Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Personal Internet Security 2011 (virus)


  • Please log in to reply

#1
Ariana386

Ariana386

    New Member

  • Member
  • Pip
  • 1 posts
On Dec 26th, I had my computer to automatically update (Microsoft)like it usually does... When I woke up, I could not log onto the internet--it said I had no connection, as my Firefox was using an unavailable proxy site... I do NOT use a proxy site... =( I attempted to remove the virus (using Malwarebytes), only I can now access only SOME sites on the internet.. I cannot access www.google.com (which is my Firefox start page), or my gmail account... I can still log into facebook, and my yahoo account (for NOW, anyway)... I ran a scan using Hijack This and the Malwarebyte... Here are the logs :
=====================================================================================
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:58:38 PM, on 12/27/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoo...earchTerms}&f=4
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 64.27.9.110 www.google.com
O1 - Hosts: 64.27.9.110 google.com
O1 - Hosts: 64.27.9.110 google.com.au
O1 - Hosts: 64.27.9.110 www.google.com.au
O1 - Hosts: 64.27.9.110 google.be
O1 - Hosts: 64.27.9.110 www.google.be
O1 - Hosts: 64.27.9.110 google.com.br
O1 - Hosts: 64.27.9.110 www.google.com.br
O1 - Hosts: 64.27.9.110 google.ca
O1 - Hosts: 64.27.9.110 www.google.ca
O1 - Hosts: 64.27.9.110 google.ch
O1 - Hosts: 64.27.9.110 www.google.ch
O1 - Hosts: 64.27.9.110 google.de
O1 - Hosts: 64.27.9.110 www.google.de
O1 - Hosts: 64.27.9.110 google.dk
O1 - Hosts: 64.27.9.110 www.google.dk
O1 - Hosts: 64.27.9.110 google.fr
O1 - Hosts: 64.27.9.110 www.google.fr
O1 - Hosts: 64.27.9.110 google.ie
O1 - Hosts: 64.27.9.110 www.google.ie
O1 - Hosts: 64.27.9.110 google.it
O1 - Hosts: 64.27.9.110 www.google.it
O1 - Hosts: 64.27.9.110 google.co.jp
O1 - Hosts: 64.27.9.110 www.google.co.jp
O1 - Hosts: 64.27.9.110 google.nl
O1 - Hosts: 64.27.9.110 www.google.nl
O1 - Hosts: 64.27.9.110 google.no
O1 - Hosts: 64.27.9.110 www.google.no
O1 - Hosts: 64.27.9.110 google.co.nz
O1 - Hosts: 64.27.9.110 www.google.co.nz
O1 - Hosts: 64.27.9.110 google.pl
O1 - Hosts: 64.27.9.110 www.google.pl
O1 - Hosts: 64.27.9.110 google.se
O1 - Hosts: 64.27.9.110 www.google.se
O1 - Hosts: 64.27.9.110 google.co.uk
O1 - Hosts: 64.27.9.110 www.google.co.uk
O1 - Hosts: 64.27.9.110 google.co.za
O1 - Hosts: 64.27.9.110 www.google.co.za
O1 - Hosts: 64.27.9.110 www.google-analytics.com
O1 - Hosts: 64.27.9.110 www.bing.com
O1 - Hosts: 64.27.9.110 search.yahoo.com
O1 - Hosts: 64.27.9.110 www.search.yahoo.com
O1 - Hosts: 64.27.9.110 uk.search.yahoo.com
O1 - Hosts: 64.27.9.110 ca.search.yahoo.com
O1 - Hosts: 64.27.9.110 de.search.yahoo.com
O1 - Hosts: 64.27.9.110 fr.search.yahoo.com
O1 - Hosts: 64.27.9.110 au.search.yahoo.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\MITI\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1292979872156
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe

--
End of file - 6498 bytes
=====================================================================================

and this one too :

=====================================================================================
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5405

Windows 5.1.2600 Service Pack 3 (Safe Mode)
Internet Explorer 8.0.6001.18702

12/27/2010 8:47:14 PM
mbam-log-2010-12-27 (20-47-14).txt

Scan type: Full scan (C:\|E:\|)
Objects scanned: 199799
Time elapsed: 21 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

=====================================================================================

I hope that u can help me... This is very inconvenient--and that is a very CALM way of saying that....

Thanx!
=)
  • 0

Advertisements


#2
RKinner

RKinner

    Malware Expert

  • Expert
  • 23,729 posts
  • MVP
We don't use HJT anymore so I'm not sure if this will work but try running HJT, Scan Only and then check these lines:

O1 - Hosts: 74.125.45.100 4-open-davinci.com
O1 - Hosts: 74.125.45.100 securitysoftwarepayments.com
O1 - Hosts: 74.125.45.100 privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 secure.privatesecuredpayments.com
O1 - Hosts: 74.125.45.100 getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getantivirusplusnow.com
O1 - Hosts: 74.125.45.100 www.secure-plus-payments.com
O1 - Hosts: 74.125.45.100 www.getavplusnow.com
O1 - Hosts: 74.125.45.100 safebrowsing-cache.google.com
O1 - Hosts: 74.125.45.100 urs.microsoft.com
O1 - Hosts: 74.125.45.100 www.securesoftwarebill.com
O1 - Hosts: 74.125.45.100 secure.paysecuresystem.com
O1 - Hosts: 74.125.45.100 paysoftbillsolution.com
O1 - Hosts: 74.125.45.100 protected.maxisoftwaremart.com
O1 - Hosts: 64.27.9.110 www.google.com
O1 - Hosts: 64.27.9.110 google.com
O1 - Hosts: 64.27.9.110 google.com.au
O1 - Hosts: 64.27.9.110 www.google.com.au
O1 - Hosts: 64.27.9.110 google.be
O1 - Hosts: 64.27.9.110 www.google.be
O1 - Hosts: 64.27.9.110 google.com.br
O1 - Hosts: 64.27.9.110 www.google.com.br
O1 - Hosts: 64.27.9.110 google.ca
O1 - Hosts: 64.27.9.110 www.google.ca
O1 - Hosts: 64.27.9.110 google.ch
O1 - Hosts: 64.27.9.110 www.google.ch
O1 - Hosts: 64.27.9.110 google.de
O1 - Hosts: 64.27.9.110 www.google.de
O1 - Hosts: 64.27.9.110 google.dk
O1 - Hosts: 64.27.9.110 www.google.dk
O1 - Hosts: 64.27.9.110 google.fr
O1 - Hosts: 64.27.9.110 www.google.fr
O1 - Hosts: 64.27.9.110 google.ie
O1 - Hosts: 64.27.9.110 www.google.ie
O1 - Hosts: 64.27.9.110 google.it
O1 - Hosts: 64.27.9.110 www.google.it
O1 - Hosts: 64.27.9.110 google.co.jp
O1 - Hosts: 64.27.9.110 www.google.co.jp
O1 - Hosts: 64.27.9.110 google.nl
O1 - Hosts: 64.27.9.110 www.google.nl
O1 - Hosts: 64.27.9.110 google.no
O1 - Hosts: 64.27.9.110 www.google.no
O1 - Hosts: 64.27.9.110 google.co.nz
O1 - Hosts: 64.27.9.110 www.google.co.nz
O1 - Hosts: 64.27.9.110 google.pl
O1 - Hosts: 64.27.9.110 www.google.pl
O1 - Hosts: 64.27.9.110 google.se
O1 - Hosts: 64.27.9.110 www.google.se
O1 - Hosts: 64.27.9.110 google.co.uk
O1 - Hosts: 64.27.9.110 www.google.co.uk
O1 - Hosts: 64.27.9.110 google.co.za
O1 - Hosts: 64.27.9.110 www.google.co.za
O1 - Hosts: 64.27.9.110 www.google-analytics.com
O1 - Hosts: 64.27.9.110 www.bing.com
O1 - Hosts: 64.27.9.110 search.yahoo.com
O1 - Hosts: 64.27.9.110 www.search.yahoo.com
O1 - Hosts: 64.27.9.110 uk.search.yahoo.com
O1 - Hosts: 64.27.9.110 ca.search.yahoo.com
O1 - Hosts: 64.27.9.110 de.search.yahoo.com
O1 - Hosts: 64.27.9.110 fr.search.yahoo.com
O1 - Hosts: 64.27.9.110 au.search.yahoo.com

Then hit Fix Checked.

If HJT knows what it is doing that should fix your problem. Would be best if you would run OTL and post both logs as per our instructions at the top of this forum.

http://www.geekstogo...cleaning-guide/

Ron
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP