Member Avatar for engine-cadet

Lately I have been aving a few problems with my computer. IE startpage sometimes goes to Martfinder and sometimes goes to a "Warning Spyware" page-but about 1/3 of the time it goes where it is supposed to.

The other problem is from time to time when I am online, I notice that my internet gets very slow. If I go to the running processes, I find that there are sometimes 50 pages (fake adware warnings, porn, etc.) running in the processes, but they do not show up as actual pages that can be accessed. The only way I can close them out is to end the process, and I always am told that they are not responding.

Below is my HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 10:02:03 PM, on 7/15/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\DVDRAMSV.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
c:\toshiba\ivp\swupdate\swupdtmr.exe
C:\WINDOWS\wanmpsvc.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcagent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: 1159680172 auto.search.msn.com
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll
O9 - Extra 'Tools' menuitem: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll
O9 - Extra button: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll (HKCU)
O9 - Extra 'Tools' menuitem: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O19 - User stylesheet: C:\WINDOWS\windows.dat
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Swupdtmr - Unknown owner - c:\toshiba\ivp\swupdate\swupdtmr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: ZESOFT - Unknown owner - C:\WINDOWS\zeta.exe (file missing)

Nothing I do seems to help and I would appreciate any help I can get!

-Brandon

  • 2 Contributors
  • 3 Replies
  • 218 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by dlh6213

Dani AI

Generated

Brief diagnosis and prioritized cleanup plan based on the symptoms reported by and the guidance from . The combination of intermittent start-page hijacks, invisible background browser instances and keyword-triggered redirects is consistent with a browser/proxy/hosts-level hijack plus one or more persistent helper modules or services. The steps below prioritize containment, targeted removal and verification so the infection cannot simply reappear from a saved restore point or an autorun component.

Immediate containment (do first)

  • The machine should be disconnected from the network (unplug or disable Wi‑Fi) to stop further redirects or downloads.
  • Reboot to Safe Mode (no networking) and run up-to-date full scans with both an on‑access antivirus and at least one on‑demand anti‑malware scanner. If updates cannot be downloaded on the infected PC, create rescue media from a clean PC.

Targeted manual checks and fixes

  • Inspect Internet Explorer LAN/Proxy settings (Tools → Internet Options → Connections → LAN Settings) and remove any proxy entries.

  • Edit the hosts file (C:\Windows\system32\drivers\etc\hosts) and remove unexpected mappings; a minimal default hosts file contains only a localhost entry, e.g.:

    127.0.0.1 localhost

  • Use Process Explorer (or Task Manager) to check each hidden browser process for its actual executable path and parent process. Correlate with network connections using:

    netstat -ano > C:\netstat.txt
tasklist /svc /FI "PID eq <pid>"

  • Run Autoruns to review and disable unknown startup items, BHOs and Winlogon/notify entries. Back up the registry before removing keys or deleting services.

Follow-up and hardening

  • After cleanup, clear all System Restore points and create a fresh restore point, reset the browser start page via Internet Options, and change important online passwords (the infection could have intercepted credentials). Keep the OS and security software patched and use layered scanners to confirm removal.

Notes and cautions

  • Manual deletions and registry edits carry risk; back up data and registry first. As recommended, also search for odd/missing executables and unknown services and post an updated HijackThis/scan log if further analysis is required.

Recommended Answers

All 3 Replies

Member Avatar for engine-cadet

Thanks much for the advice. I downloaded and ran CCleaner, Ad-Aware SE, Spybot, and Counterspy and deleted my Prefetch and temp files. Some adware was found and deleted, but my start page is still hijacked (different start pages each time such as Martfinder, Specialgoods, etc), unwanted pages still open in the background and are only found by monitoring the running processes, and when I access some pages, I am redirected to unwanted pages. Key words seem to activate the problem-when I try to access the McAfee home page, it takes me to a bogus McAfee page and so on.

I have run another HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 7:56:36 AM, on 7/16/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\drivers\CDAC11BA.EXE
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\DVDRAMSV.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
c:\toshiba\ivp\swupdate\swupdtmr.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
C:\Program Files\Sunbelt Software\CounterSpy Client\sunasDtServ.exe
C:\Program Files\Sunbelt Software\CounterSpy Client\sunasServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshiba.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshiba.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 1159680172 auto.search.msn.com
O9 - Extra button: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll
O9 - Extra 'Tools' menuitem: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll
O9 - Extra button: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll (HKCU)
O9 - Extra 'Tools' menuitem: Intel Internet Explorer Helper checker - {DB96A146-DD10-4438-B717-0121D21CA5BE} - C:\WINDOWS\System32\iegfxfrw.dll (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) -
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab
O19 - User stylesheet: C:\WINDOWS\windows.dat
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\System32\drivers\CDAC11BA.EXE
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Swupdtmr - Unknown owner - c:\toshiba\ivp\swupdate\swupdtmr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thanks much,

engine-cadet

Member Avatar for dlh6213

Please follow the recommendations in Part II of the first post in the following thread, and then follow the instructions in post #4 of the same thread:
http://www.daniweb.com/techtalkforums/showthread.php?p=141971#post141971

Do a search for the following files and delete any instances found:

Win.exe
Win32.exe

Empty your Recycle Bin and reboot.

Then post a new HijackThis log to clean up any remaining items.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.