Ultimate Predator Posted September 11, 2009 Share Posted September 11, 2009 My brother went on my laptop and accidentally installed a load of spyware on it. As I don't have a real-time anti-virus/alware running, and only built-in Windows firewall (normally I know whats going in and out of my computer), it spread pretty quickly, but thanks to Tarun's awesome clean up guide, it appears to have soughted out the problem (Malwarebytes, Super anti-spyware and Spybot all say its clean). Anyway, here is the hijackthis log file just to make sure it has a clean bill of health: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:35:44, on 11/09/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18813) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\HijackThis\HijackThis.exe C:\Program Files\Windows Media Player\wmpnscfg.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -- End of file - 1771 bytes Link to comment Share on other sites More sharing options...
Administrator Tarun Posted September 11, 2009 Administrator Share Posted September 11, 2009 I'm wondering where the rest of the log is. No services are shown and there's very few processes. Please post a Safe Mode log also. Link to comment Share on other sites More sharing options...
Ultimate Predator Posted September 11, 2009 Author Share Posted September 11, 2009 I'm wondering where the rest of the log is. No services are shown and there's very few processes. Please post a Safe Mode log also. I too don't understand why there is little else showing. I know that when I run HijackThis, towards the end of the scan it somewhat freezes, then completes, but only gives me the list above. I will post up a safe mode log later. Here is my log again in normal mode, still the same issues. I'll post up the safe mode log in another post: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:27:28, on 11/09/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18813) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\system32\wbem\unsecapp.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\HijackThis\ht.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -- End of file - 1763 bytes Link to comment Share on other sites More sharing options...
Ultimate Predator Posted September 11, 2009 Author Share Posted September 11, 2009 Here is the safe mode log, bizarre that there is little difference between it and my normal log (I also know I am loading all drivers etc as normally as I pressed F8 continuously on start-up, and selected Start Windows Normally): Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:32:51, on 11/09/2009 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18813) Boot mode: Safe mode Running processes: C:\Windows\Explorer.EXE C:\Program Files\HijackThis\ht.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - Default URLSearchHook is missing O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL -- End of file - 1658 bytes EDIT: Keep in mind, compared to my previous post there isn't a lot of difference in my normal log really, I took out the things you adised, and I no longer have a real-time anti-virus/malware or firewall (other than Windows) for the reasons provided in my first post of this thread. Here is my older laptop log anyway for reference: Link to comment Share on other sites More sharing options...
Administrator Tarun Posted September 15, 2009 Administrator Share Posted September 15, 2009 Sorry about the delay. Things have been extremely busy behind the scenes. Everything looks okay. Keep up the good work. Link to comment Share on other sites More sharing options...
Ultimate Predator Posted September 16, 2009 Author Share Posted September 16, 2009 Sorry about the delay. Things have been extremely busy behind the scenes. Everything looks okay. Keep up the good work. No worries, thanks for the reply. Glad everything looks ok. ;) Link to comment Share on other sites More sharing options...
Recommended Posts