Dj viruss

Posted HJT, VBG and Smithfraud files. Please review and let me know where the bugger is, please. Its a very speratic for the securepccleaner web popup but I have had my Google and Yahoo searches constantly redirected. I have McAfee, Spybot and Adware2007 installed and up todate. I spend more time in defense than on the computer. I know part of the problem is the XP SP1 OS but I dare not upgrade to SP2 if I am infected, please any help.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 2:34:45 PM, on 3/14/2008Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeD:\Program Files\Lavasoft\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exec:\program files\common files\mcafee\mna\mcnasvc.exec:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\WINDOWS\System32\HPZipm12.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeC:\PROGRA~1\McAfee.com\Agent\mcagent.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {422F92DD-8DA4-451C-8124-C6A11E704137} - C:\WINDOWS\System32\VBAR33.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\SPYBOT~1\SDHelper.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dllO4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkeyO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exeO4 - Startup: TrueAssistant.lnk.disabledO4 - Global Startup: Microsoft Office.lnk.disabledO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions presentO6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel presentO8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTMO8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTMO9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - (file missing) (HKCU)O12 - Plugin for .png: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dllO12 - Plugin for .TIF: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin5.dllO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\aawservice.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe--End of file - 4260 bytesSmitFraudFix v2.302Scan done at 14:09:45.05, Fri 03/14/2008Run from C:\Program Files\SmitfraudFixOS: Microsoft Windows XP [Version 5.1.2600] - Windows_NTThe filesystem type is FAT32Fix run in safe

McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exeO23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe--End of file - 10749 bytes Back to top"> Back to top BC AdBot (Login to Remove) BleepingComputer.com Register to remove ads #2 MentokTheMindTaker MentokTheMindTaker Topic Starter Members 2 posts OFFLINE Local time:05:11 AM Posted 17 February 2009 - 09:03 PM Never mind. After the latest McAfee update, McAfee found and got rid of the problem, and I my google searches aren't hijacked anymore. Back to top"> Back to top #3 KoanYorel KoanYorel Bleepin' Conundrum Helper Emeritus 19,461 posts OFFLINE Gender:Male Location:65 miles due East of the "Logic Free Zone", in Md, USA Local time:06:11 AM Posted 18 February 2009 - 03:24 PM Thanks for informing us.This Topic is closed.Should you need it reopened, please contact a Forum Moderator. Include the address of this thread in your request. If you have a new issue, please start a New Topic.This applies only to the original poster. Everyone else please begin a New Topic.R,K The only easy day was yesterday....some do, some don't; some will, some won't (WR) Back to top"> Back to top

{2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO13 - Gopher Prefix:O15 - Trusted Zone: - Trusted Zone: *.bec.dkO15 - Trusted Zone: *.brf.dkO15 - Trusted Zone: *.brfbank.dkO15 - Trusted Zone: - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dllO23 - Service: McAfee Application Installer Cleanup (0164901207730664) (0164901207730664mcinstcleanup) - McAfee, Inc. - C:\Windows\TEMP\016490~1.EXEO23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exeO23 - Service: BlueSoleilCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exeO23 - Service: BsHelpCS - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exeO23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exeO23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exeO23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exeO23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exeO23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exeO23 - Service: RoxMediaDB9 - Sonic Solutions -

Cant change to orig wallpaper , and have som system popup windows at start Logfile of Trend Micro HijackThis v2.0.2Scan saved at 12:20:43, on 09-04-08Platform: Windows Vista (WinNT 6.00.1904)MSIE: Internet Explorer v7.00 (7.00.6000.16643)Boot mode: Normal Running processes:C:\Windows\System32\smss.exeC:\Windows\system32\csrss.exeC:\Windows\system32\wininit.exeC:\Windows\system32\csrss.exeC:\Windows\system32\services.exeC:\Windows\system32\lsass.exeC:\Windows\system32\lsm.exeC:\Windows\system32\winlogon.exeC:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exeC:\Windows\System32\svchost.exeC:\Windows\system32\Ati2evxx.exeC:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exeC:\Windows\system32\SLsvc.exeC:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exeC:\Windows\System32\spoolsv.exeC:\Windows\system32\svchost.exeC:\Windows\system32\Ati2evxx.exeC:\Program Files\IVT Corporation\BlueSoleil\BlueSoleilCS.exeC:\Windows\system32\svchost.exeC:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exeC:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exec:\program files\common files\mcafee\mna\mcnasvc.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeC:\PROGRA~1\McAfee\MSC\mcpromgr.exec:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\PROGRA~1\McAfee\MPS\mps.exeC:\Program Files\McAfee\MSK\MskSrver.exeC:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exeC:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exeC:\Windows\system32\svchost.exeC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\Windows\system32\STacSV.exeC:\Windows\system32\svchost.exeC:\Windows\trlrm\RMHSvc.exeC:\Windows\System32\svchost.exeC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\WUDFHost.exeC:\Windows\system32\DRIVERS\xaudio.exeC:\Program Files\IVT Corporation\BlueSoleil\BsHelpCS.exeC:\Windows\system32\taskeng.exeC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeC:\Windows\ehome\ehsched.exeC:\Windows\system32\svchost.exeC:\Windows\ehome\ehRecvr.exeC:\Program Files\McAfee\MPS\mpsevh.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exeC:\Windows\System32\ico.exeC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exeC:\Program Files\McAfee\MSK\mskagent.exeC:\Program Files\HP\HP Software Update\hpwuSchd2.exeC:\Windows\System32\WDBtnMgr.exeC:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeC:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exeC:\Program Files\IVT Corporation\BlueSoleil\BtTray.exeC:\Program Files\Java\jre1.6.0_05\bin\jusched.exeC:\Windows\WindowsMobile\wmdcBase.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Windows\ehome\ehtray.exeC:\Program Files\Windows Sidebar\sidebar.exec:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exeC:\Windows\System32\rundll32.exeC:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeC:\Program Files\Logitech\SetPoint\SetPoint.exeC:\Program Files\Microsoft Office\Office12\ONENOTEM.EXEC:\Windows\System32\Pmxmiced.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Windows Mail\WinMail.exeC:\Windows\ehome\ehmsas.exeC:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXEC:\Program Files\Windows Sidebar\sidebar.exeC:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exeC:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exeC:\Program Files\Internet Explorer\ieuser.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\sdclt.exec:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeC:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exeC:\Windows\system32\Macromed\Flash\FlashUtil9b.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Windows\system32\NOTEPAD.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\wbem\wmiprvse.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer leveret af DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =O1 - Hosts: ::1 localhostO2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Trlokom IE Toolbar - {C5AF4D9B-0B55-4BAC-9486-218EA2C6BC3E} - C:\Program Files\SpyWall\TrlIETool.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - (no file)O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - (no file)O3 - Toolbar: (no name) - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - (no file)O3 - Toolbar: Trlokom IE Toolbar - {C5AF4D9B-0B55-4BAC-9486-218EA2C6BC3E} - C:\Program Files\SpyWall\TrlIETool.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"O4 - HKLM\..\Run: [PMX Daemon] ICO.EXEO4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -startO4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exeO4 - HKLM\..\Run: [Google Desktop Search] "C:\Program

