Desktop Type Hijack
I had fake anti spyware programs popup a screen over the desktop and a balloon popup from the windows tray area displaying messages that my computer was infected with spyware and telling me I needed to download and purchase their removal program.
I went through all the instructions in order posted by tashi in the forum "Smitfraud:SpyAxe, SpywareFalcon, and other desktop type hijacks". I no longer see the pop screens and balloons.
As per the instructions I will now post the rapport.txt, Ewido log and the HJT log for analysis. I'm also posting the SpybotSD.Report. Thanks for the help.
Rapport:
SmitFraudFix v2.81
Scan done at 8:21:22.67, Mon 08/14/2006
Run from C:\Documents and Settings\emchenry\My Documents\Temp\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix ran in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
---------------------------------------------------------
ewido anti-spyware - Scan Report
---------------------------------------------------------
+ Created at: 9:26:04 AM 8/14/2006
+ Scan result:
Ewido Log:
HKLM\SOFTWARE\Microsoft\VisualStudio\Analyzer\Events\{6C736D71-BCBF-11D0-8A23-00AA00B58E10} -> Adware.CoolWebSearch : Cleaned with backup (quarantined).
HKU\S-1-5-21-299502267-606747145-839522115-500\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1DA7DBE8-C51B-4AE4-BC6E-21863349B0B4} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-299502267-606747145-839522115-500\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1DA7DBE8-C51B-4AE4-BC6E-21863349B0B4} -> Adware.Generic : Cleaned with backup (quarantined).
C:\Documents and Settings\emchenry\Cookies\emchenry@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@adtech[2].txt -> TrackingCookie.Adtech : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@advertising[2].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@bfast[1].txt -> TrackingCookie.Bfast : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@ehg-oreilly.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@statcounter[1].txt -> TrackingCookie.Statcounter : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\emchenry\Cookies\emchenry@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned.
::Report end
