Avast finds this file C:\WINDOWS\pxapft.ysh, and I keep deleting but it keeps coming back. I ran a highjackthis scan and here are the results.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
continued…
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://favorites.live.com/quickadd.aspx Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab http://download.paltalk.com/wcloader_prod/wcloader.cab http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237860559968 https://webdl.symantec.com/activex/symdlmgr.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237860549515 http://zone.msn.com/bingame/zpagames/zpa_dmno.cab42341.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
–
Thanks
c:\716f67f39dc0c52947af\update\iesetup.exe is a strange entry, can you find iesetup.exe, and send it to virustotal http://www.virustotal.com/ Then post the results
If it keeps coming back, there is likely to be an undetected or hidden element to the infection that restores or downloads the file again. What is your firewall ?
If you haven’t already got this software (freeware), download, install, update and run it and report the findings (it should product a log file).
I have a hardware firewall and I’ve been using CA security for the last year or so but I just switched to Avast in the last week. I downloaded the Anti-Malware and it found 6 infections and it fixed them but Avast still finds that infected file.
c:\716f67f39dc0c52947af\update\iesetup.exe
Can I remove this with anti-malware?
Hi jh3421,
Check and fix with HJT this: O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) as part of Windupdates adware.
iesetup.exe is a reported threat to your computer. Scan your system as soon as possible with a av solution or an anti-malware scanner like SAS, MBAM.
Classification Adware
Part of Adware.W32.Windupdates
Developed by windupdates.com
Harmful software last update of information 2009-03-20 16:54:02
Further information
. Adware launches pop-ups with ads onto your OS, or will change your standard homepage or will redirect your search-engine result pages to a fraudulent site. The extra traffic will also slow down your system and Internet connection. Run SAS to be downloaded from here: http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE http://www.atribune.org/ccount/click.php?id=4 and run,http://www.java.com/download
Run the scanners and give us the logfile txts and then also run a fresh hjt logfile txt and attach these where it says additional options,
polonus (malware fighter)
Please post the log file as suggested run MBAM again and click the Log tab and copy and paste of attach the log file, as this gives us an idea what was found and may help with another course of action.
I would suggest that you also download the second application and run that too, posting the results, don’t worry about tracking cookies, a very minor issue, but let SAS deal with them.
system
May 16, 2009, 8:39pm
10
I downloaded and installed Comodo internet security and it found one infected file. I ran avast again and it didn’t find any viruses. The infected file it kept finding is now gone. Here is the latest log file.
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
system
May 16, 2009, 8:40pm
11
continued…
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://favorites.live.com/quickadd.aspx Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll@xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exehttp://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab http://download.paltalk.com/wcloader_prod/wcloader.cab http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1237860559968 https://webdl.symantec.com/activex/symdlmgr.cab http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1237860549515 http://zone.msn.com/bingame/zpagames/zpa_dmno.cab42341.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
–