Hi
Have an IE trojan redirecting every site I try to visit. Neither F-Secure or Norton has picked it up. Here is my Hijack This Log.
IF anyone can help me I would be really grateful.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:13:02, on 09/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TALKTA~1\backweb\81720\Program\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\crypserv.exe
C:\Program Files\TalkTalk Online Security\Anti-Virus\fsgk32st.exe
C:\Program Files\TalkTalk Online Security\backweb\81720\program\fsbwsys.exe
C:\Program Files\TalkTalk Online Security\Anti-Virus\FSGK32.EXE
C:\Program Files\TalkTalk Online Security\Common\FSMA32.EXE
C:\Program Files\TalkTalk Online Security\Common\FSMB32.EXE
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TalkTalk Online Security\Anti-Virus\fssm32.exe
C:\Program Files\TalkTalk Online Security\Common\FCH32.EXE
C:\Program Files\TalkTalk Online Security\Common\FAMEH32.EXE
C:\Program Files\TalkTalk Online Security\Anti-Virus\fsrw.exe
C:\Program Files\TalkTalk Online Security\FWES\Program\fsdfwd.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\TalkTalk Online Security\Anti-Virus\fsav32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAKE.EXE
C:\WINDOWS\VM_STI.EXE
C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Lexmark X5100 Series\lxbabmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\TalkTalk Online Security\Common\FSM32.EXE
C:\Program Files\TalkTalk Online Security\FSGUI\ispnews.exe
C:\Program Files\TalkTalk\bin\sprtcmd.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\PROGRA~1\TALKTA~1\ANTI-S~1\fsaw.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\TalkTalk Online Security\FSGUI\fsguidll.exe
C:\Program Files\Sony Corporation\Image Transfer\SonyTray.exe
C:\Program Files\TalkTalk Online Security\backweb\81720\Program\fspex.exe
C:\Program Files\Philips\SPC 300NC PC Camera\TrayMin.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Liz\Desktop\HiJackThis_v2\HiJackThis_v2.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 – HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 – HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 – HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O2 – BHO: Windows Live Sign-in Helper – {9030D464-4C02-4ABF-8ECC-5164760863C6} – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 – BHO: Kwyshell MidpX BHO – {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} – C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O3 – Toolbar: Kwyshell MidpX – {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} – C:\Program Files\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 – HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 – HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 – HKLM\..\Run: [VTTimer] VTTimer.exe
O4 – HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 – HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 – HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 – HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 – HKLM\..\Run: [EPSON PictureMate 100] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAKE.EXE /P21 “EPSON PictureMate 100” /O6 “USB001” /M “PictureMate 100”
O4 – HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 300NC PC Camera
O4 – HKLM\..\Run: [Lexmark X5100 Series] “C:\Program Files\Lexmark X5100 Series\lxbabmgr.exe”
O4 – HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 – HKLM\..\Run: [QuickTime Task] “C:\Program Files\QuickTime\qttask.exe” -atboottime
O4 – HKLM\..\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe”
O4 – HKLM\..\Run: [4oD] “C:\Program Files\Kontiki\KHost.exe” -all
O4 – HKLM\..\Run: [Sony Ericsson PC Suite] “C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe” /startoptions
O4 – HKLM\..\Run: [F-Secure Manager] “C:\Program Files\TalkTalk Online Security\Common\FSM32.EXE” /splash
O4 – HKLM\..\Run: [F-Secure TNB] “C:\Program Files\TalkTalk Online Security\TNB\TNBUtil.exe” /CHECKALL /WAITFORSW
O4 – HKLM\..\Run: [F-Secure Startup Wizard] “C:\Program Files\TalkTalk Online Security\FSGUI\FSSW.EXE” /reboot
O4 – HKLM\..\Run: [News Service] “C:\Program Files\TalkTalk Online Security\FSGUI\ispnews.exe”
O4 – HKLM\..\Run: [TalkTalk] “C:\Program Files\TalkTalk\bin\sprtcmd.exe” /P TalkTalk
O4 – HKCU\..\Run: [MsnMsgr] “C:\Program Files\MSN Messenger\MsnMsgr.Exe” /background
O4 – HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 – HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 – HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’)
O4 – HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’)
O4 – Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 – Global Startup: BTTray.lnk = ?
O4 – Global Startup: Image Transfer.lnk = ?
O4 – Global Startup: TalkTalk Online Security.lnk = C:\Program Files\TalkTalk Online Security\backweb\81720\Program\fspex.exe
O4 – Global Startup: TrayMin.lnk = ?
O8 – Extra context menu item: &Block this popup – C:\Program Files\TalkTalk Online Security\Anti-Spyware\blockpopups.htm
O8 – Extra context menu item: Add to Windows &Live Favorites – http://favorites.live.com/quickadd.aspx
O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 – Extra context menu item: Send To &Bluetooth – C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 – Extra button: IE Shield – {300DB664-75B5-47c0-8B45-A44ACCF73C00} – C:\Program Files\TalkTalk Online Security\Anti-Spyware\ieshield.dll
O9 – Extra ‘Tools’ menuitem: IE Shield… – {300DB664-75B5-47c0-8B45-A44ACCF73C00} – C:\Program Files\TalkTalk Online Security\Anti-Spyware\ieshield.dll
O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 – Extra button: @btrez.dll,-4015 – {CCA281CA-C863-46ef-9331-5C8D4460577F} – C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 – Extra ‘Tools’ menuitem: @btrez.dll,-4017 – {CCA281CA-C863-46ef-9331-5C8D4460577F} – C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 – Extra button: (no name) – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 – Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 – {e2e2dd38-d088-4134-82b7-f2ba38496583} – %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) – https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 – DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) – http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 – DPF: {54823A9D-6BAE-11D5-B519-0050BA2413EB} (ChkDVDCtl Class) – http://www.cyberlink.com/winxp/CheckDVD.cab
O16 – DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) – http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O17 – HKLM\System\CCS\Services\Tcpip\..\{11BC88A4-2CC3-4F69-ABCE-27578E30F016}: NameServer = 85.255.113.107,85.255.112.182
O17 – HKLM\System\CCS\Services\Tcpip\..\{8F514E42-84FE-4E48-B58C-5850BAC6FF27}: NameServer = 85.255.113.107,85.255.112.182
O17 – HKLM\System\CCS\Services\Tcpip\..\{A2382004-A2EE-488D-B3A2-DCBA10717707}: NameServer = 85.255.113.107,85.255.112.182
O17 – HKLM\System\CCS\Services\Tcpip\..\{CD8E722B-F3A3-491A-8318-7312EE4DB71A}: NameServer = 85.255.113.107,85.255.112.182
O17 – HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.182
O17 – HKLM\System\CS1\Services\Tcpip\..\{11BC88A4-2CC3-4F69-ABCE-27578E30F016}: NameServer = 85.255.113.107,85.255.112.182
O17 – HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.107 85.255.112.182
O22 – SharedTaskScheduler: Browseui preloader – {438755C2-A8BA-11D1-B96B-00A0C90312E1} – C:\WINDOWS\system32\browseui.dll
O22 – SharedTaskScheduler: Component Categories cache daemon – {8C7461EF-2B13-11d2-BE35-3078302C2030} – C:\WINDOWS\system32\browseui.dll
O23 – Service: TalkTalk Online Security (BackWeb Plug-in – 81720) – BackWeb Technologies Inc. – C:\PROGRA~1\TALKTA~1\backweb\81720\Program\SERVIC~1.EXE
O23 – Service: Bluetooth Service (btwdins) – WIDCOMM, Inc. – C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 – Service: Crypkey License – Unknown owner – C:\WINDOWS\SYSTEM32\crypserv.exe
O23 – Service: M-Audio Installer (EvoInstallerService) – Unknown owner – C:\Program Files\M-Audio\Install\EvoInst.exe (file missing)
O23 – Service: FSGKHS (F-Secure Gatekeeper Handler Starter) – Unknown owner – C:\Program Files\TalkTalk Online Security\Anti-Virus\fsgk32st.exe
O23 – Service: fsbwsys – Unknown owner – C:\Program Files\TalkTalk Online Security\backweb\81720\program\fsbwsys.exe
O23 – Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) – F-Secure Corporation – C:\Program Files\TalkTalk Online Security\FWES\Program\fsdfwd.exe
O23 – Service: F-Secure Management Agent (FSMA) – F-Secure Corporation – C:\Program Files\TalkTalk Online Security\Common\FSMA32.EXE
O23 – Service: InstallDriver Table Manager (IDriverT) – Macrovision Corporation – C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 – Service: InCD Helper (InCDsrv) – Nero AG – C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 – Service: iPod Service – Apple Computer, Inc. – C:\Program Files\iPod\bin\iPodService.exe
O23 – Service: KService – Unknown owner – C:\Program Files\Kontiki\KService.exe
O23 – Service: LexBce Server (LexBceS) – Lexmark International, Inc. – C:\WINDOWS\system32\LEXBCES.EXE
—
End of file – 12040 bytes
