logbooch
2006-10-21, 02:00
I am sorry if this is a long description but as I am not entirely sure where the problem started, I wanted to give you a full rundown: I have a new laptop and as I am studying Digital Design I decided I wanted to get all the relevant software programs for my own computer so that it would be easier to work in my spare time. I have purchased cheap- presumably illegal- versions of software from Ebay before and they were absolutely fine, so I bought a version of Macromedia Studio 8 & also Adobe CS2. As a part of the installation process for CS2, the disc had a separate Keygen program to generate the serial number. They all worked perfectly and I don’t think that they can have had any spyware bundled with them as I didn’t get any immediate problems so I was really pleased. It made me think that I could then surely download the appropriate keygen program for other software that I couldn’t get on Ebay. I realize this is all my own fault and I wont ever do it again, but about a week ago I then downloaded the Keygen for the animation Software Animo from a random Keygen site. When I clicked on the icon to run the program, the icon simply disappeared and absolutely nothing (visible) happened. I immediately panicked that it must be dodgy and so did a system search for the keygen.exe file (which it found in C:Windows:Prefetch) and attempted to delete it, but it said it was in use by another program and thus could not be deleted yet- this worried me even more!
After that I began to get a regular bunch of popups from a variety of alledged spyware/virus removal sites, asking me to run a system scan. I didn’t have to be browsing the web for these to appear, but as I have wifi I guess I am always connected, and they were from a different site every time. When I say regular, I don’t mean a continuous pop-up overload as some spyware can cause- more like one every few minutes. Unfortunatley, as the first one appeared with the name WinVirus Scan or something similar and had an XP logo at the top, I was foolish enough to click on it. It made out that it was scanning, but then told me that to fix the problems I would have to register my details. Obviousley I did not. I found that it had downloaded and installed 2 antivirus programs on my computer; Ultimate Defender & Ultimate Cleaner which I removed via the Add&Remove Programs function. I then found that they still had folders in their names in the Program Files folder which I deleted, but also spotted a new folder called InetGet2, which on Googling I found to be a virus. I attempted to delete this seemingly empty folder, but it wouldnt let me.
I then found that when I was online I had an additional toolbar installed, which again I removed via Add/Removeprograms. Still, whilst I was online I found that I kept getting redirected away from the sites I wanted to use. This mainly happened when I ran a google search and then opened a link from the search results. It would direct me to random sites- never porn, just random- seemingly irrelevant stuff. Occasionally it would open an additional page showing some random ebay search results. I also continued to get antivirus pop-ups. I rarely had a problem whilst navigating within sites I had accessed by typing in the URL- it seemed linked to opening it from a search engine.
I have AVG Antivirus software, so I ran a complete system scan and it came up clean. I then downloaded Ewido Spyware and ran a complete scan with that. That found quite a few things- the majority of which were low risk trackers, but there were 3 medium risk finds: trojan.agent.vg, adware.softomate & dropper.small. It deleted all of these.
Having done so, I was able to delete the Inetget2 folder, but was still unable to delete the keygen as it still claimed to be in use by another progam.
As my dad suggested the problem seemed to be exacerbated by Internet Explorer, he advised I used Mozilla Firefox instead as it is safer. I found this to be fine, and I didn’t get a single pop-up/ redirected site. I went to turn off the computer and it gave one of the standard ‘program still in use/end program now’ popups about something called Available Networks, which was definatley not something I had started. It ended it and turned off, so I immediately turned it back on and ran a system search for said program with a view to delete it, but it couldn’t find it. I then attempted to delete the keygen again, and it worked- so I assumed that this had been the program it had been tied up to.
The next day I ran the Ewido Scanner again to see if anything had reappeared, but this time I turned off the Wifi connection first as advised by the antivirus help file. There were a bunch more trackers, and 2 trojans- trojan.agent.vg (again) and Trojan.BHO.g. Again I deleted all the trackers, but as it advised to just quarantine the Trojans I let it do that. My dad then noticed that you could set the shield to automatically delete tracking cookies, so we turned that on.
It continued to run fine- no popups using Firefox so I was happy, but I was still paranoid that the Trojans were recurring and that it my have placed some other undetected virus on there that would cause problems in the future and/or leak private information. I didn’t even bother to try Internet Explorer, as I thought why risk it if there was no need.
The next day the scan was clean which was good, but I noticed that the InetGet2 folder had re-appeared in the program files- still apparently empty. I deleted it again. Also, when I checked the Add/Remove programs list something called Mediamatch OIN had appeared. I removed it.
The next day (sorry this goes on!) it found just one Trojan- Adware.virtumonde, but I found that I was also getting a couple of antvirus popups on Firefox now- very few and far between, and mainly from the same two: SystemDoctor & WinAntivirusPro, but I wasn’t sure if this was connected.
