Hijacked Browser, Possibly Smitfraud
Hello!
I don't know what i did yesterday, but i infected my PC for the first time in 6 months with some malware that hijacks IE. The start page is modified to http://www.yoursystemupdate.com where i am agressively invited to download antispyware programs, because my computer is infected. The only infection is this pest. Related sites are http://onlinesecuritytest.net/ and http://securityindex.net/ The pest also places two shortcuts on my desktop that lead to the above sites and imitate Windows XP icons related to security updates. There are also entries in the start-menu and in the favorites tab. Each time i am redirected, or Y!msg notifies me that i have new mail and i open the window, i get an error page and the message that my adware program prevents the access and i should download their crap.
Except spybot SD with TeaTimer, i also use Avast Home Edition and ZoneLabs Personal Firewall. Yesterday i updated both of them and after that i noticed the occurence. Another strange thing is that the firewall asks me if i want to grant persmission to Winlogon.. and i said yes. Every now and then IE & Winlogon ask permission to connect to the net and i say no. There is also a processes being launched in the background, called "mssearchnet.exe". Every time i end it, it turns on again.
Yesterday i found 2 entries in the registries under the name smitfraud, but spybot failed to fix one of them... so i went to delete the keys myself, but i don't know if that was a smart thing.
Firefox is not affected. My HJT log follows.
