Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

z00clicker.dll -- Site Redirection In IE8 through Google


  • This topic is locked This topic is locked
2 replies to this topic

#1 loaves fishes comput

loaves fishes comput

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:58 PM

Posted 05 February 2010 - 02:57 AM

**** SOLVED BY HITMAN PRO !!!!

Redirected in Internet Explorer when searching in Google. I have tried every scan & still can not remove the hijack. It looks like " z00clicker.dll " might be the problem, but do not know where it is located. Worst virus yet.Thank you.

DDS (Ver_09-12-01.01) - NTFSx86
Run by Lynn at 1:24:27.39 on Fri 02/05/2010
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1514 [GMT -5:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
D:\Computer-Repair-Utility-Kit-V2\Virus Removal\SuperAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Lynn\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SUPERAntiSpyware] d:\computer-repair-utility-kit-v2\virus removal\superantispyware\SUPERANTISPYWARE.EXE
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: &Search
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1245257372571
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx1.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-6-17 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-6-17 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-17 108552]
R1 SASDIFSV;SASDIFSV;d:\computer-repair-utility-kit-v2\virus removal\superantispyware\SASDIFSV.SYS [2009-6-20 9968]
R1 SASKUTIL;SASKUTIL;d:\computer-repair-utility-kit-v2\virus removal\superantispyware\SASKUTIL.SYS [2009-12-18 74480]
R3 SASENUM;SASENUM;d:\computer-repair-utility-kit-v2\virus removal\superantispyware\SASENUM.SYS [2009-1-16 7408]
S4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe --> c:\progra~1\avg\avg8\avgemc.exe [?]
S4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-6-17 297752]

=============== Created Last 30 ================

2010-02-05 06:08:27 0 d-sha-r- C:\cmdcons
2010-02-05 06:06:16 98816 ----a-w- c:\windows\sed.exe
2010-02-05 06:06:16 77312 ----a-w- c:\windows\MBR.exe
2010-02-05 06:06:16 261632 ----a-w- c:\windows\PEV.exe
2010-02-05 06:06:16 161792 ----a-w- c:\windows\SWREG.exe
2010-02-05 05:37:29 0 d-sh--w- c:\documents and settings\lynn\IECompatCache
2010-02-05 05:37:02 0 d-sh--w- c:\documents and settings\lynn\PrivacIE
2010-02-05 05:36:03 0 d-sh--w- c:\documents and settings\lynn\IETldCache
2010-02-05 05:29:56 0 dc-h--w- c:\windows\ie8
2010-02-05 05:26:52 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2010-02-05 05:26:52 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2010-02-05 05:21:29 77312 ----a-w- c:\windows\system32\ztvunace26.dll
2010-02-05 05:21:29 75264 ----a-w- c:\windows\system32\unacev2.dll
2010-02-05 05:21:29 69632 ----a-w- c:\windows\system32\ztvcabinet.dll
2010-02-05 05:21:29 162304 ----a-w- c:\windows\system32\ztvunrar36.dll
2010-02-05 05:21:29 153088 ----a-w- c:\windows\system32\UNRAR3.dll
2010-02-05 05:21:27 0 d-----w- c:\program files\Trojan Remover
2010-02-05 05:21:27 0 d-----w- c:\docume~1\lynn\applic~1\Simply Super Software
2010-02-05 05:21:27 0 d-----w- c:\docume~1\alluse~1\applic~1\Simply Super Software
2010-02-05 04:52:39 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2010-02-05 03:42:09 0 d-----w- c:\windows\system32\wbem\Repository
2010-02-05 03:42:01 0 d-----w- c:\docume~1\alluse~1\applic~1\avg8
2010-02-05 03:42:01 0 d-----w- C:\$AVG8.VAULT$
2010-02-05 03:24:09 0 d-----w- C:\32788R22FWJFW(2)
2010-02-05 03:07:41 0 d-----w- c:\docume~1\lynn\applic~1\wsInspector
2010-02-05 03:05:28 0 d-----w- c:\program files\Startup Inspector for Windows
2010-02-05 02:03:37 0 d-----w- c:\docume~1\lynn\applic~1\SUPERAntiSpyware.com
2010-01-28 00:55:38 0 d-----w- c:\program files\MSECache
2010-01-28 00:05:13 0 d-----w- C:\$AVG
2010-01-28 00:04:58 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2010-01-28 00:04:46 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9

==================== Find3M ====================

2010-01-28 00:26:14 12464 ----a-w- c:\windows\system32\avgrsstx(2).dll
2010-01-07 21:07:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07:04 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

============= FINISH: 1:24:54.20 ===============

Attached Files


Edited by loaves fishes comput, 05 February 2010 - 09:10 PM.


BC AdBot (Login to Remove)

 


#2 loaves fishes comput

loaves fishes comput
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:06:58 PM

Posted 05 February 2010 - 09:09 PM

Solved by running Hitman Pro. When all others couldn't find it, this program did. (I DON"T WORK FOR THEM!). Thank you Hitman Pro. It's free for 30 days. I ran Root Repeal, ad it said I had a suspicious activity.

--Loaves fishes & computers.

#3 syler

syler

  • Malware Response Team
  • 8,150 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Warrington, UK
  • Local time:03:58 AM

Posted 12 February 2010 - 03:17 PM

Since this issue appears resolved ... this Topic is closed. Glad we could help.

If you need this topic reopened, please request this by sending me a PM
with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

unite.jpg





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users