Hijack Log Bho Helper And Winantivirus[RESOLVED]

garmanma · June 30, 2006

I updated and ran all the virus and spyware programs. I'm still getting an obnoxious Win Antivirus pop-up. My daughter also told me That a window came up wanting to install a BHO helper and she couldn't get rid of it. Any help would be helpful

Thanks

MarkLogfile of HijackThis v1.99.1

Scan saved at 9:57:45 AM, on 6/30/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

C:\Program Files\Adelphia HSAgent\bin\tgcmd.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\devldr32.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.exe

C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Andrea\My Documents\hijack this\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe

O4 - HKLM\..\Run: [tgcmd] "c:\Program Files\Adelphia HSAgent\bin\tgcmd.exe" /server /startmonitor /deaf

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {01111F00-3E00-11D2-8470-0060089874ED} (Support.com Installer) - http://supportsoft.adelphia.net/sdccommon/...ad/tgctlins.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1119754399165

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Steamhead · June 30, 2006

Hello garmanma

Let's get started!

First download ewido anti-spyware from HERE and save that file to your desktop.

This is a 30 day trial of the program

Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run ewido and update the definition files.
On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.

[*]Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.

[*]Once in the Settings screen click on "Recommended actions" and then select "Quarantine".

[*]Under "Reports"

Select "Automatically generate report after every scan"
Un-Select "Only if threats were found"

Close ewido anti-spyware, Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:
Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
ewido will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan.

I would also like for you to go to the location you saved HijackThis to and rename the file to "HJT", then scanning again and posting a fresh log. Thank You!

garmanma · June 30, 2006

Here you go. This is my daughter's machine,

i'm not sure if I'll be back on it until Monday

Thanks

Markwido anti-spyware - Scan Report

---------------------------------------------------------

+ Created at: 5:16:14 PM 6/30/2006

+ Scan result:

C:\WINDOWS\system32\sstqr.dll -> Adware.Virtumonde : No action taken.

HKU\S-1-5-21-823518204-1292428093-725345543-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178F3FB-2560-458F-BDEE-631E2FE0DFE4} -> Adware.WinAntiVirus : No action taken.

C:\Documents and Settings\Andrea\Local Settings\Temporary Internet Files\Content.IE5\2Z6B6PYB\WinAntiVirusPro2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.j : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Wade\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Addynamix : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Adserver : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Bridgetrack : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Burstbeacon : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@burstnet[1].txt -> TrackingCookie.Burstnet : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Burstnet : No action taken.

C:\Documents and Settings\Wade\Cookies\wade@burstnet[1].txt -> TrackingCookie.Burstnet : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Casalemedia : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken.

C:\Documents and Settings\Wade\Cookies\[email protected][1].txt -> TrackingCookie.Casalemedia : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@cpvfeed[1].txt -> TrackingCookie.Cpvfeed : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Falkag : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Liveperson : No action taken.

C:\Documents and Settings\Wade\Cookies\[email protected][1].txt -> TrackingCookie.Overture : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Pointroll : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@questionmarket[1].txt -> TrackingCookie.Questionmarket : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Reliablestats : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Ru4 : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][1].txt -> TrackingCookie.Serving-sys : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Specificclick : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@tacoda[1].txt -> TrackingCookie.Tacoda : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Valuead : No action taken.

C:\Documents and Settings\Andrea\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : No action taken.

C:\Documents and Settings\Wade\Cookies\[email protected][1].txt -> TrackingCookie.Yieldmanager : No action taken.

C:\Documents and Settings\Wade\Cookies\wade@yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken.

C:\Documents and Settings\Andrea\Cookies\andrea@zedo[1].txt -> TrackingCookie.Zedo : No action taken.

::Report end

Logfile of HijackThis v1.99.1

Scan saved at 5:25:52 PM, on 6/30/2006