Recommended Driver Scanner

Member Panel


Sponsors and Ads

Noticeboard

PC Forum PC Help Forum » Security & Safety » [Fixed] Hijackthis! Logs » [Fixed] Help with persistent Spyware/Adware

[Fixed] Hijackthis! Logs - [Fixed] Help with persistent Spyware/Adware posted in the Security & Safety forums; Hello. I'm new to the site, as I recently signed up to get help with a persistent spyware/adware issue. Whenever I am online, and especially when I am on a ...

JOIN US NOW to remove these Ads

Post New Thread  Reply
  #1  
Old 09-21-2006
Bronze Member
 
Join Date: Sep 2006
Posts: 5
mswilliams124 - See this Members User comments on their Profile page
Exclamation [Fixed] Help with persistent Spyware/Adware

Hello. I'm new to the site, as I recently signed up to get help with a persistent spyware/adware issue. Whenever I am online, and especially when I am on a search engine, I get popups with "Sponsored Results", or "Sorry, this link is no longer available". It is always another site window that pops up, with titles like:
64.182.127.227
64.14.206.59
searchfeed.com
monsterlocal.com
isourcecenter.com
lottsy.com,
and quite a few more that I haven't got time to list. I have scanned and cleaned my computer with AdAware, Spybot, Windows Defender, AvGuard, Spyware Blasterand HijackThis. I've searched all over the net for solutions to this issue. I have scanned and rescanned constantly since the problem arose last night. The problem still continues. I have cleaned and scanned in both normal and safe modes. I consider myself to be pretty good at cleaning up the junk on computers, but this one just gets me. Please help. I have attached my HijackThis log.
Attached Files
File Type: log hijackthis.log (7.2 KB, 5 views)



Last edited by mswilliams124; 09-21-2006 at 11:49 PM.
  #2  
Old 09-22-2006
Pancake's Avatar
Senior Security Analyst
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 3,967
PC Experience: Elite PC Guru
Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page
Default

Hi mswilliams124

Turn off Tea Timer as changes to your log may not be saved.Instructions on how to do this if unsure:
Disable TeaTimer during Hijackthis Cleanup

To show hidden files instructions (WinXP)
Doubleclick My Computer | Tools | Folder Options | View tab
Select Show Hidden Files and Folders
Uncheck Hide extensions for known file types
Uncheck Hide protected operating system files (Recommended)
Select Apply to All Folders | Yes | Apply | OK


Please download Combofix: http://download.bleepingcomputer.com/sUBs/combofix.exe
and save to the desktop.
1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.
Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Do not proceed with the rest of the fix if you fail to run combofix
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100.

Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.

R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,hpdsqlh. exe
O2 - BHO: (no name) - {23FB5ADD-DA37-4a40-9FC0-B0E2384CDE92} - (no file)
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsa971.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKCU\..\Run: [Rcru] "C:\WINDOWS\ASKS~1\smss.exe" -vt tzt
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTS...ducts/vmp.html
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/Mu...bridge-c11.cab
O16 - DPF: {5526B4C6-63D6-41A1-9783-0FABF529859A} (mm06ocx.mm06ocxf) - http://cabs.elitemediagroup.net/cabs/mediaview.cab

Open Windows Explorer and delete the following highlighted file/s

C:\WINDOWS\system32\hpdsqlh.exe
C:\WINDOWS\ASKS~1\smss.exe

Reboot and post a new HJT log and the Combo fix log


__________________
  • An Australian Member of
  • and
My real name is Eddy

Last edited by Pancake; 09-22-2006 at 02:31 AM.
  #3  
Old 09-22-2006
Bronze Member
 
Join Date: Sep 2006
Posts: 5
mswilliams124 - See this Members User comments on their Profile page
Default

Hello. First off, thanks for the help.

Next, I did everything exactly as you said,except there is no file named hpdsqlh.exe anywhere on my PC. I even did a system search, and came up with nothing. That smss.exe gave me a bit of trouble but I got it. New Logs are attached.
Attached Files
File Type: log hijackthis.log (5.8 KB, 3 views)
File Type: txt ComboFix.txt (11.0 KB, 2 views)



Last edited by mswilliams124; 09-22-2006 at 04:03 AM.
  #4  
Old 09-22-2006
Pancake's Avatar
Senior Security Analyst
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 3,967
PC Experience: Elite PC Guru
Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page
Default

post removed


__________________
  • An Australian Member of
  • and
My real name is Eddy

Last edited by Pancake; 09-22-2006 at 04:07 AM.
  #5  
Old 09-22-2006
Pancake's Avatar
Senior Security Analyst
 
Join Date: Jun 2006
Location: Victoria, Australia
Posts: 3,967
PC Experience: Elite PC Guru
Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page Pancake - See this Members User comments on their Profile page
Default

Yes thats fine.Your good to go.

If you wish to do so, here are a few things that you can do that will help keep your computer a bit more clean and secure..
If you have not already done so, you might want to run Disk Cleanup and run it in each user's profile:
Run Disk Cleanup
Click "Start > Programs > Accessories > System Tools > Disk Cleanup"
Please make sure the following are checked:
-- Downloaded Program Files
-- Temporary Internet Files
-- Recycle Bin
-- Temporary Files
Click "OK" and Disk Cleanup will delete those files for you.


Now that you are clean its now is a good time to flush out your restored files.
To flush the XP System Restore Points:
(Using XP, you must be logged in as Administrator to do this.)
Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn Off System Restore.
Reboot. Go back in and turn System Restore ON. A new Restore Point will be created.
How Do I Protect My Computer Against Future Malware Now I'm Clean.
NOTE:You may have already taken some of these steps.
Update your anti-virus software & Windows operating system on a daily or weekly basis. Microsoft also distributes updates to its operating systems. These updates fix security holes or other problems that make a computer susceptible to security breaches. How to update your Windows operating system
Know What You're Installing
Check the source.
To avoid malware, make sure your software comes from a reputable source. Be particularly suspicious of sponsored software (software that relies on advertising) or software that claims to speed up your Internet connection.
Use Custom Install.
If you feel comfortable with software installation, you can choose Custom Install (as opposed to Typical Install). Custom Install allows you to select only the software components you wish to install, and leave out others (such as potential spyware).
Modify Security Settings (Internet Explorer 6)
To reduce the risk of installing malware, you can set Internet Explorer to high security mode. To do so:
Open Internet Explorer. Go to Tools > Internet Options….
On the Internet Options screen, select the Security tab, then select the Internet icon (if it is not already selected).
Under Security level for this zone, click Default Level. Set the slider to High.
Note: You may have to lower the security level to view certain Web sites.
Next, select the Trusted Sites icon. Under Security level for this zone, click Default Level. Set the slider to Medium.
Click Apply, then OK to save the changes.
Some Recommended Protection Programs
Each tool has its own strengths for identifying and removing specific types of malware. To thoroughly check your computer, its recommend that you use more than one malware removal program. Don't forget to back up your data files before starting a scan!
Some available programs are:
Ad-Aware
SpyBot Search & Destroy
Now that you are clean, to help protect your system I recommend that you get the following free programs:
SpywareBlaster to help prevent spyware from installing.
SpywareGuard to catch and block spyware .
IESpy-Ad to block access to malicious websites so you cannot be redirected to them from an infected site or email.
WinPatrol to monitor any changes that programs make to the registry.
If you do not have a firewall, here is a free one for personal use:
ZoneAlarm
Zone Labs: Home/Office Products
Zone Labs: Product Comparison

Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List. It will save you a lot of grief, as well as money if you are thinking of purchasing. Here is the link:
Spyware Warrior: Rogue/Suspect Anti-Spyware Products & Web Sites
If you want to know just how effective your anti-spyware program is, or how well any of the "rogue" programs listed at the above link work, check this for an independent comparison of several anti-spyware programs:
Spyware Warrior: Anti-Spyware Testing (Guide)

Here is a helpful article:
"So how did I get infected in the first place?"
http://www.pchelpforum.com/tutorials...t-your-pc.html
Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!


__________________
  • An Australian Member of
  • and
My real name is Eddy
  #6  
Old 09-22-2006
Bronze Member
 
Join Date: Sep 2006
Posts: 5
mswilliams124 - See this Members User comments on their Profile page
Default

Thank you very much!







Reply
Satellite TV on your PC - over 3000 Channels! Click Here!

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are On

All times are GMT +1. The time now is 08:23 PM.
Powered by vBulletin
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0 RC7
All Graphics & Content Copyright © 2004-2008 - PC Help Forum.com


Back to Top