[Seth~Mayvus]

Hey, first off, when I got some spy-ware problems the first time around, I managed to find most of the programs I needed on here. I managed to get rid of one of those damned Aurora infestations, as well as take care of quite a few things. I've gotta say, I like that Ewido program. However, I'm still seeing some problems. Whenever online, I'm seeing small selections of text turned into little green links, that are underlinded, and when I float the mouse over them, it implys that they are 'sponsored links'. I'm also seeing some pop-ups, despite my pop-up blockers, that come up about every other page I hit on my browser, if a little less then that. I blocked the sites associated with them, but they still pop up as blank pages, and it's really starting to piss me off that I have been unable to locate any general information pages that have been helpful.

Just wondering if someone could help me out? If so, thanks, that would be a great help. Oh, and I'll post my hijackthis log in a few minutes, after I do a system scan. I'll have that up in a jiffy.

Edit:

Logfile Removed: HJT Logfile not requested

Edited by Andy_veal, 11 May 2005 - 12:28 PM.

[Advertisements]

In order to assist you, we need to see the log from an Ad-Aware SE 1.05 full system scan.

Important Note! Before performing a scan, be sure that you have the most recent definitions file by using WebUpdate. (Click on the Globe icon, Click connect, Click OK, Click Finish.) At this current point * SE1R44 10.05.2005 * is the most recent definition file.

Ad-Aware SE comes preconfigured with default options so we need you to make only one change. Please deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat. This option can be changed when choosing your scan type.

Select "Perform Full System Scan" and press "Next". When the scan has completed, click "Show Logfile".

Please copy/paste the complete log file here using the reply button. Don't quarantine or remove anything at this time, just post a complete logfile. This sometimes takes 2-3 posts to get it all posted. You will know you are at the end when you see the "Summary of this scan" information has been posted.

When you have posted your log here, Team Lavasoft can advise on what to do next.

Please post back if you have any questions or other problems.

Good luck

Andy

[Seth~Mayvus]

Alright, here we go. A full system scan, leaving out 'negligible objects'

Ad-Aware SE Build 1.05
Logfile Created on:Wednesday, May 11, 2005 6:40:25 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R44 10.05.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
VX2(TAC index:10):2 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


5-11-2005 6:40:25 PM - Scan started. (Full System Scan)

Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]

#:2 [csrss.exe]

#:3 [winlogon.exe]

#:4 [services.exe]

#:5 [lsass.exe]

#:6 [svchost.exe]

#:7 [svchost.exe]

#:8 [svchost.exe]

#:9 [svchost.exe]

#:10 [svchost.exe]

#:11 [lexbces.exe]

#:12 [spoolsv.exe]

#:13 [lexpps.exe]

#:14 [explorer.exe]

#:15 [smax4pnp.exe]

#:16 [hkcmd.exe]

#:17 [jusched.exe]

#:18 [intelmem.exe]

#:19 [mm_tray.exe]

#:20 [mmtask.exe]

#:21 [mcagent.exe]

#:22 [realplay.exe]

#:23 [mcvsshld.exe]

#:24 [mscifapp.exe]

#:25 [aolsp scheduler.exe]

#:26 [mpftray.exe]

#:27 [dsagnt.exe]

#:28 [mskagent.exe]

#:29 [aoltray.exe]

#:30 [aolacsd.exe]

#:31 [wzqkpick.exe]

#:32 [mcvsescn.exe]

#:33 [mcvsrte.exe]

#:34 [mpfservice.exe]

#:35 [msksrvr.exe]

#:36 [mpfagent.exe]

#:37 [wdfmgr.exe]

#:38 [mcshield.exe]

#:39 [alg.exe]

#:40 [ad-aware.exe]

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0


VX2 Object Recognized!
Type : File
Data : A0002698.exe
Object : C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP21\

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 1


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 1




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

VX2 Object Recognized!
Type : RegValue
Data :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\toolbar\webbrowser
Value : {0E5CBF21-D15F-11D0-8301-00AA005B4383}

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 2

6:51:57 PM Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:11:32.93
Objects scanned:102635
Objects identified:2
Objects ignored:0
New critical objects:2


Recognize anything? I've been doing some digging on my own, and found some more info. This aurora thing has become a really big cluster[bleep].