[RESOLVED] Computer Problems
Results 1 to 6 of 6

Thread: [RESOLVED] Computer Problems

  1. August 11th, 2006, 05:54 PM #1
    JoshuaB
    JoshuaB is offline Virtual Med Student
    Join Date
    Jul 2006
    Posts
    7

    Resolved [RESOLVED] Computer Problems

    My computer seems to be running fine. But when i went to google and searched, it wouldnt take me to the link i clicked on. It would take to to something completely different. I ran adaware and removed all traces of anything. I did a full scan of ewido and it found something but had an error when getting rid of it. I tried in safe mode, same result. So here is my HJT log and a quick sacan log of ewido so you can see what is there.


    Logfile of HijackThis v1.99.1
    Scan saved at 5:47:49 PM, on 08/11/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\AIM+\AIM+.exe
    C:\PROGRAM FILES\AIM95\aim.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = mFire
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.4.4.3...-ob-assets.cab
    O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.3.4.6...-ob-assets.cab
    O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.4.2.3...-ob-assets.cab
    O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.5.2.3...lass-en_US.cab
    O16 - DPF: Yahoo! NHL StatTracker - http://aud4.sports.dcn.yahoo.com/java/y/nhlst8246_x.cab
    O16 - DPF: {01118400-3E00-11D2-8470-0060089874ED} (SdcNetCheckCtl Class) - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-48.cab
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113164596514
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1124656677153
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://cdn.digitalcity.com/video/kdx.cab
    O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_4us.cab
    O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://clubgames.pogo.com/online2/po...h.1.0.0.80.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{CD972F08-DCEB-431B-9F6B-C46AF747A450}: NameServer = 85.255.113.90,85.255.112.5
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.90 85.255.112.5
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.90 85.255.112.5
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\system32\ImapiRox.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe



    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 5:45:16 PM 08/11/2006

    + Scan result:



    [1080] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning.
    [1428] VM_007B0000 -> Downloader.Agent.uj : Error during cleaning.
    [1484] VM_00390000 -> Downloader.Agent.uj : Error during cleaning.
    [1500] VM_00960000 -> Downloader.Agent.uj : Error during cleaning.
    [1516] VM_008C0000 -> Downloader.Agent.uj : Error during cleaning.
    [1568] VM_009A0000 -> Downloader.Agent.uj : Error during cleaning.
    [2740] VM_00D40000 -> Downloader.Agent.uj : Error during cleaning.
    [376] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning.
    [400] VM_00BF0000 -> Downloader.Agent.uj : Error during cleaning.


    ::Report end
    Reply With Quote Reply With Quote
  2. August 11th, 2006, 09:40 PM #2
    lgbpop's Avatar
    lgbpop
    lgbpop is offline In an Altered State
    Join Date
    Jun 2005
    Location
    Ft Myers FL
    Posts
    8,520
    I did a full scan of ewido
    Please post that. That's the one referred to in the instructions. Seeing the details is the helpful part, not an abridged version. Thanks.

    Also, run another HJT scan and put a check in the boxes next to the following items:

    O17 - HKLM\System\CCS\Services\Tcpip\..\{CD972F08-DCEB-431B-9F6B-C46AF747A450}: NameServer = 85.255.113.90,85.255.112.5
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.90 85.255.112.5
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.90 85.255.112.5

    With all browser windows closed, click fix checked.

    Reboot, run another HJT scan and post the second scan's log only.

    Did you remove some items from your first HJT scan? And what did you mean by this:
    it wouldnt take me to the link i clicked on. It would take to to something completely different.
    What did it take you to?
    I did a full scan of ewido and it found something but had an error when getting rid of it.
    What was it?
    Reply With Quote Reply With Quote
  3. August 12th, 2006, 09:05 AM #3
    JoshuaB
    JoshuaB is offline Virtual Med Student
    Join Date
    Jul 2006
    Posts
    7
    Did you remove some items from your first HJT scan? And what did you mean by this:
    no i did not delete anything.

    What did it take you to?
    IT would take me to someadclick search site instead of the listed site.

    What was it?
    you can see it in this ewido report


    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 9:00:00 AM 08/12/2006

    + Scan result:



    C:\System Volume Information\_restore{E8011A82-5E9E-45FC-A5A5-C3AA722303A7}\RP19\A0006629.exe -> Downloader.Agent.uj : Cleaned with backup (quarantined).
    [1080] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning.
    [1428] VM_007B0000 -> Downloader.Agent.uj : Error during cleaning.
    [1484] VM_00390000 -> Downloader.Agent.uj : Error during cleaning.
    [1500] VM_00960000 -> Downloader.Agent.uj : Error during cleaning.
    [1516] VM_008C0000 -> Downloader.Agent.uj : Error during cleaning.
    [1568] VM_009A0000 -> Downloader.Agent.uj : Error during cleaning.
    [376] VM_00D60000 -> Downloader.Agent.uj : Error during cleaning.
    [400] VM_00BF0000 -> Downloader.Agent.uj : Error during cleaning.
    C:\Documents and Settings\jgrover\Cookies\jgrover@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][2].txt -> TrackingCookie.Bridgetrack : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][1].txt -> TrackingCookie.Burstnet : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@centrport[1].txt -> TrackingCookie.Centrport : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@com[1].txt -> TrackingCookie.Com : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@fastclick[2].txt -> TrackingCookie.Fastclick : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@mediaplex[2].txt -> TrackingCookie.Mediaplex : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][1].txt -> TrackingCookie.Overture : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][2].txt -> TrackingCookie.Pointroll : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][2].txt -> TrackingCookie.Ru4 : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\Documents and Settings\jgrover\Cookies\jgrover@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.


    ::Report end



    Logfile of HijackThis v1.99.1
    Scan saved at 9:05:22 AM, on 08/12/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\AIM+\AIM+.exe
    C:\PROGRAM FILES\AIM95\aim.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = mFire
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [AIM] "C:\Program Files\AIM+\AIM+.exe" -cnetwait.odl
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM95\aim.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: Word Whomp by pogo - http://game1.pogo.com/applet-6.4.4.3...-ob-assets.cab
    O16 - DPF: Word Whomp Whackdown by pogo - http://game1.pogo.com/applet-6.3.4.6...-ob-assets.cab
    O16 - DPF: WordJong by pogo - http://game1.pogo.com/applet-6.4.2.3...-ob-assets.cab
    O16 - DPF: World Class Solitaire by pogo - http://game1.pogo.com/applet-6.5.2.3...lass-en_US.cab
    O16 - DPF: Yahoo! NHL StatTracker - http://aud4.sports.dcn.yahoo.com/java/y/nhlst8246_x.cab
    O16 - DPF: {01118400-3E00-11D2-8470-0060089874ED} (SdcNetCheckCtl Class) - http://activex.microsoft.com/objects/ocget.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/acti..._v1-0-3-48.cab
    O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/...eInstaller.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.co...?1113164596514
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1124656677153
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
    O16 - DPF: {A7ECD556-D6F6-4F41-8C6B-14AB246801A0} (Secure Delivery) - http://cdn.digitalcity.com/video/kdx.cab
    O16 - DPF: {BAC01377-73DD-4796-854D-2A8997E3D68A} (Yahoo! Photos Easy Upload Tool Class) - http://us.dl1.yimg.com/download.yaho...opper1_4us.cab
    O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://clubgames.pogo.com/online2/po...h.1.0.0.80.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
    O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\system32\ImapiRox.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    Reply With Quote Reply With Quote
  4. August 12th, 2006, 05:18 PM #4
    lgbpop's Avatar
    lgbpop
    lgbpop is offline In an Altered State
    Join Date
    Jun 2005
    Location
    Ft Myers FL
    Posts
    8,520
    Your latest log looks clean! How's the computer running--still getting redirects? If yes, run ewido again in Safe Mode, then post its log and another HJT log. If no, that's good.
    Reply With Quote Reply With Quote
  6. August 12th, 2006, 10:10 PM #5
    JoshuaB
    JoshuaB is offline Virtual Med Student
    Join Date
    Jul 2006
    Posts
    7
    no more redirects...thank you so much
    Reply With Quote Reply With Quote
  7. August 12th, 2006, 11:57 PM #6
    lgbpop's Avatar
    lgbpop
    lgbpop is offline In an Altered State
    Join Date
    Jun 2005
    Location
    Ft Myers FL
    Posts
    8,520
    You're welcome; very glad to hear it.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules