[paypaltoegold1]

Ohhhhhhhh

so...run this scan tonight. leave it running and go to bed, it will take a long while to complete.

you may need help with running malwarebytes. it takes a little more know how...but i bet you can find the help you need from someone in this forum. What Nline is telling you to do will work pretty well and is worth the effort.

If you feel better, the house computer here is going to need the same thing done in the next week or so (when i get the time). it works, but it sucks and needs a cleanup. it is the one that the kids use for their myspace and facebook.

[JessiPollo]

I can't even get to the part where I'm scanning because they keep asking me a bunch of questions and I don't know the correct answer. For example,

"SuperAntiSPyware has detected that your browser home page has been changed. If you did not make this change you may have spyware on your system."
Then, it says Home Page for Internet Explorer (before change) http://www.google.com

Home Page for Internet Explorer (after change) http://ie/redirect.ht.com/svs/rdr?TY:E=iehomelocale=en...............

Then, I'm supposed to answer either Allow Change or Block Change. The weird thing is what it shows is the reverse. The "before change" was not google.com it was that other one. AHhhhhhhhhhhhhhhhhhhhhhh.......

[mobbemeatiedy]

Obviously sign of Google's incipient world dominion.....




...and you all just thought they were a simple search engine....


MUAHAHAHAHAHAHA!!

[Frjrbefd]

Computer issues create that same feeling of despondency I feel when an auto mechanic starts telling me about the thus in such connected to the thus and such that needs to be replaced, and I don't have the slightest clue what the thus and such is, where it's located or what its function might be.

[blohannaserri]

A plane ticket and maybe one meal and Nline would probably be in Houston first thing in the morning.

Yes, I much appreciate his help. I'm getting closer to the answer, I feel it!

[FrereeDoulley]

So close, yet so far away...

I got to Preferences and went to the Scanning Control tab and deselected the two boxes that were suggested. Then, I selected Complete Scan under the first tab and it says I can't do that in the Free Edition that I'lll have to upgrade to the paid version (which I'm not opposed to I just want to be sure it's supposed to say that).

Are all the boxes on the first tab supposed to be checked as well?

[valiumcheepval]

So close, yet so far away...

I got to Preferences and went to the Scanning Control tab and deselected the two boxes that were suggested. Then, I selected Complete Scan under the first tab and it says I can't do that in the Free Edition that I'lll have to upgrade to the paid version (which I'm not opposed to I just want to be sure it's supposed to say that).

Are all the boxes on the first tab supposed to be checked as well?

I assume you are talking about this page.


Leave that page alone.

ON this page:

Here you need to select everything except:
Scan only known file types.
Display Scan Option in Explorer Context.

Then you just need to hit CLOSE and that will take you back to the main control page.



On that page you need to hit Check for updates and let it update. After it finishes that then you hit Scan your Computer.



ON that page you need to make sure on the left side that your hard drive is selected on the right side select FULL SCAN not the quick scan. Then hit next. After the scan finishes you will be presented with a list of bad stuff with check boxes. CHECK ALL OF THEM and hit next to remove them.

Then you will be finished with Superantispyware and can move on to malwarebytes.

Hope this helps.

[diundasmink]

Oh, okay. Thank you!

[ehib8yPc]

Nline,

The superspyware thing got a few things that per them were low risk.

But, the malware found 2 things and got rid of them (don't know if they were the problem or not):
1. adware.mywebsearch that infected the registry keys (whatever that means).
2. files infected: c:/install.exe (trojan.agent).

When I attempted to run the Hijack This it popped up with a message that said something like you need to edit the file yourself for some reason your system denied access to the Host's file. Then, it told me to run Hijack this as Administrator. Which I did.

The weird thing is there weren't that many things running like when I used Hijack This before. I was able to fit it all in one PM. Last time I it took 4 of them.

I'm paranoid about posting the log for all to see, since there be some crazy folks who float through MOF, and I don't know enough about this stuff to know if I would be handing them the keys to my front door. My Chinese hackers have made me a paranoid woman.

[htDgExh8]

Nline,

The superspyware thing got a few things that per them were low risk.

But, the malware found 2 things and got rid of them (don't know if they were the problem or not):
1. adware.mywebsearch that infected the registry keys (whatever that means).
2. files infected: c:/install.exe (trojan.agent).

When I attempted to run the Hijack This it popped up with a message that said something like you need to edit the file yourself for some reason your system denied access to the Host's file. Then, it told me to run Hijack this as Administrator. Which I did.

The weird thing is there weren't that many things running like when I used Hijack This before. I was able to fit it all in one PM. Last time I it took 4 of them.

I'm paranoid about posting the log for all to see, since there be some crazy folks who float through MOF, and I don't know enough about this stuff to know if I would be handing them the keys to my front door. My Chinese hackers have made me a paranoid woman.

Rerun that Hijackthis log. It didn't run correctly. Also POST IT HERE. There is ANYTHING that can personally identify you in a Hijackthis log or give the world access to your computer. It is just a list of what is running on your computer. Thousands of hijackthis logs are posted on help forums everyday. If it was a risk I would not ask you to use it. If you are using Vista then you need to run it as an administrator. Right click on the icon and from the menu that pops up select run as administrator.

[Abaanto]

Hmmm....Is this longer or is it the same. Could my hijack be hijacked? I guess I might as well go order a pizza.

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Users\MelanieB35\Downloads\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.ex e
C:\Program Files\OverDrive Media Console\MediaConsole.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...vilion&pf=cnnb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch

[egoldhyip]

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton 360\Engine\3.5.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.ex e" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LoadMSvcmm] "C:\Program Files\Blockbuster\BLOCKBUSTERMovielink\Movielink User.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: *.netzero.com
O15 - Trusted Zone: *.netzero.net
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite....x/qtplugin.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/tech...bs/tgctlsr.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton 360\Engine\3.5.2.11\coIEPlg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Movielink Core Service - Blockbuster - C:\Program Files\Blockbuster\BLOCKBUSTERMovielink\MovielinkCo re.exe
O23 - Service: Norton 360 (N360) - Symantec Corporation - C:\Program Files\Norton 360\Engine\3.5.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 10756 bytes

[Pashtet]

Looks ok except the host file reference.

Can you start notepad and then use it to open the following file

"C:\Windows\System32\drivers\etc\hosts"

Copy and post that here.

Thanks.

[Blolover11]

# Copyright (c) 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
::1 localhost

[br`lorance]

Ok that too is clean.

Tell us more about this intrusion attempt.

What exactly,step by step, are you doing when this pops up?

[Shiplyopidomi]

Ok that too is clean.

Tell us more about this intrusion attempt.

What exactly,step by step, are you doing when this pops up?

I can't think specifically of what I was doing when I would notice it. I think just looking stuff up using google. I would notice it on occasion above the address bar. For example, right now it says "Myopenforum-reply to topic-windows internet explorer" like it's supposed to, but other times it would be Chinese jibberish. It didn't seem to be linked to a specific website that I could tell. Any time I saw it, I would try and log off and it would say I was prevented from logging off because the chinese program was running. So, I would have to do a hard boot. It didn't show in my running tasks which made me wonder if it has corrupted a legitimate program.

We'll see if it pops up again. Maybe the steps you had me do got rid of my pest.

[SergZHy67]

Ok but what where you doing when you got messages about this:

medical-static-center.ru:8080/filez/readme.pdf

[PPActionnGuys]

Ok but what where you doing when you got messages about this:

medical-static-center.ru:8080/filez/readme.pdf

I had a bunch of windows open, so I can't really pinpoint what I was doing. If this happens again, I will try and pay more attention to what all I have open at the time. So, far no more warnings or Chinese characters. Fingers crossed.

Thanks for all your help. It's much appreciated.

[CreativeSuiteDown]

This so PC!! ROFLMFAO!

Buy a Mac. Less headache. Better programs. Much better resolution and fine tuning. Microsoft and PC's have been the biggest scam and conspiracy of all time.