Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Webtracer


  • Please log in to reply

#1
Tguarinos

Tguarinos

    New Member

  • Member
  • Pip
  • 2 posts
Hi! I got infected by Webtracer and cannot get rid of it. It has hidden my Google toolbar, filled my Favorites folder with [bleep] Urls and redirects me to a different home page. I followed your instructions, ran Ad-Aware, CWShredder, TDS-3, Spybot (which found the files but couldn't fix them), and Hijack This. Couldn't download Windows Update, though, don't know why. Same thing happened with Panda Activescan. Here are my Hijackthis log:

Logfile of HijackThis v1.97.7
Scan saved at 15:42:34, on 22/04/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\PaSSrv.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\Firewall\PavFires.exe
C:\Archivos de programa\Archivos comunes\Panda Software\PavShld\pavprsrv.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\pavsrv51.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\PsImSvc.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\AVENGINE.EXE
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\apvxdwin.exe
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\SRVLOAD.EXE
C:\Archivos de programa\Panda Software\Panda Platinum Internet Security\WebProxy.exe
C:\Documents and Settings\Administrador\Mis documentos\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?iiehf
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://rl.webtracer.cc/-/?iiehf
O1 - Hosts: 1159680172 auto.search.msn.com
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Backward Links - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Similar Pages - res://c:\archivos de programa\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Archivos de programa\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Referencia (HKLM)
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O10 - Unknown file in Winsock LSP: c:\archivos de programa\panda software\panda platinum internet security\pavlsp.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E9A16DAC-7669-4628-BC4C-D4FEFEB7086A}: NameServer = 195.235.113.3 195.235.96.90
O19 - User stylesheet: C:\WINDOWS\stsheets.dat

...and my find log:

C:\WINDOWS\SYSTEM32\DRIVERS\
ndisu.sys Thu 29 Aug 2002 8:09:26 A.... 31.744 31,00 K

1 item found: 1 file, 0 directories.
Total of file sizes: 31.744 bytes 31,00 K

Thank you in advance for your help
  • 0

Advertisements


#2
Tguarinos

Tguarinos

    New Member

  • Topic Starter
  • Member
  • Pip
  • 2 posts
OK. Got it solved. Thank you anyway.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP