Hi everyone,
I am only new here, and quite looking forward to getting to meet with a lot of you. But right now, I have a very frustrating problem that has only started today. Every time I start my Firefox browser, it starts to open up multiple tabs by itself, linking to all these search sites that I have never heard of. This is very frustrating for me especially when I am half way through researching something and then get lost in the paragraph because Firefox takes over. I have ran Anti-Virus scans and Anti-Spyware programs to no avail, I have even ran these scans in safe mode and still no success. I also have an an enoying pest which calls itself Malware-Crush which sits itself in my task tray down on the bottom right of the screen, when i try to close it, it just basically laughs at me and stays put. I have tried every thing that i can think of and now I have come to you in the hopes that someone can help me solve this problem. I have included a Hijackthis log with this post. I have no idea what any of these processors mean as I am only a PHP Developer and don't know much about these malicious software processes, although i would love to learn for future refferrence. Any help with these issues will be much appreciated.
Please note my Hijackthis Log:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:28:30 PM, on 8/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
- Running processes:
- C:\WINDOWS\System32\smss.exe
- C:\WINDOWS\system32\winlogon.exe
- C:\WINDOWS\system32\services.exe
- C:\WINDOWS\system32\lsass.exe
- C:\WINDOWS\system32\svchost.exe
- C:\WINDOWS\System32\svchost.exe
- C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
- C:\WINDOWS\system32\spoolsv.exe
- C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
- c:\Program Files\bigpond\security\App\syssvcnt.exe
- C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
- C:\WINDOWS\system32\crypserv.exe
- C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
- C:\WINDOWS\dnetc.exe
- c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
- C:\WINDOWS\system32\nvsvc32.exe
- C:\WINDOWS\system32\svchost.exe
- C:\WINDOWS\system32\UAService7.exe
- C:\Program Files\Webroot\Washer\WasherSvc.exe
- C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
- C:\WINDOWS\system32\wscntfy.exe
- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
- C:\WINDOWS\system32\ctfmon.exe
- C:\Program Files\bigpond\security\app\Console.exe
- D:\Program Files\iFinger\iFinger.exe
- C:\Program Files\Logitech\SetPoint\SetPoint.exe
- C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
- C:\WINDOWS\explorer.exe
- C:\WINDOWS\system32\taskmgr.exe
- C:\wamp\wampmanager.exe
- c:\wamp\bin\apache\apache2.2.6\bin\httpd.exe
- c:\wamp\bin\mysql\mysql5.0.45\bin\mysqld-nt.exe
- C:\wamp\bin\apache\apache2.2.6\bin\httpd.exe
- C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
- C:\Program Files\Zend\ZendStudio-5.5.0\bin\ZDE.exe
- C:\Program Files\Zend\ZendStudio-5.5.0\jre\bin\javaw.exe
- C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
- F:\Development Folder\Software-Development\HiJackThis_v2\HiJackThis_v2.exe
- R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
- R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
- R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
- N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\RICHARD WALKER\Application Data\Mozilla\Profiles\default\wwk1mlvn.slt\prefs.js)
- O2 - BHO: (no name) - {01226306-49F0-4A72-AAEF-0E03AA5CC279} - (no file)
- O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
- O2 - BHO: AuthPopupBHO01.cBHO - {3C7195F6-D788-4D50-BA72-2EE212EDAC78} - c:\Program Files\bigpond\security\App\popupbho01.dll
- O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
- O2 - BHO: iFinger plugin / Browser helper object - {A114D52B-870C-4F15-8021-B6D7F91A054B} - D:\PROGRA~1\iFinger\plugins\IE.ifp
- O2 - BHO: (no name) - {FED51DF2-9644-4C58-9104-90244EDD6EEC} - (no file)
- O3 - Toolbar: Zend Studio - {95188727-288F-4581-A48D-EAB3BD027314} - C:\PROGRA~1\Zend\ZENDST~1.0\bin\ZENDIE~1.DLL
- O3 - Toolbar: BigPond Security Popup Blocker - {2C0A5F28-48D8-408B-9172-9C6121025BCE} - c:\Program Files\bigpond\security\App\popupbho01.dll
- O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
- O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
- O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
- O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
- O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
- O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
- O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
- O4 - HKLM\..\Run: [lxddmon.exe] "C:\Program Files\Lexmark 2500 Series\lxddmon.exe"
- O4 - HKLM\..\Run: [lxddamon] "C:\Program Files\Lexmark 2500 Series\lxddamon.exe"
- O4 - HKLM\..\Run: [MSDrive] "rundll32.exe" C:\WINDOWS\system32\drvcag.dll,startup
- O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
- O4 - HKLM\..\Run: [ESP] c:\Program Files\bigpond\security\app\start.exe
- O4 - HKCU\..\Run: [LDM] "C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"
- O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- O4 - HKCU\..\Policies\Explorer\Run: [NTSecurity] NTSecurity.exe
- O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
- O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
- O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
- O4 - Global Startup: iFinger 2.1.lnk = D:\Program Files\iFinger\iFinger.exe
- O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
- O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
- O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
- O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
- O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
- O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
- O8 - Extra context menu item: Zend Studio - Debug current page - res://C:\Program Files\Zend\ZendStudio-5.5.0\bin\ZendIEToolbar.dll/DebugCurrent.html
- O8 - Extra context menu item: Zend Studio - Debug next page - res://C:\Program Files\Zend\ZendStudio-5.5.0\bin\ZendIEToolbar.dll/DebugNext.html
- O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
- O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
- O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
- O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
- O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
- O9 - Extra button: iFinger - {936E5D60-596C-11D3-BB96-00600816DF55} - C:\WINDOWS\system32\SHDOCVW.DLL
- O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\WINDOWS\system32\shdocvw.dll
- O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
- O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
- O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
- O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
- O15 - Trusted Zone: http://*.download.microsoft.com
- O15 - Trusted Zone: http://*.update.microsoft.com
- O15 - Trusted Zone: http://*.windowsupdate.com
- O15 - Trusted Zone: http://*.windowsupdate.microsoft.com
- O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab
- O16 - DPF: {1B4F9DD7-2D7C-44B5-9126-73206DA0AE75} (CNavigationManager Object) - http://files.authentium.com/bp/rsau/bin/wizard.exe
- O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
- O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
- O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201932624703
- O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab
- O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
- O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows/Initial/VideoEggPublisher.exe
- O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O17 - HKLM\System\CS2\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O17 - HKLM\System\CS3\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O17 - HKLM\System\CS4\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O17 - HKLM\System\CS5\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O17 - HKLM\System\CS6\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
- O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
- O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
- O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - (no file)
- O20 - Winlogon Notify: mljihgh - mljihgh.dll (file missing)
- O21 - SSODL: zip - {8c23e867-9cbc-423e-be97-ce72369a2989} - C:\WINDOWS\Installer\{8c23e867-9cbc-423e-be97-ce72369a2989}\zip.dll
- O21 - SSODL: PrxPrx - {af21b5f5-a1dc-4562-ad47-ad07e61345f8} - C:\WINDOWS\Installer\{af21b5f5-a1dc-4562-ad47-ad07e61345f8}\PrxPrx.dll
- O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
- O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
- O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
- O23 - Service: Acer Media Server - Acer Inc. - C:\Program Files\Acer\Acer eConsole\MediaServerService.exe
- O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
- O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
- O23 - Service: BigPond Security System Service (AuthSysSvc) - Authentium, Inc. - c:\Program Files\bigpond\security\App\syssvcnt.exe
- O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLCapSvc.exe
- O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer TV-FM\Kernel\TV\CLSched.exe
- O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe
- O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer TV-FM\Kernel\CLML_NTService\CLMLServer.exe
- O23 - Service: distributed.net client (dnetc) - Distributed Computing Technologies, Inc. - C:\WINDOWS\dnetc.exe
- O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - c:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
- O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
- O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
- O23 - Service: lxddCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxddserv.exe
- O23 - Service: lxdd_device - - C:\WINDOWS\system32\lxddcoms.exe
- O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - (no file)
- O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
- O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
- O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
- O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.6\bin\httpd.exe
- O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.45\bin\mysqld-nt.exe
- O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe
End of file - 12719 bytes
Once again thank you for any help you can give:)
<snip>[EMAIL][/EMAIL]</snip>
