Ok. Last Thursday or Friday I downloaded the MyWebSearch/Webfetti against my better judgement. I have spent every day on this, downloading everything I thought would help. Avast antivirus, HijackThis, Unlocker, Adaware…the list goes on. I barely got on here because the stupid thing conspires to slow down when I go to sites that remove it, and then ultimately stops all together. I know which ones are the culprits, but when going into windows search it acts as if its not running…and says it IS NOT RUNNING, I have read these forums, and tried, I want to make a REBOOT- back up disk, but when I go to the sites to download them the malware stalls IE… so please help me.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:51, on 3/18/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\WINDOWS\system32\java.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Roxio Creator 2009\Digital Home 11\RoxioUpnpService11.exe
C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxLiveShare11.exe
C:\Program Files\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatch11.exe
C:\Program Files\LeapFrog\LeapFrog Connect\Monitor.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
continued on next topic/thread !!! Thanks in advance…ya’ll are just Heaven on Earth !
McCrappy has expired. I only run Avast. I have done system scans, and hijack this deletes…but then one is starting at start up. kamileva.dll, bajujami.dll,
O2 - BHO: (no name) - {25418557-5b15-45a3-b580-a349d9b4e161} - C:\WINDOWS\system32\gomopiwe.dll
I deleted mywebsearch from Add/Remove . I haven’t deleted McAffe because I have been dealing with this. I dont mind the pop ups as much, but I hate that I can’t go to sites on instant, because it slows it down. Plus I hate the vunerability to my files.
kamileva.dll is a malware-associated dynamic link library (dll). Legitimate dll files contain a set of executable functions that can be used by Windows applications. Malware-associated dlls contain malicious code that causes damage to your PC.
I also hate that so many processes are running on my PC, I know that is the least of my problems right now, but once I fix this, I would like to have better control of what is running in the background. I know a little about computers, I know enough to get me in trouble. I don’t want to have to to a TOTAL WIPEOUT, because I don’t have a backup of my current system, SP3, alll the hotfixes, and other things that would take a week just to update. I have pictures that are irreplaceable. I have a Gateway 250 GB dual core GT 5032. I only use about 1/4 of my hard drive, so theres not a memory problem.
www.iobit.com/advancedwindowscareper.html try this software
it would reduce the unnecessary processes running in the background and also take care of the registry entries which are not reqd
3/16/2009 10:41:28 SYSTEM 1180 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\SYSTEM32\UKBTTN.DLL” file.
3/16/2009 10:41:48 SYSTEM 1180 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\SYSTEM32\DOGUMIVU.DLL” file.
3/16/2009 10:47:42 SYSTEM 1180 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\SYSTEM32\BTUQSL.DLL” file.
3/16/2009 11:14:54 SYSTEM 1180 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\SYSTEM32\POFUSIDO.DLL” file.
3/16/2009 12:06:42 SYSTEM 1180 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\SYSTEM32\XPHSAX.DLL” file.
3/16/2009 1:19:56 SYSTEM 1180 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\SYSTEM32\ZUDOVASE.DLL” file.
3/16/2009 4:05:54 Butcher 1188 AAVM - scanning warning: x_AavmCheckFileDirectEx [UNI]: C:\Documents and Settings\Butcher\Desktop\SmitfraudFix\Process.exe (C:\Documents and Settings\Butcher\Desktop\SmitfraudFix\Process.exe) returning error, 00000005.
3/17/2009 12:52:12 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP235\A0041095.dll” file.
3/17/2009 8:26:04 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP235\A0041096.dll” file.
3/17/2009 8:26:20 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP235\A0041097.dll” file.
3/17/2009 8:26:39 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP235\A0041101.dll” file.
3/17/2009 8:27:00 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP235\A0041141.dll” file.
3/17/2009 8:27:10 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\System Volume Information_restore{593F298F-B7D6-4A3D-A260-6D7E68E3F587}\RP235\A0041162.dll” file.
3/17/2009 9:32:23 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\system32\hosazowa.dll” file.
3/17/2009 9:39:54 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\system32\nudodina.dll” file.
3/17/2009 9:41:06 Administrator 1328 Sign of “Win32:Trojan-gen {Other}” has been found in “C:\WINDOWS\system32\pivetupa.dll” file.
3/17/2009 6:32:48 SYSTEM 1236 Sign of “Win32:Virtumonde-TV [Adw]” has been found in “http://82.98.235.205/dwn/d.html?sid=RB39GXIMpk98CqkfJgX6G3EJ-U5xCPpNdQ_uGHEOp0N3DZ1aIV_oH3UPpx90Df4ZdAz7H31Zq0x0C6ZIdQX5HCNb_RxGO65MfA_vQkE3rkh2CqxIfA2pTkA5rkp1D5l4dAyYfndcrUtNOK5Kcgqo\[Embedded_I#0a260]\[UPX]” file.
I go to manually find the files in the folders…not using windows search since it has been altered too I guess…and cant. I assume they are hidden, and this is where I am. thanks for the tip for processor mgmt.
installs on startup. I have read about going into C:\ mode, and del “filename.dll” but don’t want to make a mess of something I don’t feel comfortable getting into.
thats what I was saying before. I read that you can make an exact replica of your OS, I don’t care about having to reinstall small programs/applications like printers, camera, but its the Windows update, I got this pc in 2005. thats 4 years worth of updates, hotfixes, so on. I heard about a way to restart your computer in DOS mode, by a certain date, its restoring I know, but doesn’t your computer make additional hidden " restore points " ?>?
I am having a look at your log, that entry is bad, and is probably redirecting your web search.I will post back soon,then you can use HJT to fix some of the entries
I really appreciate all the help. I have 4 kids, ages 8 months, 4 , 8, and 9 years. I don’t want to lose pics of them, nor do I want inappropriate content flashing before their eyes while they do homework. Its a shame that people have nothing better to do, then to create viruses, and trojens, and all the other names and crap that they do. People like me just want to live their lives, I don’t harm others, why …why…why…its just rediculous !!! but thanks , I am glad you guys are here to the rescue !!!