SE.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieprogramming.com/redirect.php (file missing)
O9 - Extra ‘Tools’ menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieprogramming.com/redirect.php (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Compaq_Administrator\Start Menu\Programs>IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra ‘Tools’ menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-3-48.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Belkin Wireless USB Network Adapter (Belkin Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
–
End of file - 11211 bytes
An analysis of your HJT log shows the following :
We didn’t detect any active process of a firewall on your system. Reasons maybe:
(1.) You are using the windows firewall or a hardware firewall.
(2.) You are using a firewall of an unknown vendor.
(3.) You are using a firewall, but for unknown reasons it is disabled
(4.) You don’t use any firewall at all.
We recommend you to use a firewall.
Questionable and/or BAD entries :
C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe
http://www.processlibrary.com/directory/files/rftray/
If you use a Logitech QuickCam, this one is not bad. If you do not use QuickCam, this one can be fixed.
[b]R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windowsisearch.com/ie6.html[/b]
http://www.prevx.com/filenames/2953301731691070390-X1/ALGG2EEXE.html
This entry should be fixed by HijackThis.
[b]R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://windowsisearch.com/ie6.html[/b]
http://www.prevx.com/filenames/2953301731691070390-X1/ALGG2EEXE.html
This entry should be fixed by HijackThis.
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (file missing)
Unnecessary (deactivated) entry that can be fixed. AcroIEhelper.ocx, AcroIEhelper.dll - Adobe Acrobat reader, http://www.adobe.com/products/acrobat/re adstep2.html
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
Unnecessary (deactivated) entry that can be fixed. LinkScannerIE.dll - LinkScanner, http://linkscanner.explabs.com/linkscann er/default.asp
O2 - BHO: 829275 helper - {616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB} - C:\WINDOWS\system32\829275\829275.dll (file missing)
http://www.prevx.com/filenames/2953301731691070390-X1/ALGG2EEXE.html
Unnecessary (deactivated) entry that can be fixed.
O2 - BHO: (no name) - {CFEE97A3-4911-444D-8BE8-E243A23D3DE2} - C:\Program Files\Applications\iebt.dll (file missing)
http://www.fileresearchcenter.com/I/IEBT.DLL-12991.html
Unknown application. Unnecessary (deactivated) entry that can be fixed.
O4 - HKCU..\Run: [wblogon] C:\WINDOWS\system32\algg.exe
http://www.threatexpert.com/files/algg.exe.html
This entry should be fixed by HijackThis.
O4 - HKCU..\Run: [DriverUpdaterPro] C:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
http://www.threatexpert.com/files/DriverUpdaterPro.exe.html
If this is a program you use, then it should be OK.
O4 - HKLM..\Policies\Explorer\Run: [start] C:\Program Files\Applications\iebtm.exe
http://www.bleepingcomputer.com/startups/iebtm.exe-23379.html
This entry should be fixed by HijackThis.
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieprogramming.com/redirect.php (file missing)
http://www.threatexpert.com/report.aspx?md5=134f4aa99af9e7f5b6481006cfaab5dc
This entry should be fixed by HijackThis.
O9 - Extra ‘Tools’ menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.ieprogramming.com/redirect.php (file missing)
http://www.threatexpert.com/report.aspx?md5=134f4aa99af9e7f5b6481006cfaab5dc
This entry should be fixed by HijackThis.
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Compaq_Administrator\Start Menu\Programs>IMVU\Run IMVU.lnk (file missing)
Unnecessary (deactivated) entry that can be fixed.
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEB utton\support.htm (file missing)
Unnecessary (deactivated) entry that can be fixed.
O9 - Extra ‘Tools’ menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEB utton\support.htm (file missing)
Unnecessary (deactivated) entry that can be fixed.
Well azureus can bring its own problems depending on what port it uses for communication and the download. However, I don’t believe it is as bad as utorrent on system performance, though that depends on your system specification.
Re: your log file.
Your copy of acrobat pdf reader is out of date (assuming you still have it) and as such vulnerable to attack, you need to update it.
Your version of JAVA is also out of date and vulnerable.
Ensure you have the latest version of JRE (JAVA Runtime Environment) because older versions can be vulnerable to malware. First remove All Older Versions From Add/Remove Programs.
Then get the latest update from here http://java.sun.com/javase/downloads/index.jsp
Or JRE version 6 update 12 http://www.majorgeeks.com/Sun_Java_Runtime_Environment_d4648.html
I would also suggest a visit to this site, which scans your system for out of date programs that have patches to close vulnerabilities, http://secunia.com/software_inspector/ to see if there are any other programs that need to be updated.
You also have remnants of AVG8 that you need to remove - AVG8 Remover, download tool from here, http://www.grisoft.com/ww.download-tools there is a 32bit and 64 bit windows version, ensure you use the correct one.
This url is reported as dangerous, http://www.mywot.com/en/scorecard/windowsisearch.com
This too isn’t considered a good site, http://www.mywot.com/en/scorecard/ieprogramming.com
CharleyO, I am using windows firewall. Is that bad? I fixed all of the entries that you addressed for hijackthis. Should I scan again? Should I fix the other entries or are they better left alone? I am also scaning my system with superantispyware and Malwarebytes. I will post results as they finish scanning. Any other advice?
Windows firewall is better than none but it does not provide outbound protection.
No, you should only fix the entries I noted in my last post. The other entries not in my last post are good. Let us know how the scans go with SAS and MBAM.
Also, please follow David’s advice in his post.
I suggest:
- Disable System Restore and then reenable it again…
- Schedule a boot time scanning with avast with archive scanning turned on. If avast does not detect it, you can try DrWeb CureIT! instead.
- Immunize your system with SpywareBlaster.
- Check if you have insecure applications with Secunia Software Inspector.
Malwarebytes’ Anti-Malware 1.34
Database version: 1868
Windows 5.1.2600 Service Pack 3
3/19/2009 11:13:58 AM
mbam-log-2009-03-19 (11-13-41).txt
Scan type: Full Scan (C:|D:|E:|F:|G:|H:|I:|)
Objects scanned: 183078
Time elapsed: 1 hour(s), 29 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 27
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 1
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\y456.y456mgr (Trojan.BHO) → No action taken.
HKEY_CLASSES_ROOT\y456.y456mgr.1 (Trojan.BHO) → No action taken.
HKEY_CLASSES_ROOT\Interface{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) → No action taken.
HKEY_CLASSES_ROOT\CLSID{616f9ab4-a605-48b5-b7ae-b6b68e6c3cab} (Trojan.BHO) → No action taken.
HKEY_CLASSES_ROOT\CLSID{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) → No action taken.
HKEY_CLASSES_ROOT\Typelib{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{616f9ab4-a605-48b5-b7ae-b6b68e6c3cab} (Trojan.BHO) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{cfee97a3-4911-444d-8be8-e243a23d3de2} (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{53e0b6e8-a51d-448b-b692-40b67b285543} (Adware.180Solutions) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{616f9ab4-a605-48b5-b7ae-b6b68e6c3cab} (Trojan.BHO) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{0ac49246-419b-4ee0-8917-8818daad6a4e} (Adware.180Solutions) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{99410cde-6f16-42ce-9d49-3807f78f0287} (Adware.180Solutions) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) → No action taken.
HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar (Trojan.Zlob) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center (Trojan.Zlob) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\MSx (Rogue.MSAntivirus) → No action taken.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\smile (Trojan.Zlob) → No action taken.
Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) → Bad: (“regedit.exe” “%1”) Good: (regedit.exe “%1”) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) → Bad: (http://windowsisearch.com/search?q={searchTerms}) Good: (http://www.google.com/) → No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) → Bad: (http://windowsisearch.com/search?q={searchTerms}) Good: (http://www.google.com/) → No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) → Bad: (http://windowsisearch.com) Good: (http://www.google.com/) → No action taken.
