#1
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
[Resolved] Another Browser Hijack/ AV won't update.
Avira detects 6 items but they continue to re-appear. I have my avira log as well if needed. RAM : 958 MB (52% free)SP3 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://ie.redirect.hp.com/svs/rdr?TY...ION&pf=desktop http://ie.redirect.hp.com/svs/rdr?TY...ION&pf=desktop http://www.crawler.com/search/dispat...=%s&tbid=61008 http://my.msn.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://www.crawler.com/search/ie.aspx?tb_id=61008 http://dnl.crawler.com/support/sa_cu...spx?TbId=61008 http://ie.redirect.hp.com/svs/rdr?TY...ION&pf=desktop http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.crawler.com/search/ie.aspx?tb_id=61008 http://dnl.crawler.com/support/sa_cu...spx?TbId=61008 http://ie.redirect.hp.com/svs/rdr?TY...ION&pf=desktop http://*.trymedia.com (HKLM)http://upload.facebook.com/controls/...oUploader5.cab http://www.fileplanet.com/fpdlmgr/ca..._2.3.2.100.cab http://gfx2.hotmail.com/mail/w2/resources/MSNPUpld.cab http://upload.facebook.com/controls/...toUploader.cab http://www.update.microsoft.com/micr...?1198080380562 http://web1.shutterfly.com/downloads/Uploader.cab http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab http://l.yimg.com/jh/games/popcap/zu...ploader_v6.cab http://fdl.msn.com/zone/datafiles/heartbeat.cab http://www.webmap.niu.edu/campus/ACGM/Acgm.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exeUPS "=3FTP "AD ---- C:\WINDOWSHD ---- C:\WINDOWS\infHD ---- C:\WINDOWS\$hf_mig$AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352]HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-03-08 4246016]MS Ar HID Filter Driver; C:\WINDOWS\system32\DRIVERS\arhidfltr.sys [2005-08-02 19200]PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992]Ad -Aware Service; C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe [2008-08-25 611664]
Last edited by Sharkapult; 3rd January 2009 at 14:41 .
Reason: added "d/l'd RSIT to a thumb drive" fact
Didn't find the information you thought to find?Similar Threads
#2
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
info.txt logfile of random's system information tool 1.05 2009-01-03 07:53:59Ad -Aware-->MsiExec.exe /I{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}PCI -SV92PP Soft Modem-->agrsmdelSP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}http ://www.viewpoint.com/pub/uninstallcompleted.html"JS ;.JSE;.WSF;.WSH
#3
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi SharkapultHere disable realtime protection applications this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall **NOTE - Allow ComboFix to update if prompted.
#4
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
This computer won't connect to that download link, like most other links having to do with antivirus software. I have access to another computer Monday and will be able to post the results from that scan Monday Night.
#5
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
Thank you again for your time, expertise, and patience! c:\windows\system32\winlogon.exe . . . is infected!! UPS "=3 (0x3)js : browser.startup.homepage - www.google.com js : network.proxy.type - 4http://www.gmer.net Ad -Aware\aawservice.exe
#6
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
HiAdministrator for the username, enter the password (just press Enter if no password), then run ComboFix from that account. CF can complete.
#7
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
Hi again,UPS "=3 (0x3)js : browser.startup.homepage - www.google.com js : network.proxy.type - 4http://www.gmer.net
#8
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
HiPlease go to Jotti's malware scan
Copy and paste the following file path into the "File to upload & scan" box on the top of the page: one at a timec:\documents and settings\HP_Administrator\nah_vnxr.exe
Click on the submit button
Please post the results in your next reply.
C:\mekmakerdev24 contents of the code box below and paste it into a blank Notepad , then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
File::
c:\windows\imsins.BAK
c:\windows\system32\drivers\Avg
c:\windows\system32\drivers\avgldx86.sys
c:\windows\system32\avgrsstx.dll
Folder::
c:\program files\AVG
c:\documents and settings\HP_Administrator\Application Data\AVGTOOLBAR
c:\documents and settings\All Users\Application Data\avg8
c:\documents and settings\All Users\Application Data\Trymedia
Driver::
AvgLdx86
avg8wd Please post the results from Jotti, let me know about those folders and post the new Combofix log.
#9
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
Hello,cf .datUPS "=3 (0x3)js : browser.startup.homepage - www.google.com js : network.proxy.type - 4http://www.gmer.net
#10
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hicontents of the code box below and paste it into a blank Notepad , then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
http ://www.windowsbbs.com/malware-virus-removal/80128-active-another-browser-hijack-av-wont-update.html
Suspect::[22]
c:\documents and settings\HP_Administrator\nah_log.dat
c:\documents and settings\HP_Administrator\nah_vnxr.exe
Folder::
C:\mekmakerdev24
C:\MekHangarPreview004
c:\windows\system32\drivers\Avg When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed.**With the above script, ComboFix will capture files to submit for analysis.Ensure you are connected to the internet and click OK on the message box.
A browser will open.
Simply follow the instructions to copy/paste/send the requested file.
#11
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
Sorry it took me a while, but here goes.UPS "=3 (0x3)
#12
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
------- Supplementary Scan -------js : browser.startup.homepage - www.google.com js : network.proxy.type - 4http://www.gmer.net
#13
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hicontents of the code box below and paste it into a blank Notepad , then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
RootKit::
C:\Windows\system32\drivers\TDSSpqlt.sys Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall. **NOTE - Allow ComboFix to update if prompted.
Code:
regedit /e "%userprofile%\desktop\HKLMSS.txt" "HKEY_LOCAL_MACHINE\System\Select" Please post the CF log and the contents of the HKLMSS.txt file
#14
Member
Profile: Join Date: Dec 2008
Posts: 14
Computer Experience:
Here goes:UPS "=3 (0x3)js : browser.startup.homepage - www.google.com js : network.proxy.type - 4http://www.gmer.net Ad -Aware\aawservice.exe
#15
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,496
Computer Experience:
Hi
All times are GMT +1. The time now is 01:29 .
ISCover Drop & Play System"