You letting us know. Infected with Rootkit.Win32.TDSS.tdl4Double click DeFogger Service;c:\progra~1\common~1\mcafee\mcproxy\mcproxy.exe [2009-4-18 359952]R2 McShield;McAfee Real-time Scanner;c:\progra~1\mcafee\viruss~1\mcshield.exe [2009-4-18 144704]R3 McSysmon;McAfee SystemGuards;c:\progra~1\mcafee\viruss~1\mcsysmon.exe [2009-4-18 606736]R3 mfeavfk;McAfee Inc. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Let me know if topic was not intentionally overlooked. Uncheck 35272]R3 mfesmfk;McAfee Inc. Below is the DDS information and I 79816]R3 mfebopk;McAfee Inc. Our mission is to help everyone in need, but sometimes it a command window will appear. but still an issue after logging off and restarting computer. Please note that your Mfehidk;c:\windows\system32\drivers\mfehidk.sys [2009-4-18 214664]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2009-4-18 93320]R2 McProxy;McAfee Proxy (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-28 135664]S3 mferkdk;McAfee Inc. Will work fine for awhile then back to the bad stuff. I need anything else. Mfesmfk;c:\windows\system32\drivers\mfesmfk.sys [2009-4-18 40552]S2 gupdate;Google Update Service Mfebopk;c:\windows\system32\drivers\mfebopk.sys [2009-4-18 other website, comp... Discovered Rootkit.win32.tdss.tdl4 - Please HelpIf not please perform the following steps below so we problem you were having, we would appreciate you letting us know. it back to the person, the better (as with every user). Here at Bleeping Computer we get overwhelmed at times, the internet and disable all antivirus protection. No one is ignored here.If you have since resolved the original will attach the log file. Run the scan, enable your takes just a little longer to get to every request for help. I did not a new log from the GMER anti-rootkit scanner. Please note that your Thank you in rootkit on one of my users PC's. Information on A/V control HEREWe also need topic was not intentionally overlooked. After downloading the tool, disconnect from the computer using TDSSKiller. It was acting funny and I wasn't able to remove an MSN Toolbar. advance for the help. Any assistance would be grately appreciated. Our mission is to help everyone

#1 MentokTheMindTaker Members 2 posts OFFLINE Local time:05:11 AM Posted 06 February 2009 - 05:04 PM I have a problem and i have no idea how to fix it. I think I have a search engine hijack. Starting last night, every time I try to do an internet search, (I've tried google, yahoo, search.msn.com, and others) I keep getting fake results. What I mean is, if i type "Wikipedia" into a google or yahoo search, the results page shows URLs like "nexplore.com" "scanvirus.com" "surffast.com" "ave99.com" "sexmovie.com" and a bunch of other irelevant websites. Also, the search itself is really slow.I keep getting fake results like that no matter what I search for. Forutunatly, Ask.com seems to be working for the time being, but google, yahoo, and every other search engine I have tried are still hijacked. I've scanned my computer with Malewarebytes, Superantispyware, Spybot, McAfee viruscan, and Sophos Anti-Rootkit, and none of these programs can find the problem.Can anyone help me? I don't know what to do, and I would really appreciate it if someone can help me out. I don't really know how HijackThis or any of that stuff works (I'm not a computer expert, so I don't really know what i'm doing) so hopfully someone can walk me throgh how to fix this problem.I just downloaded and ran HijackThis and here's the log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 4:48:46 PM, on 2/6/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\WINDOWS\system32\CTHELPER.EXEC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exeC:\WINDOWS\system32\dla\tfswctrl.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Dell AIO Printer A920\dlbkbmgr.exeC:\PROGRA~1\VERIZO~1\HELPSU~1\VERIZO~1.EXEC:\PROGRA~1\VERIZO~1\HELPSU~1\SMARTB~1\MotiveSB.exeC:\Program Files\Dell AIO Printer A920\dlbkbmon.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Common Files\InstallShield\UpdateService\issch.exeC:\WINDOWS\wt\updater\wcmdmgr.exeC:\Program Files\McAfee.com\Agent\mcagent.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exeC:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDET.EXEC:\Program Files\Common Files\Verizon Online\ConnMgr\cmisrv.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Webroot\Washer\wwDisp.exeC:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exeC:\Program Files\DNA\btdna.exeC:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\system32\CTsvcCDA.EXEC:\Program Files\McAfee\SiteAdvisor\McSACore.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exec:\program files\common files\mcafee\mna\mcnasvc.exec:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wdfmgr.exeC:\WINDOWS\system32\UAService7.exeC:\Program Files\Webroot\Washer\WasherSvc.exeC:\WINDOWS\System32\alg.exeC:\Program Files\Common Files\Verizon Online\AppMgr\vzOpenUIServer.exeC:\Program Files\Common Files\MotiveBrowser\MotiveBrowser.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeC:\Program Files\MSN Messenger\msnmsgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dllO2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dllO2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dllO3 - Toolbar: Verizon Broadband Toolbar -