Folders Infected:
C:\WINDOWS\system32\829275 (Trojan.BHO) → No action taken.
Files Infected:
C:\WINDOWS\system32\bszip.dll (Worm.P2P) → No action taken.
C:\Documents and Settings\Compaq_Administrator\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) → No action taken.
C:\Documents and Settings\Compaq_Administrator\My Documents\My Documents.url (Trojan.Zlob) → No action taken.
C:\Documents and Settings\Compaq_Administrator\Favorites\Antivirus Scan.url (Rogue.Link) → No action taken.
I am following DavidR’s advice as well. Thank you all so much!
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 03/19/2009 at 01:18 AM
Application Version : 4.25.1014
Core Rules Database Version : 3804
Trace Rules Database Version: 1759
Scan type : Complete Scan
Total Scan Time : 01:52:45
Memory items scanned : 604
Memory threats detected : 0
Registry items scanned : 6452
Registry threats detected : 51
File items scanned : 28552
File threats detected : 215
Trojan.FakeAlert-IEBT
HKLM\Software\Classes\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}
HKCR\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}
HKCR\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}
HKCR\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\Implemented Categories
HKCR\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\Implemented Categories{00021493-0000-0000-C000-000000000046}
HKCR\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\InprocServer32
HKCR\CLSID{144A6B24-0EBC-4D89-BF09-A06A718E57B5}\InprocServer32#ThreadingModel
C:\PROGRAM FILES\APPLICATIONS\IEBR.DLL
HKU\S-1-5-21-861706201-3366741721-2364323922-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{144A6B24-0EBC-4D89-BF09-A06A718E57B5}
HKU\S-1-5-21-861706201-3366741721-2364323922-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{CFEE97A3-4911-444D-8BE8-E243A23D3DE2}
Adware.E404 Helper/Variant-V
HKLM\Software\Classes\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}\InprocServer32
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}\InprocServer32#ThreadingModel
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}\ProgID
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}\Programmable
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}\TypeLib
HKCR\CLSID{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}\VersionIndependentProgID
HKCR\y456.y456mgr.1
HKCR\y456.y456mgr.1\CLSID
HKCR\y456.y456mgr
HKCR\y456.y456mgr\CLSID
HKCR\y456.y456mgr\CurVer
HKCR\TypeLib{E63648F7-3933-440E-AAAA-A8584DD7B7EB}
C:\WINDOWS\SYSTEM32\829275\829275.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}
HKU\S-1-5-21-861706201-3366741721-2364323922-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{616F9AB4-A605-48B5-B7AE-B6B68E6C3CAB}
Adware.SearchTool
HKU\S-1-5-21-861706201-3366741721-2364323922-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{5ED7D3DE-6DBE-4516-8712-01B1B64B7057}
Trojan.Smitfraud Variant/IE Anti-Spyware
HKU\S-1-5-21-861706201-3366741721-2364323922-1008\Software\Microsoft\Windows\CurrentVersion\Ext\Stats{9034A523-D068-4BE8-A284-9DF278BE776E}
Adware.Tracking Cookie
(I am leaving out the details of tracking cookie results as they were 212 in number. If you guys really want me to post them I will)
Adware.MyWebSearch/FunWebProducts
HKCR\CLSID{9AFB8248-617F-460d-9366-D71CDEDA3179}
Trojan.Media-Codec
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar#UninstallString
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center#DisplayName
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center#UninstallString
Adware.E404 Helper/Hij
HKCR\CLSID\e405.e405mgr
HKCR\CLSID\e405.e405mgr#UserId
HKCR\TypeLib{E63648F7-3933-440E-B4F6-A8584DD7B7EB}
HKCR\TypeLib{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0
HKCR\TypeLib{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0
HKCR\TypeLib{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\0\win32
HKCR\TypeLib{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\FLAGS
HKCR\TypeLib{E63648F7-3933-440E-B4F6-A8584DD7B7EB}\1.0\HELPDIR
HKCR\Interface{F7D09218-46D7-4D3D-9B7F-315204CD0836}
HKCR\Interface{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid
HKCR\Interface{F7D09218-46D7-4D3D-9B7F-315204CD0836}\ProxyStubClsid32
HKCR\Interface{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib
HKCR\Interface{F7D09218-46D7-4D3D-9B7F-315204CD0836}\TypeLib#Version
Browser Hijacker.Favorites
C:\DOCUMENTS AND SETTINGS\COMPAQ_ADMINISTRATOR\FAVORITES\ANTIVIRUS SCAN.URL
OK, since your MBAM log shows no action taken, run MBAM again and the detected items should all selected/ticked (if they aren’t selected, select them as all appear good detections), and click the remove selected button, see image.
Malwarebytes’ Anti-Malware 1.34
Database version: 1868
Windows 5.1.2600 Service Pack 3
3/19/2009 12:23:11 PM
mbam-log-2009-03-19 (12-23-11).txt
Scan type: Full Scan (C:|D:|E:|F:|G:|H:|I:|)
Objects scanned: 183078
Time elapsed: 1 hour(s), 29 minute(s), 5 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 27
Registry Values Infected: 1
Registry Data Items Infected: 4
Folders Infected: 1
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\y456.y456mgr (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\y456.y456mgr.1 (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{616f9ab4-a605-48b5-b7ae-b6b68e6c3cab} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{616f9ab4-a605-48b5-b7ae-b6b68e6c3cab} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{5ed7d3de-6dbe-4516-8712-01b1b64b7057} (Adware.SmartShopper) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{9034a523-d068-4be8-a284-9df278be776e} (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{144a6b24-0ebc-4d89-bf09-a06a718e57b5} (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{cfee97a3-4911-444d-8be8-e243a23d3de2} (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{5929cd6e-2062-44a4-b2c5-2c7e78fbab38} (Fake.Dropped.Malware) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{53e0b6e8-a51d-448b-b692-40b67b285543} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{616f9ab4-a605-48b5-b7ae-b6b68e6c3cab} (Trojan.BHO) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{0ac49246-419b-4ee0-8917-8818daad6a4e} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{99410cde-6f16-42ce-9d49-3807f78f0287} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved{f31a5d11-bf0b-4a4e-90af-274f2090aaa6} (Adware.180Solutions) → Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\e405.e405mgr (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEBrowse Tool (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IExplorer Bar (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warning Center (Trojan.Zlob) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MSx (Rogue.MSAntivirus) → Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\smile (Trojan.Zlob) → Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) → Bad: (“regedit.exe” “%1”) Good: (regedit.exe “%1”) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) → Bad: (http://windowsisearch.com/search?q={searchTerms}) Good: (http://www.google.com/) → Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) → Bad: (http://windowsisearch.com/search?q={searchTerms}) Good: (http://www.google.com/) → Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\SearchAssistant (Hijack.Search) → Bad: (http://windowsisearch.com) Good: (http://www.google.com/) → Quarantined and deleted successfully.
Folders Infected:
C:\WINDOWS\system32\829275 (Trojan.BHO) → Quarantined and deleted successfully.
Files Infected:
C:\WINDOWS\system32\bszip.dll (Worm.P2P) → Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Administrator\My Documents\My Pictures\My Pictures.url (Trojan.Zlob) → Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Administrator\My Documents\My Documents.url (Trojan.Zlob) → Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Administrator\Favorites\Antivirus Scan.url (Rogue.Link) → Quarantined and deleted successfully.
OK, that looks much better as far as the MBAM scan goes.
I presume that you also let SAS take care of what it detected ?
If so that’s fine, no need to post the info on tracking cookies, they are a minor niggle and one of privacy rather than security. However you should let SAS remove them, in your browser you should not allow third party cookies (those not from the site you are visiting) and periodically clear your cookies from your browser settings.