Member Avatar for Doritos:)

ok first off i am a new member here im not sure how this web site works but if there are other topic i am good in im glad to help :) also. the poeple who write viruses and spyware and such. i could just strangle them! AHH.. anyway my computer is currently running windows 7 i have WAY to much pictures and music on here to back up to my other hard drive to reinstall windows it would take forever plus my computer is just set up the way i like it. anyway on to my problem, the symptoms im having are the web browser (firefox) will open up and open some random page, the second problem i am having is any google search i make it automaticly redirects me to some page that isnt what i clicked and i have to keep copying the link location and pasting it in to the address bar. i have super anti spyware and Malwarebytes' Anti-Malware currently installed and i have tried running both programs at the same time on full scan to remove all the programs with no luck. i downloaded hickack this to post up whats going on and here it is can someone tell me what to do from here?


Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 8:36:14 PM, on 2/10/2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16385)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\SOUNDMAN.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Windows\explorer.exe
C:\Users\Jeff\Downloads\Half-Life 2\Install.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\\gears.dll
O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [P17RunE] RunDll32 P17RunE.dll,RunDLLEntry
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [googletalk] C:\Users\Jeff\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: ATITool.lnk = C:\Program Files\ATITool\ATITool.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\\gears.dll
O9 - Extra 'Tools' menuitem: &Gears Settings - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\\gears.dll
O13 - Gopher Prefix:
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 4947 bytes

  • 5 Contributors
  • 4 Replies
  • 200 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Symptoms like sudden redirects and pages opening without intent most often point to a browser hijacker or adware that has altered browser settings, installed a toolbar, or changed the hosts/DNS configuration. Immediate triage is to isolate the machine (unplug network or disable Wi‑Fi), stop any P2P or file‑sharing clients, and avoid running unknown installers. Community responders correctly flagged the infection vectors and missing AV; treat the system as compromised until scans say otherwise. (malwarebytes.com)

A practical, sequential workflow that avoids tool conflicts is: 1) boot to Safe Mode (or Safe Mode with Networking if an online scanner is needed); 2) run a focused PUP/hijacker cleaner (AdwCleaner) and remove quarantined items; 3) update and run Malwarebytes for a full on‑demand scan; 4) follow with a second‑opinion online scanner (ESET Online Scanner) if results are unclear; 5) if persistence or rootkit behavior is suspected, perform an offline rootkit scan (Microsoft Defender Offline or vendor removal tools) and collect a diagnostic FRST scan for forum analysis. Real‑time antivirus engines should not be run twice or left enabled in duplicate—use one resident AV and run the on‑demand tools one at a time. These steps map to common, supported removal tools and diagnostics. (malwarebytes.com)

For backups and longer‑term decisions: copy only personal files (documents, photos, music) to external media, do not copy executables or program installers, and scan that backup with updated AV before restoring. If the infection survives the above sequence or critical boot/startup entries remain, a clean reinstall is the reliable last step—especially because Windows 7 is out of mainstream support and will remain a higher‑risk platform. Helpful attachments for remote helpers are the Malwarebytes/ESET scan logs and the FRST text files so removers can see persistence points. (support.microsoft.com)

Notes tied to thread replies: and rightly highlighted P2P risk and missing resident AV; ’s suggestion to use an online scanner matches the “second opinion” step above; ’s reinstall idea is valid if cleaning proves unreliable. ’s reluctance to reinstall is understandable, but prioritize safe backups and log collection before attempting repairs.

Recommended Answers

All 4 Replies

Member Avatar for unitedwaykat

I surely don't claim to be an expert at interpreting these logs but I see numerous P2P file sharing programs and NO anti virus software. Did I miss it? I also don't believe you should run Superantispyware AND Malwarebytes at the same time. Installed on the computer but not running at the same time, is that perhaps what you meant?

Member Avatar for Loopah

To start, go to and run Activescan to see if you have any viruses.

If that doesn't find anything, uninstall your two Spyware checkers. Install CCleaner and Microsoft Security Essentials (a low memory usage Spyware AND Virus utility).

Run both of those and see if anything is fixed/reported.

Member Avatar for Member #692894

If malwarebytes has not found it typically it is not going to be an easy thing to remove. You may have less trouble backing up your media and documents (not typically infected, barring macro enabled documents), and wiping and doing a reinstall.

Member Avatar for jholland1964

have super anti spyware and Malwarebytes' Anti-Malware currently installed and i have tried running both programs at the same time on full scan to remove all the programs with no luck.

Not sure what you mean by running full scans at the same time...if you mean ACTUALLY running the scans at the very same time, then NO they don't work that way. You can only run ONE scanner at a time.
Turn off ALL P2P programs and leave them turned off, better yet, Uninstall them. Very likely the way you were infected in the first place that AND, as unitedwaykat stated, there is NO anti-virus program on there, WHY?
Turn off SAS. Update MBA-M. Run a FULL scan with it. When the scan is complete REMOVE all items found.
REBOOT the computer, this is VITAL.

Then do the following:
Run the ESET Online Scanner and post the ScanLog with your post for assistance.

* You will need to use Internet Explorer to to complete this scan.
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is checked and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.

REBOOT the computer.
Post back here with the MBA-M log and the ESET log.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.