OS Support → Post your problem → malicious add-on problem

24 May 2009, 06:35

i thought have posted here my prob but...
here is my logfile. thanks in advance
------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:49:30, on 2009/05/20
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 .00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Users\cheshire\Program Files\DNA\btdna.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\Taskmgr.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Users\cheshire\Desktop\HiJackThis\HijackThis.exe

O1 - Hosts: ::1 localhost
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {ecdb5ea3-bd30-4b66-9012-0533b14e76e0} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Users\cheshire\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Speeky - {3c103f63-b6fb-428c-970c-d9490a5cfd70} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {53F4962A-8E27-4601-8B01-79A82B4D7FC9} (LoadPrg Class) - https://member.gungho.jp/front/member/webgs/LoadPrgAx.CAB
O16 - DPF: {A049E723-858B-4EDB-BAF1-87286429FDA5} (GameleonGameControl Control) - http://homage.gameleon.jp/component/GameleonGameControl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/jpn/crlocx.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{66EADBFC-6DBB-__TEXT IS TOO BIG. IT WAS TRUNCATED TO 5000 SYMBOLS

Rating 0 Comments 5

Thebossonline 24 May 2009, 13:45 #

what malicious addon...do you know it ? i see only Bittorrent DNA ..

cheshire72 25 May 2009, 08:41 #

really? that's strange.
but since WinPC Defender was installed on my PC
it's really strange my web browser.
especially when opening Gmail. it's frequently shut down...
like every 5 minutes.

Thebossonline 25 May 2009, 12:30 #

Download SUPERAntispyware free edition from here.

http://superantispyware.com/

Open SUPERAntispyware

Make sure to update the program/definitions:

Print/save usage instructions.
Click on Preferences--Scanning control tab
Check the check boxes called "Close Browsers before scanning" and "Terminate memory threats before quarantining".
Then click on Statistics/logs tab
If "Keep a log file of detailed scanning results" and "Save empty/clean logs" check boxes are unchecked make sure to check/enable both

Now do a complete scan for including all your hard disk partitions. Wait till the scan is finished/completed.

Once the scan is finished click preferences again
Then click on Statistics/logs tab
Under scanner logs double click the latest log file to open it
Copy and paste the contents of the log file in here.

Also, tell us how your system is now.

Note: If you cannot update Superantispyware automatically, Go here and download the offline updater and install it.

http://www.superantispyware.com/downloads/SASDEFINITIONS.EXE

cheshire72 28 May 2009, 08:21 #

something strange this forum.
even i posted comment it's not added~

cheshire72 28 May 2009, 08:27 #

hey i cant post my log file here.

You have to login or register to post comments.

cheshire72

9 ♠ 0 ♣

Tweet: