system
January 31, 2005, 9:08pm
1
My avast warned me of this virus
Sign of “Win32:Exdl [Adw]” has been found in “C:\program files\alwil software\avast4\data\moved\a0015585.srg” file.
The problem is and i don’t know if they are linked is , YAhoo, msn, goggle all seem to display PORN results when i search for anything and if i put in specific names eg Avast. all i get is links to PORN and it looks slightly diffent to the usual yahoo page i will enclos a Hijack this log aswell.
Please can anyone help i am trying some of the thing from, I believe his name is eddie from other threads many thanks by the way
Please help
Logfile of HijackThis v1.99.0
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk http://www.yahoo.co.uk @C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exehttp://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab http://support.epson-europe.com/selftest/Prg/ESTPTest.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.webcamnow.com/broadcast/ActiveXWebCam.cab http://download.paltalk.com/webconftest/WcnfGroupControl.cab http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
Many thanks
Andrew
Eddy
January 31, 2005, 9:19pm
2
If you look at the folder the infection is detected in, you will see that is the ‘moved’ folder from Avast. That means you (Avast) detected a infection and moved the file there. While there the file(s) can’t do any harm and you can safely delete them from your system if you wish to do so.
I only had a quick look at your HJT log, but at first glance I see no malware. Will have a good look at it a little later on and post back the result here.
system
January 31, 2005, 9:26pm
3
many thanks
i ran spybot and search it removed several entries but i still seem to get just porn results
here i a log after running spybot
Logfile of HijackThis v1.99.0
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk http://www.yahoo.co.uk @C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exehttp://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-17.cab http://support.epson-europe.com/selftest/Prg/ESTPTest.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.webcamnow.com/broadcast/ActiveXWebCam.cab http://download.paltalk.com/webconftest/WcnfGroupControl.cab http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab
system
January 31, 2005, 9:34pm
4
This is the result from Eddy’s HijackThis analyser.
o2 - bho: (no name) - {031b6d43-cbc4-46a5-8e46-cf8b407c1a33} - (no file)http://tools.ebayimg.com/eps/wl/activex/epuwalcontrol_v1-0-3-17.cab http://support.epson-europe.com/selftest/prg/estptest.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.webcamnow.com/broadcast/activexwebcam.cab http://download.paltalk.com/webconftest/wcnfgroupcontrol.cab http://ax.phobos.apple.com.edgesuite.net/detection/itdetector.cab
Nothing found.
o4 - hklm..\run: [updreg] c:\windows\updreg.exe
–lee
Eddy
January 31, 2005, 9:48pm
5
The porn is very likely be caused by this line:
And for the results of the log analyzer, well actually it is like this:
You are using the latest version of HijackThis.
o2 - bho: (no name) - {031b6d43-cbc4-46a5-8e46-cf8b407c1a33} - (no file)http://tools.ebayimg.com/eps/wl/activex/epuwalcontrol_v1-0-3-17.cab http://support.epson-europe.com/selftest/prg/estptest.cab http://www.pandasoftware.com/activescan/as5/asinst.cab http://www.webcamnow.com/broadcast/activexwebcam.cab http://download.paltalk.com/webconftest/wcnfgroupcontrol.cab http://ax.phobos.apple.com.edgesuite.net/detection/itdetector.cab
o4 - hklm..\run: [updreg] c:\windows\updreg.exe
system
February 1, 2005, 2:01am
6
Many thanks for all of your help
I have posted below a hack this log after the changes just to check i got everything, if not please let me know otherwise i cannot thank you enough.
system
February 1, 2005, 2:01am
7
Logfile of HijackThis v1.99.0
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk http://www.yahoo.co.uk @C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe@C :\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
system
February 1, 2005, 2:04am
8
1 final question for you you said i didnt have a firewall any ggod ones you know about i used to use norton but it was crap and i couldnt quite grasp tiny firewall.
any good ones please let me know
DavidR
February 1, 2005, 2:05pm
9
Zone Alarm, Sygate, Outpost, there are lots, there have been a number of threads about firewalls a search of the forums should provide more information. Also see Links (for almost everything…)