Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Help! Cannot Access Many Webpages....


  • Please log in to reply
1 reply to this topic

#1 damn_computer

damn_computer

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:01:05 AM

Posted 25 April 2007 - 08:46 AM

I download a lot from isohunt.com. i recently formatted my hdd and reinstalled windows xp media center edition. Whenever i try to access isohunt.com, a website called www.regeringen.se comes up. IVE TRIED ADAWARE SE, AVG, AND SPYBOT S&D TO NO AVAIL. pLEASE HELP. here is my hijackthis log. Please any suggestions will help. Thank you.

//Mod edit to remove email address to protect from spam bots.//






Logfile of HijackThis v1.99.1
Scan saved at 9:14:57 AM, on 4/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...n&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O1 - Hosts: 81.216.70.132 www.msn.no
O1 - Hosts: 81.216.70.132 www.msn.se
O1 - Hosts: 81.216.70.132 www.msn.co.uk
O1 - Hosts: 81.216.70.132 www.msn.de
O1 - Hosts: 81.216.70.132 www.msn.dk
O1 - Hosts: 81.216.70.132 se.msn.com
O1 - Hosts: 81.216.70.132 no.msn.com
O1 - Hosts: 81.216.70.132 dk.msn.com
O1 - Hosts: 81.216.70.132 de.msn.com
O1 - Hosts: 81.216.70.132 uk.msn.com
O1 - Hosts: 81.216.70.132 msn.no
O1 - Hosts: 81.216.70.132 msn.se
O1 - Hosts: 81.216.70.132 msn.co.uk
O1 - Hosts: 81.216.70.132 msn.de
O1 - Hosts: 81.216.70.132 msn.dk
O1 - Hosts: 81.216.70.132 www.altavista.com
O1 - Hosts: 81.216.70.132 www.altavista.no
O1 - Hosts: 81.216.70.132 www.altavista.se
O1 - Hosts: 81.216.70.132 www.altavista.dk
O1 - Hosts: 81.216.70.132 www.altavista.de
O1 - Hosts: 81.216.70.132 www.altavista.co.uk
O1 - Hosts: 81.216.70.132 altavista.com
O1 - Hosts: 81.216.70.132 altavista.no
O1 - Hosts: 81.216.70.132 altavista.se
O1 - Hosts: 81.216.70.132 altavista.dk
O1 - Hosts: 81.216.70.132 altavista.de
O1 - Hosts: 81.216.70.132 altavista.co.uk
O1 - Hosts: 81.216.70.132 www.thepiratebay.com
O1 - Hosts: 81.216.70.132 www.thepiratebay.org
O1 - Hosts: 81.216.70.132 www.thepiratebay.net
O1 - Hosts: 81.216.70.132 thepiratebay.com
O1 - Hosts: 81.216.70.132 thepiratebay.org
O1 - Hosts: 81.216.70.132 thepiratebay.net
O1 - Hosts: 81.216.70.132 www.isohunt.com
O1 - Hosts: 81.216.70.132 isohunt.com
O1 - Hosts: 81.216.70.132 www.torrentreactor.net
O1 - Hosts: 81.216.70.132 www.torrentreactor.com
O1 - Hosts: 81.216.70.132 www.torrentreactor.to
O1 - Hosts: 81.216.70.132 torrentreactor.net
O1 - Hosts: 81.216.70.132 torrentreactor.com
O1 - Hosts: 81.216.70.132 torrentreactor.to
O1 - Hosts: 81.216.70.132 www.sharethefiles.com
O1 - Hosts: 81.216.70.132 sharethefiles.com
O1 - Hosts: 81.216.70.132 www.torrentazos.com
O1 - Hosts: 81.216.70.132 www.torrentbox.com
O1 - Hosts: 81.216.70.132 www.bittorrent.com
O1 - Hosts: 81.216.70.132 www.torrentspy.com
O1 - Hosts: 81.216.70.132 www.utorrent.com
O1 - Hosts: 81.216.70.132 www.download.com
O1 - Hosts: 81.216.70.132 www.arespremium.com
O1 - Hosts: 81.216.70.132 www.fixmypcsite.com
O1 - Hosts: 81.216.70.132 www.dehsoftware.com
O1 - Hosts: 81.216.70.132 www.bitcomet.com
O1 - Hosts: 81.216.70.132 www.kazaa.com
O1 - Hosts: 81.216.70.132 www.tntdownloads.com
O1 - Hosts: 81.216.70.132 www.emule-project.net
O1 - Hosts: 81.216.70.132 www.emule.com
O1 - Hosts: 81.216.70.132 www.emule.org
O1 - Hosts: 81.216.70.132 www.yahoo.net
O1 - Hosts: 81.216.70.132 www.microsoft.net
O1 - Hosts: 81.216.70.132 torrentazos.com
O1 - Hosts: 81.216.70.132 torrentbox.com
O1 - Hosts: 81.216.70.132 bittorrent.com
O1 - Hosts: 81.216.70.132 torrentspy.com
O1 - Hosts: 81.216.70.132 utorrent.com
O1 - Hosts: 81.216.70.132 download.com
O1 - Hosts: 81.216.70.132 arespremium.com
O1 - Hosts: 81.216.70.132 fixmypcsite.com
O1 - Hosts: 81.216.70.132 dehsoftware.com
O1 - Hosts: 81.216.70.132 bitcomet.com
O1 - Hosts: 81.216.70.132 kazaa.com
O1 - Hosts: 81.216.70.132 tntdownloads.com
O1 - Hosts: 81.216.70.132 emule-project.net
O1 - Hosts: 81.216.70.132 emule.com
O1 - Hosts: 81.216.70.132 emule.org
O1 - Hosts: 81.216.70.132 yahoo.net
O1 - Hosts: 81.216.70.132 microsoft.net
O1 - Hosts: 81.216.70.132 video.google.com
O1 - Hosts: 81.216.70.132 www.qx.se
O1 - Hosts: 81.216.70.132 www.tradera.com
O1 - Hosts: 81.216.70.132 www.tradera.se
O1 - Hosts: 81.216.70.132 qx.se
O1 - Hosts: 81.216.70.132 www.qx.se
O1 - Hosts: 81.216.70.132 www.qruiser.com
O1 - Hosts: 81.216.70.132 qruiser.com
O1 - Hosts: 81.216.70.132 www.qruiser.se
O1 - Hosts: 81.216.70.132 qruiser.se
O1 - Hosts: 81.216.70.132 tradera.com
O1 - Hosts: 81.216.70.132 tradera.se
O1 - Hosts: 81.216.70.132 www.gamespy.com
O1 - Hosts: 81.216.70.132 www.alexa.com
O1 - Hosts: 81.216.70.132 www.btjunkie.org
O1 - Hosts: 81.216.70.132 www.btjunkie.com
O1 - Hosts: 81.216.70.132 www.bushtorrent.com
O1 - Hosts: 81.216.70.132 www.meganova.org
O1 - Hosts: 81.216.70.132 www.mininova.org
O1 - Hosts: 81.216.70.132 www.torrentportal.com
O1 - Hosts: 81.216.70.132 www.asianload.com
O1 - Hosts: 81.216.70.132 www.tvtorrents.com
O1 - Hosts: 81.216.70.132 www.torrent-finder.com
O1 - Hosts: 81.216.70.132 www.demonoid.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Admin\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Admin\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1177377298671
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

Edited by KoanYorel, 25 April 2007 - 10:05 AM.


BC AdBot (Login to Remove)

 


#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:06:05 AM

Posted 25 April 2007 - 10:02 AM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum damn_computer :thumbsup:

Download ATF Cleaner by Atribune:
http://www.atribune.org/ccount/click.php?id=1

Double-click ATF-Cleaner.exe to run the program.
Click 'Select All' found at the bottom of the list.
Click the 'Empty Selected' button.

If you use Firefox browser, do this also:
Click Firefox at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

If you use Opera browser,do this also:
Click Opera at the top and choose 'Select All' from the list.
Click the 'Empty Selected' button.
NOTE:
If you would like to keep your saved passwords,please click 'No' at the prompt.

Click 'Exit' on the Main menu to close the program.

*************************************

Download HostsXpert 3.8:
http://www.funkytoad.com/download/HostsXpert.zip
1. Extract the zip file to your desktop or a permanent folder on your hard drive.
2. Open the folder and double-click on the Hoster.exe
3. Press "Restore Microsofts Original Hosts File"
4. Press "OK" and exit the program.

Go to:
C:\WINDOWS\System32\drivers\etc\HOSTS.
1) Right-click on the HOSTS file
2) Click Properties
3) You will see a window open,at the bottom of the window to the right of Attributes,check the box that says 'Read-only'.
4) Click Apply/OK.

*************************************

Please download DrWeb-CureIt & save it to your desktop. DO NOT perform a scan yet.

You should copy/print the following because you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE" using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows:
* Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
* Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
* Once the short scan has finished, Click Options > Change settings
* Choose the "Scan tab" and UNcheck "Heuristic analysis"
* Back at the main window, click "Select drives" (a red dot will show which drives have been chosen)
* Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
* When done, a message will be displayed at the bottom advising if any viruses were found.
* Click "Yes to all" if it asks if you want to cure/move the file.
* When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
* Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
* Save the DrWeb.csv report to your desktop.
* Exit Dr.Web Cureit when done.
* Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
* After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

Post the DrWeb.cvs report,and a new Hijackthis log into your next reply please.
Let me know how your pc is running now.
Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users