system
July 26, 2009, 1:03pm
1
I suspect my friend’s computer may be infected as he has foolishly been without AV for one month and odd messages keep popping up on his desktop. Avast! boot time scan did not detect anything nor did Dr. Web Cureit or online scans with Kaspersky, ESET. Can someone take a look at his log and see if there is anything I need to take care of?
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop http://www.netflix.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop
system
July 26, 2009, 1:04pm
2
Wow, this is a long one, sry.http://go.microsoft.com/fwlink/?linkid=39204
–
Larc
July 26, 2009, 1:13pm
3
Nothing seems to be serious. Just a few deactivated entries & a need for an update.
b Service Pack[/b]
b Firewall[/b]
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-94BE-FD60BB9AAE29} - (no file)
NOTE: If weird things continue to persist, download, install & update Malwarebytes Antimalware . Run a scan & if possible, post the results.
system
July 26, 2009, 1:35pm
4
Thanks, I’ll do as you suggest. I am running a MBAM scan right now. Odd that Secunia didn’t pick up on the SP3 issue.
system
July 26, 2009, 3:06pm
5
Malwarebytes’ Anti-Malware 1.39
7/26/2009 10:50:45 AM
Scan type: Full Scan (C:|D:|)
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
That makes sense that SP2 is still on computer as it appears that Windows Security is disabled, and when I went on Windows Update website it said that important updates were hidden, so I had to unhide them and download SP3. Should I go ahead and remove these objects or will it cause problems with my system?
DavidR
July 26, 2009, 3:16pm
6
Yes - Run MBAM again and this time when the scan is complete, all detections should have a check mark in the box to the left of the entry, leave them selected (or select if not selected). At the bottom of the window there is a button, Remove Selected, click that and the items will be removed.
system
July 26, 2009, 3:48pm
7
Ok, taken care of. Apparently my friend’s XP firewall was disabled by this thing as well. :o Thanks you guys, you are always so helpful.
system
July 26, 2009, 9:15pm
8
Uh oh, as soon as I installed Service Pack 3 and re-booted my friend’s computer will only start in Safe Mode. It’s giving me a message that a recent hardware or software change has caused Windows to not start successfully. What should I do? I feel really bad now and hope I haven’t ruined my friend’s computer.
Larc
July 27, 2009, 9:53am
9
Uh oh, as soon as I installed Service Pack 3 and re-booted my friend’s computer will only start in Safe Mode. It’s giving me a message that a recent hardware or software change has caused Windows to not start successfully. What should I do? I feel really bad now and hope I haven’t ruined my friend’s computer.
Did SP3 install well after the system restore?
system
July 27, 2009, 10:20pm
10
I haven’t had a chance to get back to my friend’s house, but I did find out there are certain things you can do to ensure a successful install of SP3 (according to the Microsoft website ). I will let you know how things go when I try again. Thanks for your help.