I decided to try the HijackThis log just to check & be safe, but I am unable to decifer it fully myself. I did notice that in the 04 Autoloading Programs section that Ultimate Cleaner & Ultimate Defender were listed- which seems strange as I had seemingly deleted them? I also downloaded StartupList as it claimed it could help identify unknown applications. Whilst there is obviousley a lot of things there that I don’t recognize by eye, I cant see how the StartupList program is helping me identify what they are? I posted my log on one other forum but no-one offered me any help all week.
Since then, I found that I continued to get more and more pop ups in firefox, and the number were increasing, plus they were now coming from more varied sources. I read on a forum that I should try both Ad-Aware & Spybot Search & Destroy as they were meant to be the best programs to find spy and adware, so I downloaded them both and ran them. Ad-Aware found about 51 items (!) most of which were trackers with names like adserver, adtech, euroclick & mediaplex, but there was also a couple of Trojans. I was surprised that it found trackers given that Ewido is meant to be set to delete any that appear on contact? Spybot also found and healed about 12 things. This is all well and good, but the pop-ups continued everytime I was online. Still nothing bad- predominantly anti-virus related, but some with random names like Amaena and stuff, and then the occasional one for bingo or holidays or something. What I also started to get though which seemed really odd, is blank page pop-ups which appeared to be loading something from somewhere but were just taking forever to do it, and obviously I didn’t want to wait for whatever trash it was, so I would close them, but I did note that all of these ones began with http://85.12.25.8 (or sometimes 85.12.25.85) followed by some other words or letters; .tana, .425QQsacaf, or even followed by the name of the site I was actually accessing on my original page. Also, a few times, when I went to close down the computer I got a pop up telling me it was trying to close XPCOM Event Receiver, which is not something I ever knowingly had running.
Finally, As today I was continuing to have pop-ups like those mentioned above whilst online I decided to run some further scans. I disabled the Bluetooth and ran full system scans with AVG, Ewido, Ad-Aware & Spybot, and the only one to find anything was Spybot, which found a solitary fault- something called VS Toolbar- which again it healed. Whilst it seems good that the scans would come back clear in relation to what they were before, that doesn’t change the fact that the pop-ups have continued and increased regardless, and everytime it scans it is finding some different adware which is alledgedly causing them, but something somewhere in my computer must still be responsible for creating this new adware, as the problem has never gone away. Someone read my latest HijackThis Log and help me, Please!
Logfile of HijackThis v1.99.1
Scan saved at 9:17:44 PM, on 10/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\System Control Manager\edd.exe
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\HijacjkThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [qowapgi.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\qowapgi.dll,hgskauc
O4 - HKLM\..\Run: [Ultimate Cleaner] C:\Program Files\Ultimate Cleaner\App.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Startup: .protected
O4 - Global Startup: .protected
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Works\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160142287968
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
After that I began to get a regular bunch of popups from a variety of alledged spyware/virus removal sites, asking me to run a system scan. I didn’t have to be browsing the web for these to appear, but as I have wifi I guess I am always connected, and they were from a different site every time. When I say regular, I don’t mean a continuous pop-up overload as some spyware can cause- more like one every few minutes. Unfortunatley, as the first one appeared with the name WinVirus Scan or something similar and had an XP logo at the top, I was foolish enough to click on it. It made out that it was scanning, but then told me that to fix the problems I would have to register my details. Obviousley I did not. I found that it had downloaded and installed 2 antivirus programs on my computer; Ultimate Defender & Ultimate Cleaner which I removed via the Add&Remove Programs function. I then found that they still had folders in their names in the Program Files folder which I deleted, but also spotted a new folder called InetGet2, which on Googling I found to be a virus. I attempted to delete this seemingly empty folder, but it wouldnt let me.
I then found that when I was online I had an additional toolbar installed, which again I removed via Add/Removeprograms. Still, whilst I was online I found that I kept getting redirected away from the sites I wanted to use. This mainly happened when I ran a google search and then opened a link from the search results. It would direct me to random sites- never porn, just random- seemingly irrelevant stuff. Occasionally it would open an additional page showing some random ebay search results. I also continued to get antivirus pop-ups. I rarely had a problem whilst navigating within sites I had accessed by typing in the URL- it seemed linked to opening it from a search engine.
I have AVG Antivirus software, so I ran a complete system scan and it came up clean. I then downloaded Ewido Spyware and ran a complete scan with that. That found quite a few things- the majority of which were low risk trackers, but there were 3 medium risk finds: trojan.agent.vg, adware.softomate & dropper.small. It deleted all of these.
Having done so, I was able to delete the Inetget2 folder, but was still unable to delete the keygen as it still claimed to be in use by another progam.
As my dad suggested the problem seemed to be exacerbated by Internet Explorer, he advised I used Mozilla Firefox instead as it is safer. I found this to be fine, and I didn’t get a single pop-up/ redirected site. I went to turn off the computer and it gave one of the standard ‘program still in use/end program now’ popups about something called Available Networks, which was definatley not something I had started. It ended it and turned off, so I immediately turned it back on and ran a system search for said program with a view to delete it, but it couldn’t find it. I then attempted to delete the keygen again, and it worked- so I assumed that this had been the program it had been tied up to.
