Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Spanner Needs Help!


  • Please log in to reply
1 reply to this topic

#1 SpannerITWKS

SpannerITWKS

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:09:43 AM

Posted 11 March 2006 - 11:58 AM

Please help I have adware on my computer but scans with ad-aware, spybot, ewido , spydoctor, windows defender and spycatcher cannot detect it. Also did online scans with Panda, KAV, Trend.

The popups are driving me nuts!

Logfile of HijackThis v1.99.1
Scan saved at 12:52:06 AM, on 3/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\security\firewall\srvany.exe
c:\security\firewall\fwsrv.exe
C:\WINDOWS\System32\SnoopFreeSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SnoopFreeUI.exe
C:\wincmd\Wincmd32.exe
C:\Firefox\Firefox\firefox.exe
c:\Antispyware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = ftp=127.0.0.1:8080;gopher=127.0.0.1:8080;http=127.0.0.1:8080;https=127.0.0.1:8080;socks=127.0.0.1:9050
O2 - BHO: (no name) - AutorunsDisabled - (no file)
O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - c:\Security\ANTISP~1\SPYWAR~2\tools\iesdsg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - c:\Security\ANTISP~1\SPYWAR~2\tools\iesdpb.dll
O4 - HKLM\..\Run: [SpyCatcher Reminder] "c:\Antispyware\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - Startup: Scheduler.lnk = C:\Antispyware\SpyCatcher 2006\Scheduler daemon.exe
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - c:\ANTISP~1\SPYWAR~2\tools\iesdpb.dll
O15 - Trusted Zone: http://www3.ca.com (HKLM)
O15 - Trusted Zone: http://support.f-secure.com (HKLM)
O15 - Trusted Zone: http://www.kaspersky.com (HKLM)
O15 - Trusted Zone: http://safety.live.com (HKLM)
O15 - Trusted Zone: http://www.pandasoftware.com (HKLM)
O15 - Trusted Zone: http://security.symantec.com (HKLM)
O15 - Trusted Zone: http://housecall.trendmicro.com (HKLM)
O15 - Trusted Zone: http://*.trendmicro.com (HKLM)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (CwlscInstall Object) - https://scan.safety.live.com/resource/downl...lscbase2213.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1123645019156
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} (Java Plug-in) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{2B8961BD-C3D7-4E36-A63A-5D7BF9E0813D}: NameServer = 127.0.0.1
O20 - AppInit_DLLs: Interceptor.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir Scheduler (AntiVirScheduler) - H+BEDV Datentechnik GmbH - C:\Security\Antivirus\Antivir\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: jetico - Unknown owner - c:\firewall\jetico\srvany.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

BC AdBot (Login to Remove)

 


#2 OldTimer

OldTimer

    Malware Expert


  • Members
  • 11,092 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:North Carolina
  • Local time:10:43 AM

Posted 12 March 2006 - 08:58 PM

Hello SpannerITWKS and welcome to the BC HijackThis forum. I see no signs of viruses or malware in the log. It is clean. What specifc issues are you having that point to spyware at this time?

There are a couple of cleanup items that are missing files so let's take care of those while you are here.

Start HijackThis and click the Scan button to perform a scan. Look for the following items and click in the checkbox in front of each item to select it:O2 - BHO: (no name) - AutorunsDisabled - (no file)
O16 - DPF: {CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA} (Java Plug-in) -

Now close ALL open windows except HijackThis and click the Fix Checked button to finish the repair.

Other than that everything looks fine.

Cheers.

OT
I do not respond to PM's requesting help. That's what the forums are here for. Please use them so that others may benefit from your questions and the responses you receive.
OldTimer

Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users