I copied this from another forum: since my dads pc has this exact issue:
cant hyperlink from search engine (google). it redirects me to ads or other pages and says url fraudcheck in the information bar at the bottom of the screen.
browser has been hijacked. any ideas to rectify this. done malwarebytes scan and antivirus and super antispyware scan. still the same
Any ideas? ran malwarebytes, avast antivirus scan and spybot nothing found.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:05:30 PM, on 2/26/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Shizzy.HOME\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast5] "C:\Program Files\Alwil Software\Avast5\avastUI.exe" /nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HitmanPro35] "C:\Program Files\Hitman Pro 3.5\HitmanPro35.exe" /scan:boot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: GoZone iSync.lnk = C:\Program Files\GoZone\GoZone_iSync.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OneNote Table Of Contents.onetoc2
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsu...?1242228432890
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1242343626562
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -
http://upload.facebook.com/controls/...Uploader55.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -
http://dl8-cdn-09.sun.com/s/ESD7/JSC...ws-i586-jc.cab
O16 - DPF: {B80CD4E6-5B02-4B6C-99BE-68F1511E9549} (WebSlingPlayer) -
http://plugin.slingbox.com/downloads...lingPlayer.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) -
http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McciCMService - Alcatel-Lucent - C:\Program Files\Common Files\Motive\McciCMService.exe
--
End of file - 8186 bytes
[Reply]
Ok, so I ran into a virus thing today. Was browsing the web and all of a sudden my comp started telling me my hard drive had failed and all kinds of crazy stuff. So some WindowsHelper thing popped up and began "searching for any problems" and "found" 11 of them. It looked legit and wouldn't let me touch anything else so I clicked OK like a dumbass. Then shit started ****ing up and got even worse.
Anyway, I started the Task Manager and found a couple odd programs running: one of which was "483080805740..." (a bunch of numbers-not accurate) and another "A1Ashfjdhf..." (a bunch of letters-again not accurate). So I ended the processes and was able to open other things in my comp again. After I updated Malware Bytes I ran the check and it found 5 problems (2 of which were the ones already mentioned and the other 3 I didn't recognize). Anyway, I removed them and now I can access all processes of my comp.
Here's the issue: all of my data and files have been wiped out. Since my comp is just for schoolwork, music and browsing the web I didn't have many important files saved in the first place so I'm fine with that. The thing is, when I move the cursor over any of the folders- let's just say Music- all of the information pertaining to it shows up. So it says my Music folder has 9.84 GBs worth of files and when it was created and all of that, but none of it is showing up. All of my songs even exist and play perfectly in iTunes, it's pretty bizarre.
I've been browsing the web on how to restore lost information and am not computer savy enough to figure out their instructions. I haven't run any "System Restore" or "Recovery" programs yet. So my questions to you guys are:
1. Is there anyway to recover all of my "lost" data and files?
2. Since Malware apparently deleted any traces of the virus, is it safe to be browsing on the same comp again? (Which I'm doing now, by the way)
3. I've accessed my credit card/bank accounts and have applied for several jobs on this comp (so I've entered in a lot of my personal information). I have never saved any of this information or any of these passwords (just entered them in and submitted them) so is there anyway that this virus possibly could have stolen any of that info?
***EDIT: As I said earlier, none of the files on the comp were extremely vital to me so I never ran any backup, transferring of the files to an external hard drive, etc. I'm sure that will come back to bite me in the ass now but I figured it was pertinent information for you to help me.
[Reply]
Originally Posted by ThaVirus:
Ok, so I ran into a virus thing today. Was browsing the web and all of a sudden my comp started telling me my hard drive had failed and all kinds of crazy stuff. So some WindowsHelper thing popped up and began "searching for any problems" and "found" 11 of them. It looked legit and wouldn't let me touch anything else so I clicked OK like a dumbass. Then shit started ****ing up and got even worse.
Anyway, I started the Task Manager and found a couple odd programs running: one of which was "483080805740..." (a bunch of numbers-not accurate) and another "A1Ashfjdhf..." (a bunch of letters-again not accurate). So I ended the processes and was able to open other things in my comp again. After I updated Malware Bytes I ran the check and it found 5 problems (2 of which were the ones already mentioned and the other 3 I didn't recognize). Anyway, I removed them and now I can access all processes of my comp.
Here's the issue: all of my data and files have been wiped out. Since my comp is just for schoolwork, music and browsing the web I didn't have many important files saved in the first place so I'm fine with that. The thing is, when I move the cursor over any of the folders- let's just say Music- all of the information pertaining to it shows up. So it says my Music folder has 9.84 GBs worth of files and when it was created and all of that, but none of it is showing up. All of my songs even exist and play perfectly in iTunes, it's pretty bizarre.
I've been browsing the web on how to restore lost information and am not computer savy enough to figure out their instructions. I haven't run any "System Restore" or "Recovery" programs yet. So my questions to you guys are:
1. Is there anyway to recover all of my "lost" data and files?
2. Since Malware apparently deleted any traces of the virus, is it safe to be browsing on the same comp again? (Which I'm doing now, by the way)
3. I've accessed my credit card/bank accounts and have applied for several jobs on this comp (so I've entered in a lot of my personal information). I have never saved any of this information or any of these passwords (just entered them in and submitted them) so is there anyway that this virus possibly could have stolen any of that info?
***EDIT: As I said earlier, none of the files on the comp were extremely vital to me so I never ran any backup, transferring of the files to an external hard drive, etc. I'm sure that will come back to bite me in the ass now but I figured it was pertinent information for you to help me.
Windows XP or 7?
I'm taking off soon, so don't know how much detail I'll be able to get into.... if you Google 'Windows XP restore' or 'Windows 7 restore', you can find info on how to do a restore. That will restore your computer back to a certain date, so you would lose anything new from that date until today. If you have Windows CDs, you could also do a fresh install, which would obviously delete everything.
As far as the virus, I wouldn't assume it's gone. I would follow some of the instructions in the OP... look at the elitekiller site, download the toolkit, and run the scans from Safe Mode (reboot and press f8 a few times (it's in the OP, too)).
As far as the files... the folder says there's stuff in it, but you don't see anything? Usually if it's corrupt, you'll at least see icons, but either way... if they're gone or corrupt, you're probably SOL.
As far as the personal information, I doubt any of it is at risk... you could always change important passwords, but if you haven't saved bank/CC info anywhere on the PC, I wouldn't worry about it.
So.... for a basic gameplan,
1) I think a restore is your best option at this point, and Google (or someone who's going to be here later tonight) should be able to help you there... if you're not comfortable doing what Google says, or need verification on anything, feel free to post it here, but you might have to wait a little while for feedback.
2) If you're not doing the restore right away, while you're waiting, I'd look at the OP and run the scans in Safe Mode... that will at least get you to a point where your computer is cleaned up, and there's a smaller risk of something else going wrong.
[Reply]