Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Internet Explorer - Search Engine Hijacker


  • This topic is locked This topic is locked
18 replies to this topic

#1 coachrogers44

coachrogers44

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 24 September 2009 - 09:43 PM

My problem appears to be an internet explorer browser or search engine hijacker. When I try to link to a searched item, my browser is hijacked and takes me to whatever sight it wants to. If I click the back arrow immediately clinking the link, it will prevent the hijack. After that, I can click the link again and it will navigate to the appropriate site. The following is a copy of my dds.txt file:


DDS (Ver_09-07-30.01) - NTFSx86
Run by Steve at 20:48:13.64 on Thu 09/24/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.382.107 [GMT -6:00]


============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Garmin\ANT Agent\ANT Agent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\HP\hpcoretech\comp\hptskmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Steve\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_en
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: MSN Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: MSN Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.1125.0\msneshellx.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {D7F30B62-8269-41AF-9539-B2697FA7D77E} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
uRun: [ANT Agent] c:\garmin\ant agent\ANT Agent.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [<NO NAME>]
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [hpWirelessAssistant] c:\program files\hpq\hp wireless assistant\HP Wireless Assistant.exe
mRun: [SynTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [eabconfg.cpl] c:\program files\hpq\quick launch buttons\EabServr.exe /Start
mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd.exe"
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [DeviceDiscovery] c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
mRun: [Bart Station] c:\program files\isp50\hta\station.sbrt
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [sysldtray] c:\windows\ld12.exe
mRun: [vptray] c:\progra~1\symant~1\symant~1\vptray.exe
mRun: [<NO NAME>]
uPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
uPolicies-system: EnableProfileQuota = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: microsoft.com\office
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-8-7 64160]
R2 NAVAPEL;NAVAPEL;c:\program files\symantec_client_security\symantec antivirus\Navapel.sys [2003-8-11 30208]
R2 Norton AntiVirus Server;Symantec AntiVirus Client;c:\progra~1\symant~1\symant~1\Rtvscan.exe [2003-10-7 647168]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R3 HSFHWATI;HSFHWATI;c:\windows\system32\drivers\HSFHWATI.sys [2004-12-15 200192]
R3 NAVAP;NAVAP;c:\progra~1\symant~1\symant~1\NAVAP.sys [2003-8-11 224768]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090918.003\NAVENG.sys [2009-9-18 84912]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090918.003\NAVEX15.sys [2009-9-18 1323568]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456]

=============== Created Last 30 ================

2009-09-17 20:45 <DIR> --d----- c:\program files\QUAD Utilities
2009-09-17 20:33 42,809 a------- c:\windows\system32\key01.sys
2009-09-17 20:33 42,809 a------- c:\windows\system32\dllcache\key01.sys
2009-09-17 20:33 4,608 a------- c:\windows\system32\dllhst3g.exe
2009-09-17 20:33 4,608 a------- c:\windows\system32\dllcache\dllhst3g.exe
2009-09-17 20:32 29,056 a------- c:\windows\system32\drivers\ip6fw.sys
2009-09-17 20:32 29,056 a------- c:\windows\system32\dllcache\ip6fw.sys
2009-09-17 20:32 1,423 -------- c:\windows\fix.lnk
2009-09-17 20:29 <DIR> --d----- c:\program files\Fedmich
2009-09-10 20:04 <DIR> --d----- c:\program files\HJT
2009-09-08 21:40 <DIR> --d----- c:\documents and settings\steve\Tracing
2009-09-08 21:37 <DIR> --d----- c:\program files\Windows Live SkyDrive
2009-09-08 21:31 <DIR> --d----- c:\program files\common files\Windows Live
2009-09-06 20:38 <DIR> --d----- c:\windows\network diagnostic
2009-09-06 20:38 380,928 -------- c:\windows\system32\dllcache\ieapfltr.dll
2009-09-06 20:38 63,488 -------- c:\windows\system32\dllcache\icardie.dll
2009-09-06 20:38 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-09-06 20:38 2,452,872 -------- c:\windows\system32\dllcache\ieapfltr.dat
2009-09-06 20:38 991,232 -------- c:\windows\system32\dllcache\ieframe.dll.mui
2009-08-30 22:18 155,648 a------- c:\windows\system32\JavaAccessBridge.dll
2009-08-30 22:18 81,920 a------- c:\windows\system32\WindowsAccessBridge.dll
2009-08-30 22:18 32,768 a------- c:\windows\system32\JAWTAccessBridge.dll
2009-08-30 22:01 <DIR> --d----- c:\program files\SkillSoft
2009-08-30 21:13 <DIR> --d----- c:\program files\Microsoft
2009-08-30 21:11 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-30 21:11 73,728 a------- c:\windows\system32\javacpl.cpl
2009-08-26 20:52 0 a------- c:\windows\VPC32.INI
2009-08-26 20:48 124,167 a------- c:\windows\system32\SYMEVNT.386
2009-08-26 20:48 83,208 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-26 20:48 73,496 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-26 20:48 <DIR> --d----- c:\program files\Symantec
2009-08-26 20:48 <DIR> --d----- C:\VirDefs
2009-08-26 20:48 <DIR> --d----- C:\Support
2009-08-26 20:48 <DIR> --d----- C:\SevInst
2009-08-26 20:48 <DIR> --d----- c:\program files\Symantec_Client_Security
2009-08-26 20:48 <DIR> --d----- C:\LiveUpdt
2009-08-26 20:48 <DIR> --d----- C:\Data

==================== Find3M ====================

2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll
2009-07-19 19:03 3,597,824 -------- c:\windows\system32\dllcache\mshtml.dll
2009-07-19 18:48 11,067,392 -------- c:\windows\system32\dllcache\ieframe.dll
2009-07-03 11:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 11:09 594,432 -------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 11:09 55,296 -------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 11:09 1,985,536 -------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 11:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 08:49 15,688 a------- c:\windows\system32\lsdelete.exe
2009-07-01 01:08 101,376 -------- c:\windows\system32\dllcache\iecompat.dll
2009-06-29 05:07 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-29 02:35 634,632 -------- c:\windows\system32\dllcache\iexplore.exe
2009-06-29 02:33 161,792 -------- c:\windows\system32\dllcache\ieakui.dll

============= FINISH: 20:48:36.70 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 11 October 2009 - 06:02 PM

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

Pleaseinclude a clear description of the problems you're having, along with any steps you may have performed so far.

Please refrain from running tools or applying updates other than those we suggest while we are cleaning up your computer. The reason for this is so we know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.

Even if you have already provided information about your PC, we need a new log to see what has changed since you originally posted your problem.
  • Please download OTL from following mirror:
  • Save it to your desktop.
  • Double click on the Posted Image icon on your desktop.
  • Click the "Scan All Users" checkbox.
  • Push the Posted Image button.
  • Two reports will open, copy and paste them in a reply here:
    • OTL.txt <-- Will be opened
    • Extra.txt <-- Will be minimized
In the upper right hand corner of the topic you will see a button called Options. If you click on this in the drop-down menu you can choose Track this topic. I suggest you do this and select Immediate E-Mail notification and click on Proceed. This way you will be advised when we respond to your topic and facilitate the cleaning of your machine.

After 5 days if a topic is not replied to we assume it has been abandoned and it is closed.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#3 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 12 October 2009 - 07:30 AM

This is a reply to your message telling me to run OTL.exe. I've attached the OTL.Txt and Extras.Txt files.

Attached Files



#4 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 12 October 2009 - 09:21 AM

Hi,

Please run rootrepeal:
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract the contents of RootRepeal.zip, to your desktop.
  • Double click Posted Image on your desktop.
  • Click on the report tab, then click scan
  • Check all seven boxes:
    Drivers
    Files
    Processes
    SSDT
    Stealth Objects
    Hidden Services
    Shadow SSDT
  • Click Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, Click the Save Report button. Save the log as RootRepeal.txt and post it in your next reply.
Please also run Malwarebytes:
Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
If you have a previous version of MBAM, remove it via Add/Remove Programs and download a fresh copy.
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.


Could you give me an example of a link to which you get redirected?

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#5 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 12 October 2009 - 10:28 PM

The MalwareBytes Anti Virus download and run seemed to take care of the problem. The mbam.exe would not execute. I changed the name and tried to execute it and it worked. It identified 24 items that I deleted. All the files would not delete immediately but the program instructed me to restart my computer. When I restarted my computer, the problem seemed to be fixed. I am attaching the RootRepeal.txt file as requested for your review to see if there is anything that might cause a recurrence.

Attached Files



#6 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 14 October 2009 - 04:55 AM

Hi,

please provide the Malwarebytes Anti-Malware log. You can find the log if you start the program, select the tab "Logs" and doubleclick the log with the date of your scan.

regards temp

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#7 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 14 October 2009 - 09:29 PM

Attached is the Malware log as requested

Attached Files



#8 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 15 October 2009 - 04:14 AM

Hi,

this doesn't look to bad. We're on the right track. :(

How is your PC behaving?

Please create a new log with OTL and post in your next reply. (Only OTL.txt will be created)

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#9 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 15 October 2009 - 05:17 PM

The computer is acting perfect again. It has been working so well that I deleted OTL and the other downloads required. I am considering the computer back in perfect working condition and you can close this request. Thanks so much. It was very frustrating having the computer hijacked every time I searched for something and then tried to link to it.
Steve

#10 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 16 October 2009 - 06:37 AM

Hi,

while I'm glad to hear, that your PC is behaving normally again, we are not done yet. :( I would like to check the logs once more and make sure that your PC is protected. Please stay with me and post the OTL log.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#11 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 17 October 2009 - 10:47 AM

The OTL.txt file is attached. When I ran OTL, I could not find an "extras.txt" file like I did the first time when I ran it. I'm not sure why. Anyway, thanks again for the help. Let me know if you find anything interesting in the OTL.txt file.

Attached Files

  • Attached File  OTL.Txt   66.33KB   2 downloads


#12 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 18 October 2009 - 10:58 AM

Hi,

sorry, I should have mentioned, that only the otl.txt will be created. The log looks good. :(

Just to be safe, I would like to ask you, to run an online scan:

I'd like us to scan your machine with ESET OnlineScan
  • Hold down Control and click on the following link to open ESET OnlineScan in a new window.
    ESET OnlineScan
  • Click the Posted Image button.
  • For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
    • Click on Posted Image to download the ESET Smart Installer. Save it to your desktop.
    • Double click on the Posted Image icon on your desktop.
  • Check Posted Image
  • Click the Posted Image button.
  • Accept any security warnings from your browser.
  • Check Posted Image
  • Push the Start button.
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push Posted Image
  • Push Posted Image, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • Push the Posted Image button.
  • Push Posted Image
regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#13 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 19 October 2009 - 06:00 AM

Attached is the ESET scan text file. I did not turn on "Scan Archives" on the first scan. The first scan discovered a couple infected files. After I realized I was supposed to have the "Scan Archives" checkbox selected, I conducted another scan and no infected files were found.

Attached Files



#14 myrti

myrti

    Sillyberry


  • Malware Study Hall Admin
  • 33,772 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:At home
  • Local time:03:03 PM

Posted 19 October 2009 - 08:55 AM

Hi,

I believe that your logs are clean now. :( So lets focus on making your PC more secure. You have a couple of outdated software on your PC, that we need to update:
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:
  • Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  • Look for "Java Runtime Environment (JRE)" JRE 6 Update 16.
  • Click the Download button to the right.
  • Select your Platform: "Windows".
  • Select your Language: "Multi-language".
  • Read the License Agreement, and then check the box that says: "Accept License Agreement".
  • Click Continue and the page will refresh.
  • Under Required Files, check the box for Windows Offline Installation, click the link below it and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version.
-- If using Windows Vista and the installer refuses to launch due to insufficient user permissions, then Run As Administrator.
-- If you choose to update via the Java applet in Control Panel, uncheck the option to install the Toolbar unless you want it.
-- The uninstaller incorporated in this release removes previous Updates 10 and above, but does not remove older versions, so they still need to be removed manually.


Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click Ok and reboot your computer.

Your Adobe Reader is also out of date. Please uninstall it and download the latest version from Adobe: Download
Please untick all proposed toolbars unless you really want them.

Please post back another OTL log after updating.

regards _temp_

is that a bird?  a plane? nooo it's the flying blueberry!

If I have been helping you and haven't replied in 2 days, feel free to shoot me a PM! Please don't send help request via PM, unless I am already helping you. Use the forums!

 

Follow BleepingComputer on: Facebook | Twitter | Google+


#15 coachrogers44

coachrogers44
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Local time:07:03 AM

Posted 19 October 2009 - 08:19 PM

Everything is working great. I updated JAVA and Adobe. Attached is the OTL.txt file

Attached Files

  • Attached File  OTL.Txt   68.43KB   1 downloads





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users