Member Avatar for 2b_berean

Hi anyone with wisdom,
I'm currently having problems with google search results redirecting to porn sites and other random sites and also many pages wont even load, particularly anti spyware sites..... i'm running nod32 v3 also ran Spybot S&D, Malware Bytes & Spyzooka.
Below is my HJT report and FixWareOut report. and a nod32 quarantine item.
i'm humble enough to know when i'm beaten and out of my depth...... with help i'm sure i can overcome this issue.

Logfile of HijackThis v1.99.1
Scan saved at 4:12:02 PM, on 20/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Mozilla Thunderbird\thunderbird.exe
C:\Documents and Settings\Shane\My Documents\New downloads\Net ware\analyze.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Power_Gear] "C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" 1
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Download with GetRight - C:\Program Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program Files\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{07237A92-6C76-420E-BEB5-DB63C17CFB63}: Domain =
O17 - HKLM\System\CCS\Services\Tcpip\..\{7768D3DB-7F40-4AFD-B950-C41292E9D680}: Domain =
O17 - HKLM\System\CS1\Services\Tcpip\..\{07237A92-6C76-420E-BEB5-DB63C17CFB63}: Domain =
O17 - HKLM\System\CS2\Services\Tcpip\..\{07237A92-6C76-420E-BEB5-DB63C17CFB63}: Domain =
O17 - HKLM\System\CS3\Services\Tcpip\..\{07237A92-6C76-420E-BEB5-DB63C17CFB63}: Domain =
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe


Username "Shane" - 20/09/2008 16:36:29 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check

Successfully flushed the DNS Resolver Cache.

System was rebooted successfully.

~~~~~ Postrun check
HKLM\SOFTWARE\~\Winlogon\ "System"=""
....
....
~~~~~ Misc files.
....
~~~~~ Checking for older varients.
....

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\\WINDOWS\\ATK0100\\HControl.exe"
"SoundMan"="SOUNDMAN.EXE"
"SiSUSBRG"="C:\\WINDOWS\\SiSUSBrg.exe"
"Power_Gear"="\"C:\\Program Files\\ASUS\\Power4 Gear\\BatteryLife.exe\" 1"
"SynTPLpr"="\"C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe\""
"SynTPEnh"="\"C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe\""
"RemoteControl"="\"C:\\Program Files\\ASUSTeK\\ASUSDVD\\PDVDServ.exe\""
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"KernelFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,\
65,6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,6b,00
"egui"="\"C:\\Program Files\\ESET\\ESET NOD32 Antivirus\\egui.exe\" /hide /waitservice"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\QTTask.exe\" -atboottime"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe\""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~

Nod32 v3 Quarantine entry:

20/09/2008 3:09:22 PM HTTP filter

Win32/TrojanDownloader.FakeAlert.IY trojan
connection terminated - quarantined
NT AUTHORITY\SYSTEM
Threat was detected upon access to web by the application: C:\WINDOWS\system32\svchost.exe

18/09/2008 8:12:44 PM HTTP filter
http://www.mike-austin.com/home/papers/search-engines/
HTML/TrojanDownloader.Agent.IJ trojan connection terminated - quarantined
NT AUTHORITY\SYSTEM
Threat was detected upon access to web by the application: C:\WINDOWS\system32\svchost.exe.

15/09/2008 6:35:56 PM HTTP filter

probably a variant of Win32/Statik application connection terminated - quarantined
Threat was detected upon access to web by the application: C:\WINDOWS\system32\drivers\svchost.exe.

Please help unravel this mess

  • 3 Contributors
  • 4 Replies
  • 408 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by BluePenguin15

Dani AI

Generated

This thread shows a classic browser‑redirect / network‑hook infection pattern: outbound connections from system services, web searches redirected to unrelated/malicious pages, and legitimate anti‑malware sites blocked. Good first steps already taken by (Comodo + CCleaner) and the scans run by (NOD32, Malwarebytes) — those reduce active risk and can remove many user‑mode components, but kernel/rootkit components sometimes require targeted tools and an offline approach.

Why redirects and blocked anti‑malware pages happen: some malware injects into system services or installs low‑level drivers that intercept DNS/HTTP or alter browser/proxy settings. That both reroutes search results and prevents access to cleanup resources. Simple registry or file removals can leave hidden drivers or persistence points behind.

Recommended checklist (prioritized):

  1. Isolate the PC from the network (unplug or block outbound in the firewall).

  2. Run updated anti‑rootkit tools and full scans from Safe Mode or via a bootable rescue environment. Follow with a second opinion scan from a different vendor.

  3. Inspect and clean startup/persistence with a trusted autorun/startup viewer; remove unknown entries only when their purpose is certain.

  4. Reset networking and browser state to remove leftover hooks: flush DNS and reset Winsock, clear browser proxy and reset the hosts file. Useful commands:

    ipconfig /flushdns
netsh winsock reset

  5. After apparent cleanup, verify with multiple updated scanners and reboot. Change important passwords only from a known‑clean device.

If uncertainty remains about system integrity or sensitive accounts were used on the PC, a clean OS reinstall from known‑good media is the safest option. The outbound‑filtering approach from was appropriate; keep a strong outbound firewall/HIPS and keep system and third‑party apps patched to prevent reinfection.

Recommended Answers

All 4 Replies

Member Avatar for gerbil

Hello, shane... for a start I think you need a better Firewall. If you check the nod32 log entries you posted you will see that svchost.exe was contacting dangerous websites. Comodo Firewall Pro [free] would have alerted you to the fact that it was attempting to make web connections before any connection was made.
The hijackthis log shows as clean, but you could use it to fix these two orphaned entries:
O9 - Extra button: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)
O9 - Extra 'Tools' menuitem: Net2Phone - {4B30061A-5B39-11D3-80F8-0090276F843F} - http://www.net2phone.com/ (file missing)

Something must be there, though, to cause svchost to open connections, so to check a little further would you please:
==Get CCleaner from http://www.ccleaner.com/ - and install it in a new folder. You should keep this one for general use. I set the installation checkboxes only to open from the recycle bin. It's neater that way.
Now run CCleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...].
If you have FireFox open the Applications tab and ensure at least that Cookies and Cache are checked.
Select the Cleaner icon, press Run Cleaner.
Run CCleaner in any other Accounts.
==Please use IE or Firefox to do an online scan at panda:-
-First Register [otherwise there will be no disinfection, merely detection] with a valid email address for the free online virus scan and follow through.
Unlike Kaspersky this scan does not require Java. Panda will clean only virii, but it is superb at listing other malwares which can then be targeted.
Please ATTACH to your post the log it produces.

Member Avatar for 2b_berean

Thanks so much Gerbil for reviewing my logs..... i followed your advice and got cc cleaner (great freeware) & comodo firewall which is very thorough and very annoying but very necessary given recent attacks.
It seems malware bytes(MBAM) has saved the day again for me so i didn't bother running panda.
below is the MBAM log:

Malwarebytes' Anti-Malware 1.28
Database version: 1180
Windows 5.1.2600 Service Pack 2

20/09/2008 5:15:04 PM
mbam-log-2008-09-20 (17-15-04).txt

Scan type: Full Scan (C:\|)
Objects scanned: 81809
Time elapsed: 12 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.


thanks again gerbil you've been an awesome helper....

Member Avatar for gerbil

Orright. Comodo.. take notice of the various options available on the popups, using them can simplify life.
Panda is a good scan... really good. Never hurts to get a second opinion. MBAM targets trojans, adware, spyware... Panda is a lilttle more complete, dare I say?

Member Avatar for BluePenguin15

Hello,

If you have spyware after running Spyzooka please follow these directions and we'll give you a free update to remove all your spyware in less than 24 hours:

1.Open SpyZooka

2. Click “Start Scan”

3. Choose “Quick Scan” and click “Scan”

4. After the scan is complete click the “Scan Report” tab.

5. Enter your email address and click “Send Report.” If you are unable to send us a report using the Send Report feature please click “Copy Report” and paste it on our

Regards,

Carl Haugen
President
BluePenguin Software
www.SpyZooka.com

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.