Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Webtracer


  • Please log in to reply

#1
Tguarinos

Tguarinos

    New Member

  • Member
  • Pip
  • 2 posts
Hi! I got infected by Webtracer and cannot get rid of it. It has hidden my Google toolbar, filled my Favorites folder with [bleep] Urls and redirects me to a different home page. I followed your instructions, ran Ad-Aware, CWShredder, TDS-3, Spybot (which found the files but couldn't fix them), and Hijack This. Couldn't download Windows Update, though, don't know why. Same thing happened with Panda Activescan. Here are my Hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 15:42:34, on 22/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\PaSSrv.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\Firewall\PavFires.exe
C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\pavsrv51.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\PsImSvc.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\AVENGINE.EXE
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\apvxdwin.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\SRVLOAD.EXE
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\WebProxy.exe
C:\Documents and Settings\Administrador\Mis documentos\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?iiehf
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?iiehf
O1 - Hosts: 1159680172 auto.search.msn.com
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Backward Links - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Similar Pages - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Referencia (HKLM)
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E9A16DAC-7669-4628-BC4C-D4FEFEB7086A}: NameServer = 195.235.113.3 195.235.96.90
O19 - User stylesheet: C:\WINDOWS\stsheets.dat

...and my find log:

C:\WINDOWS\SYSTEM32\DRIVERS\
ndisu.sys Thu 29 Aug 2002 8:09:26 A.... 31.744 31,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 31.744 bytes 31,00 K

Thank you in advance for your help
  • 0

Advertisements


#2
Tguarinos

Tguarinos

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
OK. Got it solved. Thank you anyway.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP