Scan your PC for Errors

Member Panel

Remember me ?

Forgot password?   

Join the PC Help Forum Team

Join PC Help Forum on Facebook

Join the PCHF Distributed Computing Teams

Try the NEW PC Help Forum Dark style

Link to PCHF from other parts of the Internet
PC Forum PC Help Forum » Security & Safety » [Fixed] Hijackthis! Logs » [Resolved] Trojan DnsChanger.hg

[Fixed] Hijackthis! Logs - [Resolved] Trojan DnsChanger.hg posted in the Security & Safety forums; AVG anti-spyware keeps coming up with this trojan, it cant seem to get rid of it. This trojan redirects me to other search engines when i try to use google ...

JOIN US NOW to remove these Ads

Post New Thread  Reply
  #1  
Old 12-18-2006
Bronze Member
  
Join Date: Dec 2006
Posts: 12
Clive - See this Members User comments on their Profile page
Default [Resolved] Trojan DnsChanger.hg
AVG anti-spyware keeps coming up with this trojan, it cant seem to get rid of it.

This trojan redirects me to other search engines when i try to use google or yahoo(any other search engine).

If anyone could help i would very happy. Sense this is my fathers computer, he'll kill me if i dont get it fixed


  #2  
Old 12-18-2006
Wolfeymole's Avatar
Resident WereWolf
  
Join Date: Nov 2006
Posts: 1,583
PC Experience: Enough to choke a Mule
Wolfeymole - See this Members User comments on their Profile page Wolfeymole - See this Members User comments on their Profile page Wolfeymole - See this Members User comments on their Profile page
Default
Hello Clive

Welcome to PC Help Forums

We can't be upsetting Daddy so follow the instructions given in the PCHF PreWork link in my signature below.

I will move this to the HJT logs forum.


__________________
  #3  
Old 12-18-2006
Bronze Member
  
Join Date: Dec 2006
Posts: 12
Clive - See this Members User comments on their Profile page
Default
Logfile of HijackThis v1.99.1
Scan saved at 9:51:01 AM, on 12/18/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\PAULPA~1\LOCALS~1\Temp\Rar$EX00.276\Hi jackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe



AVG antispyware report log:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 9:17:09 AM 12/18/2006
+ Scan result:

C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@www.burstnet[1].txt -> TrackingCookie.Burstnet : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@enhance[1].txt -> TrackingCookie.Enhance : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@goclick[1].txt -> TrackingCookie.Goclick : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Paul Palmer\Cookies\paul_palmer@zedo[1].txt -> TrackingCookie.Zedo : Cleaned.
[176] VM_00DA0000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[200] VM_00C60000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).
[824] VM_00B70000 -> Trojan.DNSChanger.hg : Cleaned with backup (quarantined).

::Report end
  #4  
Old 12-18-2006
Wolfeymole's Avatar
Resident WereWolf
  
Join Date: Nov 2006
Posts: 1,583
PC Experience: Enough to choke a Mule
Wolfeymole - See this Members User comments on their Profile page Wolfeymole - See this Members User comments on their Profile page Wolfeymole - See this Members User comments on their Profile page
Default
Cheers Clive

One of our Security team will be along as soon as possible to check these logs.


__________________
  #5  
Old 12-19-2006
chiaz's Avatar
Senior Security Analyst
  
Join Date: Jun 2006
Location: Singapore
Posts: 2,866
PC Experience: PC Guru
chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page chiaz - See this Members User comments on their Profile page
Default
Hello clive.

Update AVG Anti-spyware with the updater module now. Turn off your computer and wait 30 secs before turning it on. Immediately start tapping the F8 key. The Windows Advanced Options Menu should appear. Ensure that the Safe mode option is selected. Press Enter. The computer should then begin to start in Safe mode.

Now launch a full-system scan with AVG Anti-spyware. Clean all detected items as usual. Restart your computer again, you should get back to normal mode automatically.

Rescan with ewido (normal mode) and post the new log in your next reply.



Reply
Satellite TV on your PC - over 3000 Channels! Click Here!

Bookmarks

« [Resolved] could not open .VXD file | Redirect problem(spyware?) »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are On

Contact Us - PC Help Forum - Site Map - Privacy Statement - Top
All times are GMT +1. The time now is 08:40 AM.
Powered by vBulletin
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
SEO by vBSEO 3.2.0 RC7
All Graphics & Content Copyright © 2004-2008 - PC Help Forum.com


Back to Top