system
April 5, 2009, 10:36pm
1
Hello everyone, My mom got a popup saying she had viruses and it looked similar to windows. However she has Norton 360 and it doesnt pick up anything. I disconnected from the internet and closed the pop ups. Two things I saw was Lime wire, which my mom used to download Barry Mantilow songs because she doesnt know how to move the songs from disk to MP3 and Wild Tangent appeared on HJT log.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Pavilion&pf=laptop
system
April 5, 2009, 10:37pm
2
O4 - HKUS\S-1-5-19..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User ‘LOCAL SERVICE’)http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZKxdm021YYUS @btrez.dll ,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm@btrez.dll ,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htmhttp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-3/WebfettiInitialSetup1.0.1.0.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1229556687743&h=7f62a7dec6dfeb101ed6c7c923ee3664/&filename=jinstall-6u11-windows-i586-jc.cab http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
–
system
April 5, 2009, 10:47pm
3
I suggest that you tell your mom to get avast!
Try SuperAntiSpyware Free MBAM
Download and run Norton Removal Tool
system
April 5, 2009, 11:01pm
4
She’s not going to get rid of something she paid for, will MBAM conflict with Norton 360 unlike Avast?
system
April 5, 2009, 11:23pm
6
Malwarebytes’ Anti-Malware 1.35
4/5/2009 7:18:56 PM
Scan type: Quick Scan
Memory Processes Infected: 2
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
system
April 5, 2009, 11:23pm
7
HKEY_CLASSES_ROOT\Interface{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) → No action taken.
Why didn’t you send that infected files to MBAM quarantine?
system
April 5, 2009, 11:25pm
9
HKEY_CLASSES_ROOT\Typelib{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) → No action taken.
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
system
April 5, 2009, 11:26pm
10
I Didnt close the window yet, I can stC:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) → No action taken.
DavidR
April 6, 2009, 12:51am
11
Wow all that from only the MBAM Quick Scan, I do suggest that you do run the Full scan.
In any case you need to remove those previously found and No action taken. - Run MBAM and this time when the scan is complete,all detections should have a check mark in the box to the left of the entry, leave them selected (or select if not selected). At the bottom of the window there is a button, Remove Selected, click that and the items will be removed.
system
April 6, 2009, 2:13am
12
Im running full scan now.
system
April 6, 2009, 4:07am
13
Wow … that is a very crapware infected computer.
Sorry, John, but please advice your mother against using such things as MyWebSearch, FunWebProducts, etc. Some others to avoid are CoolWebSearch, originalicons (AIM Buddy Icons), smileycentral, smileyworld, etc.
Please follow David’s advice.
system
April 6, 2009, 4:53pm
14
I asked her about them earlier and she said she didnt know about them. I suspect non provoked intrusion(she didnt click anything or dwnld)
system
April 6, 2009, 5:23pm
15
OH YOUR GOING TO LOVE THIS, My mom told me to install MBAM on her desktop too, it found 167 infect. with a PARTIAL quick scan. 165 adware, 2 Trojan.Vundo. I heard this one can be hard to remove(not confusing with vitro)
Please download VundoFix.exe
Double-click VundoFix.exe to run it.
Note: It is possible that VundoFix encountered a file it could not remove.
A log will be produced which you can post in your next response.
DavidR
April 6, 2009, 6:13pm
17
OH YOUR GOING TO LOVE THIS, My mom told me to install MBAM on her desktop too, it found 167 infect. with a PARTIAL quick scan. 165 adware, 2 Trojan.Vundo. I heard this one can be hard to remove(not confusing with vitro)
Vundo isn’t that hard to remove (depends on variant and if it is protected by rootkit) and MBAM does do a good job, nothing lost to try the specific tool suggested by Tech.
system
April 6, 2009, 8:58pm
18
Ok, my brothers friend had one plus malware.trace every time she deleted it with MBAM they both came back again. I caled my mom about trying vundofix it wont delete any important documents will it? And how do I find out if its protected by rootkit? Should I get a program for checking? (no conflicts right with Vundofi, Nor360, and MBAM, my mom doesnt want any damage on her computer)
DavidR
April 6, 2009, 9:31pm
19
Personally I have never used it, but vundo is a trojan and not a file infecter so important files shouldn’t get ‘infected’ vundo files normally look like they are randomly generated (they are).