Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Personal Internet Security 2011 (virus)

Started by Ariana386 , Dec 27 2010 08:19 PM

  • Please log in to reply

#1
Ariana386
Posted 27 December 2010 - 08:19 PM

Ariana386

    New Member

  • Member
  • Pip
  • 1 posts
On Dec 26th, I had my computer to automatically update (Microsoft)like it usually does... When I woke up, I could not log onto the internet--it said I had no connection, as my Firefox was using an unavailable proxy site... I do NOT use a proxy site... =( I attempted to remove the virus (using Malwarebytes), only I can now access only SOME sites on the internet.. I cannot access www.google.com (which is my Firefox start page), or my gmail account... I can still log into facebook, and my yahoo account (for NOW, anyway)... I ran a scan using Hijack This and the Malwarebyte... Here are the logs :
=====================================================================================
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:58:38 PM, on 12/27/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoo...earchTerms}&f=4
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 64.27.9.110 www.google.com
O1 - Hosts: 64.27.9.110 google.com
O1 - Hosts: 64.27.9.110 google.com.au
O1 - Hosts: 64.27.9.110 www.google.com.au
O1 - Hosts: 64.27.9.110 google.be
O1 - Hosts: 64.27.9.110 www.google.be
O1 - Hosts: 64.27.9.110 google.com.br
O1 - Hosts: 64.27.9.110 www.google.com.br
O1 - Hosts: 64.27.9.110 google.ca
O1 - Hosts: 64.27.9.110 www.google.ca
O1 - Hosts: 64.27.9.110 google.ch
O1 - Hosts: 64.27.9.110 www.google.ch
O1 - Hosts: 64.27.9.110 google.de
O1 - Hosts: 64.27.9.110 www.google.de
O1 - Hosts: 64.27.9.110 google.dk
O1 - Hosts: 64.27.9.110 www.google.dk
O1 - Hosts: 64.27.9.110 google.fr
O1 - Hosts: 64.27.9.110 www.google.fr
O1 - Hosts: 64.27.9.110 google.ie
O1 - Hosts: 64.27.9.110 www.google.ie
O1 - Hosts: 64.27.9.110 google.it
O1 - Hosts: 64.27.9.110 www.google.it
O1 - Hosts: 64.27.9.110 google.co.jp
O1 - Hosts: 64.27.9.110 www.google.co.jp
O1 - Hosts: 64.27.9.110 google.nl
O1 - Hosts: 64.27.9.110 www.google.nl
O1 - Hosts: 64.27.9.110 google.no
O1 - Hosts: 64.27.9.110 www.google.no
O1 - Hosts: 64.27.9.110 google.co.nz
O1 - Hosts: 64.27.9.110 www.google.co.nz
O1 - Hosts: 64.27.9.110 google.pl
O1 - Hosts: 64.27.9.110 www.google.pl
O1 - Hosts: 64.27.9.110 google.se
O1 - Hosts: 64.27.9.110 www.google.se
O1 - Hosts: 64.27.9.110 google.co.uk
O1 - Hosts: 64.27.9.110 www.google.co.uk
O1 - Hosts: 64.27.9.110 google.co.za
O1 - Hosts: 64.27.9.110 www.google.co.za
O1 - Hosts: 64.27.9.110 www.google-analytics.com
O1 - Hosts: 64.27.9.110 www.bing.com
O1 - Hosts: 64.27.9.110 search.yahoo.com
O1 - Hosts: 64.27.9.110 www.search.yahoo.com
O1 - Hosts: 64.27.9.110 uk.search.yahoo.com
O1 - Hosts: 64.27.9.110 ca.search.yahoo.com
O1 - Hosts: 64.27.9.110 de.search.yahoo.com
O1 - Hosts: 64.27.9.110 fr.search.yahoo.com
O1 - Hosts: 64.27.9.110 au.search.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\MITI\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1292979872156
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

--
End of file - 6498 bytes
=====================================================================================

and this one too :

=====================================================================================
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5405

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

12/27/2010 8:47:14 PM
mbam-log-2010-12-27 (20-47-14).txt

Scan type: Full scan (C:\|E:\|)
Objects scanned: 199799
Time elapsed: 21 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

=====================================================================================

I hope that u can help me... This is very inconvenient--and that is a very CALM way of saying that....