The next day I ran the Ewido Scanner again to see if anything had reappeared, but this time I turned off the Wifi connection first as advised by the antivirus help file. There were a bunch more trackers, and 2 trojans- trojan.agent.vg (again) and Trojan.BHO.g. Again I deleted all the trackers, but as it advised to just quarantine the Trojans I let it do that. My dad then noticed that you could set the shield to automatically delete tracking cookies, so we turned that on.
It continued to run fine- no popups using Firefox so I was happy, but I was still paranoid that the Trojans were recurring and that it my have placed some other undetected virus on there that would cause problems in the future and/or leak private information. I didn’t even bother to try Internet Explorer, as I thought why risk it if there was no need.
The next day the scan was clean which was good, but I noticed that the InetGet2 folder had re-appeared in the program files- still apparently empty. I deleted it again. Also, when I checked the Add/Remove programs list something called Mediamatch OIN had appeared. I removed it.
The next day (sorry this goes on!) it found just one Trojan- Adware.virtumonde, but I found that I was also getting a couple of antvirus popups on Firefox now- very few and far between, and mainly from the same two: SystemDoctor & WinAntivirusPro, but I wasn’t sure if this was connected.
I decided to try the HijackThis log just to check & be safe, but I am unable to decifer it fully myself. I did notice that in the 04 Autoloading Programs section that Ultimate Cleaner & Ultimate Defender were listed- which seems strange as I had seemingly deleted them? I also downloaded StartupList as it claimed it could help identify unknown applications. Whilst there is obviousley a lot of things there that I don’t recognize by eye, I cant see how the StartupList program is helping me identify what they are? I posted my log on one other forum but no-one offered me any help all week.
Since then, I found that I continued to get more and more pop ups in firefox, and the number were increasing, plus they were now coming from more varied sources. I read on a forum that I should try both Ad-Aware & Spybot Search & Destroy as they were meant to be the best programs to find spy and adware, so I downloaded them both and ran them. Ad-Aware found about 51 items (!) most of which were trackers with names like adserver, adtech, euroclick & mediaplex, but there was also a couple of Trojans. I was surprised that it found trackers given that Ewido is meant to be set to delete any that appear on contact? Spybot also found and healed about 12 things. This is all well and good, but the pop-ups continued everytime I was online. Still nothing bad- predominantly anti-virus related, but some with random names like Amaena and stuff, and then the occasional one for bingo or holidays or something. What I also started to get though which seemed really odd, is blank page pop-ups which appeared to be loading something from somewhere but were just taking forever to do it, and obviously I didn’t want to wait for whatever trash it was, so I would close them, but I did note that all of these ones began with http://85.12.25.8 (or sometimes 85.12.25.85) followed by some other words or letters; .tana, .425QQsacaf, or even followed by the name of the site I was actually accessing on my original page. Also, a few times, when I went to close down the computer I got a pop up telling me it was trying to close XPCOM Event Receiver, which is not something I ever knowingly had running.
Finally, As today I was continuing to have pop-ups like those mentioned above whilst online I decided to run some further scans. I disabled the Bluetooth and ran full system scans with AVG, Ewido, Ad-Aware & Spybot, and the only one to find anything was Spybot, which found a solitary fault- something called VS Toolbar- which again it healed. Whilst it seems good that the scans would come back clear in relation to what they were before, that doesn’t change the fact that the pop-ups have continued and increased regardless, and everytime it scans it is finding some different adware which is alledgedly causing them, but something somewhere in my computer must still be responsible for creating this new adware, as the problem has never gone away. Someone read my latest HijackThis Log and help me, Please!
Logfile of HijackThis v1.99.1
Scan saved at 9:17:44 PM, on 10/20/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\Program Files\System Control Manager\edd.exe
C:\WINDOWS\system32\o2flash.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\System Control Manager\MGSysCtrl.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe
C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ewido anti-spyware 4.0\ewido.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\HijacjkThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Program Files\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Version Cue CS2] "C:\Program Files\Adobe\Adobe Version Cue CS2\ControlPanel\VersionCueCS2Tray.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Adobe Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [qowapgi.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\qowapgi.dll,hgskauc
O4 - HKLM\..\Run: [Ultimate Cleaner] C:\Program Files\Ultimate Cleaner\App.exe
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - Startup: .protected
O4 - Global Startup: .protected
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Works\Office10\OSA.EXE
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1160142287968
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Version Cue CS2 - Unknown owner - C:\Program Files\Adobe\Adobe Version Cue CS2\bin\VersionCueCS2.exe" -win32service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: SCM Driver Daemon (NishService) - Unknown owner - C:\Program Files\System Control Manager\edd.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe