w32.mzor.fx virus

[ripley77]

when i open my internet browser it redirects my homepage to a warning box. the warning box says "w32.mzor.fx@yf is a virus...." it wants me to click ok to download "officially approved security software". i click on cancel, but the web page is addressed as hxxp://safeiepage.com/. if i go to certain web pages i get redirected to a web paged addressed hxxp://idnserror.com/. there is a link on top of the page that says "the page you are looking for is probably blocked by adware/spyware on your PC. Remove it with sysem doctor software. click here". i cannot get this off of my computer and spybot did not notice this at all. please help!!!


this is my panda online scan
Incident Status Location

Adware:Adware/SystemDoctor Not disinfected C:\Program Files\iVideoCodec\isaddon.dll
Adware:Adware/VirusBurst Not disinfected C:\WINDOWS\system32\rrtcany.dll
Adware:adware/safetybar Not disinfected c:\documents and settings\all users\desktop\Online Security Guide.url
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\DIANE\Cookies\diane@atdmt[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\DIANE\Cookies\diane@doubleclick[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\DIANE\Cookies\diane@fastclick[1].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@2o7[2].txt
Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@ad.yieldmanager[1].txt
Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@adopt.hbmediapro[2].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@ads.addynamix[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@ads.pointroll[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@advertising[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@atdmt[2].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@belnk[1].txt
Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@casalemedia[1].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@com[1].txt
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@dist.belnk[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@doubleclick[1].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@ehg-dig.hitbox[1].txt
Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@fastclick[1].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@go[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@hitbox[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@mediaplex[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@overture[1].txt
Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@perf.overture[1].txt
Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@serving-sys[1].txt
Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@trafficmp[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@tribalfusion[2].txt
Spyware:Cookie/VirusBurst Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@www.virusburst[1].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\MIANNA\Cookies\mianna@zedo[2].txt
Adware:Adware/PestTrap Not disinfected C:\Documents and Settings\MIANNA\Local Settings\Temporary Internet Files\Content.IE5\JXDVQEQ1\iesecurepage[1].htm
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@2o7[1].txt
Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@ads.addynamix[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@ads.pointroll[2].txt
Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@adtech[2].txt
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@adultfriendfinder[2].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@advertising[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@atdmt[2].txt
Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@ccbill[1].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@cgi-bin[3].txt
Spyware:Cookie/cs.sexcounter Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@cs.sexcounter[2].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@did-it[1].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@doubleclick[2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@drivecleaner[1].txt
Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@findwhat[1].txt
Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@fortunecity[2].txt
Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@gostats[2].txt
Spyware:Cookie/MediaTickets Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@kinghost[2].txt
Spyware:Cookie/Malwarewipe Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@malwarewipe[2].txt
Spyware:Cookie/PayCounter Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@paycounter[2].txt

[ripley77]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@realmedia[1].txt
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@server.iad.liveperson[2].txt
Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@stat.onestat[2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@stats.drivecleaner[2].txt
Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@stats1.reliablestats[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@tribalfusion[2].txt
Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@www.drivecleaner[1].txt
Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@www.systemdoctor[2].txt
Spyware:Cookie/VirusBurst Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@www.virusburst[2].txt
Spyware:Cookie/XXXCounter Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@xxxcounter[1].txt
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@yadro[2].txt
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Raphels\Cookies\raphels@zedo[1].txt
Adware:Adware/PestTrap Not disinfected C:\Documents and Settings\Raphels\Local Settings\Temporary Internet Files\Content.IE5\9GFZJL4W\iesecurepage[1].htm
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Raphels\Local Settings\Temporary Internet Files\Content.IE5\C1UJGHYB\AntiPuper[1].exe[²PÇ]
Adware:Adware/VidCodec Not disinfected C:\Program Files\iVideoCodec\iesplugin.dll
Adware:Adware/iVideoCodec Not disinfected C:\Program Files\iVideoCodec\pmmon.exe

[ripley77]

Logfile of HijackThis v1.99.1
Scan saved at 9:26:26 AM, on 11/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HIJACK THIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {8bf5b8fc-11cb-409f-8c91-4d4ca04a1b6d} - C:\Program Files\iVideoCodec\isaddon.dll
O3 - Toolbar: Protection Bar - {1a29a79a-b9c8-44a9-bedf-7fadde3cf33f} - C:\Program Files\iVideoCodec\iesplugin.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Program Files\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Comcast\COMCAS~1\data\Xtras\mssysmgr.exe
O8 - Extra context menu item: Open with WordPerfect - C:\Program Files\WordPerfect Office X3\Programs\WPLauncher.hta
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} (McUpdatePortalFactory Class) - http://www.amiuptodate.com/vsc/bin/2,0,0,0/McUpdatePortal.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/mcgdmgr/1,0,0,26/mcgdmgr.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,1,0,4881/mcfscan.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - C:\WINDOWS\system32\rrtcany.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe

[ripley77]

this is what i have for now please help thanks in advance

[ripley77]

SmitFraudFix v2.119

Scan done at 10:31:36.45, Mon 11/06/2006
Run from C:\Documents and Settings\Raphels\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\rrtcany.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Raphels


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Raphels\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Raphels\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop

C:\DOCUME~1\ALLUSE~1\Desktop\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\Desktop\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\iVideoCodec\ FOUND !
C:\Program Files\VirusBursters\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{27321538-5739-4aa1-b84c-7d18e4383f1f}"="ferrateen"

[HKEY_CLASSES_ROOT\CLSID\{27321538-5739-4aa1-b84c-7d18e4383f1f}\InProcServer32]
@="C:\WINDOWS\system32\rrtcany.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{27321538-5739-4aa1-b84c-7d18e4383f1f}\InProcServer32]
@="C:\WINDOWS\system32\rrtcany.dll"



»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

[ripley77]

by reading other threads i was able to get rid of problem i seem clean. but i would like to make sure. What should i do now?

[LonnyRJones]

Hi

Thats a log from running smithfraudfix option 1, since the author updates smithfraudfix often, delete yours and re-download it, reboot the pc into safe mode run the tool choose option 2 fix, when its done restart back to normal and post the report.txt

[tashi]

This topic has been closed to prevent others with similar issues posting in it.
If you need it re-opened please send me or your helper a private message (pm) and provide a link to the thread.

Applies only to the original topic starter.