Thanx!
=)
  • 0

Advertisements

#2
RKinner
Posted 28 December 2010 - 08:39 AM

RKinner

    Malware Expert

  • Expert
  • 24,625 posts
  • MVP
We don't use HJT anymore so I'm not sure if this will work but try running HJT, Scan Only and then check these lines:

O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 64.27.9.110 www.google.com
O1 - Hosts: 64.27.9.110 google.com
O1 - Hosts: 64.27.9.110 google.com.au
O1 - Hosts: 64.27.9.110 www.google.com.au
O1 - Hosts: 64.27.9.110 google.be
O1 - Hosts: 64.27.9.110 www.google.be
O1 - Hosts: 64.27.9.110 google.com.br
O1 - Hosts: 64.27.9.110 www.google.com.br
O1 - Hosts: 64.27.9.110 google.ca
O1 - Hosts: 64.27.9.110 www.google.ca
O1 - Hosts: 64.27.9.110 google.ch
O1 - Hosts: 64.27.9.110 www.google.ch
O1 - Hosts: 64.27.9.110 google.de
O1 - Hosts: 64.27.9.110 www.google.de
O1 - Hosts: 64.27.9.110 google.dk
O1 - Hosts: 64.27.9.110 www.google.dk
O1 - Hosts: 64.27.9.110 google.fr
O1 - Hosts: 64.27.9.110 www.google.fr
O1 - Hosts: 64.27.9.110 google.ie
O1 - Hosts: 64.27.9.110 www.google.ie
O1 - Hosts: 64.27.9.110 google.it
O1 - Hosts: 64.27.9.110 www.google.it
O1 - Hosts: 64.27.9.110 google.co.jp
O1 - Hosts: 64.27.9.110 www.google.co.jp
O1 - Hosts: 64.27.9.110 google.nl
O1 - Hosts: 64.27.9.110 www.google.nl
O1 - Hosts: 64.27.9.110 google.no
O1 - Hosts: 64.27.9.110 www.google.no
O1 - Hosts: 64.27.9.110 google.co.nz
O1 - Hosts: 64.27.9.110 www.google.co.nz
O1 - Hosts: 64.27.9.110 google.pl
O1 - Hosts: 64.27.9.110 www.google.pl
O1 - Hosts: 64.27.9.110 google.se
O1 - Hosts: 64.27.9.110 www.google.se
O1 - Hosts: 64.27.9.110 google.co.uk
O1 - Hosts: 64.27.9.110 www.google.co.uk
O1 - Hosts: 64.27.9.110 google.co.za
O1 - Hosts: 64.27.9.110 www.google.co.za
O1 - Hosts: 64.27.9.110 www.google-analytics.com
O1 - Hosts: 64.27.9.110 www.bing.com
O1 - Hosts: 64.27.9.110 search.yahoo.com
O1 - Hosts: 64.27.9.110 www.search.yahoo.com
O1 - Hosts: 64.27.9.110 uk.search.yahoo.com
O1 - Hosts: 64.27.9.110 ca.search.yahoo.com
O1 - Hosts: 64.27.9.110 de.search.yahoo.com
O1 - Hosts: 64.27.9.110 fr.search.yahoo.com
O1 - Hosts: 64.27.9.110 au.search.yahoo.com

Then hit Fix Checked.

If HJT knows what it is doing that should fix your problem. Would be best if you would run OTL and post both logs as per our instructions at the top of this forum.

http://www.geekstogo...cleaning-guide/

Ron
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP