Internet Explorer Opens By Itself

Question

Hi!  Internet Explorer opens a blank page by itself, called Gamma or Planet.nana, it installs a v3 package in C: drive along with an exe. file called x and another called Secure. I don't know what program is causeing this. Im DOS mode I deleted offline files, and did the normal procedure, but I don't have a virus according to Norton, Adware or Spybot S&D. I've tried CWShredder, but it doesn't go away, I have also tried TrendMicro. What else can I do? Please & ThankYou Cheers!

Midnight Star · Answer

Jean B., Post us up a HiJackThis log to look at, and we'll see what's running on your pc that might be causing it. Mike.

Jean B. · Answer

Why DELL? => 'I LIKE THE WAY THEY DO BUSINESS.' 'I have to see things at the ground level to understand.'                                                         --George Simpson Success is 1 percent inspiration and 99 percent perspiration. Nothing great is ever achieved without enthusiam. ---------------------------------------------------------X Logfile of HijackThis v1.97.7Scan saved at 12:41:03 AM, on 11/6/2004Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\WINDOWS\System32egscan32.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Logitech\MouseWare\system\em_exec.exeC:\Program Files\Messenger\msmsgs.exeC:\WINDOWS\System32\ctfmon.exeC:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeC:\Program Files\WinTV\Ir.exeC:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exeC:\Program Files\Webshots\WebshotsTray.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton AntiVirus
avapsvc.exeC:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXEC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\WINDOWS\System32\wuauclt.exeC:\WINDOWS\System32\WISPTIS.EXEC:\Program Files\Norton AntiVirus\SAVScan.exeC:\Program Files\MSN\MSNCoreFiles\MSN6.EXEC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Documents and Settings\Jean A. Boveri\Desktop\Internet\Privacy & Maintenance\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blankR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blankO2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.ExeO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [Windows Registry Scan] regscan32.exeO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [Windows Compliant] ffheja.exeO4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\RunServices: [Windows Registry Scan] regscan32.exeO4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exeO4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exeO4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exeO4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO4 - Global Startup: Reality Fusion GameCam SE.lnk = ?O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra 'Tools' menuitem: Sun Java Console (HKLM)O9 - Extra button: Research (HKLM)O9 - Extra button: Real.com (HKLM)O9 - Extra button: Messenger (HKLM)O9 - Extra 'Tools' menuitem: Messenger (HKLM)O16 - DPF: ppctlcab - O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - O16 - DPF: {3334504D-9980-0010-8000-00AA00389B71} - O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} (Office Update Installation Engine) - O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - O17 - HKLM\System\CCS\Services\Tcpip\..\{0948447C-BD2A-4F45-A4BB-3C3A320D86A6}: NameServer = 209.197.128.2,209.197.128.5O17 - HKLM\System\CS1\Services\Tcpip\..\{0948447C-BD2A-4F45-A4BB-3C3A320D86A6}: NameServer = 209.197.128.2,209.197.128.5O17 - HKLM\System\CS2\Services\Tcpip\..\{0948447C-BD2A-4F45-A4BB-3C3A320D86A6}: NameServer = 209.197.128.2,209.197.128.5

Midnight Star · Answer

Jean, Good work on posting your log! I can already see that your pc has an about:blank infection. Let's download, run and post back a new log using the newest version of HijackThis; version 1.98.2. This might pick up even more 'nasties' hiding in there, than the previous version did. Let's wait and see if anything else is in there before we try to 'fix' it. Also, when you post back, please include any 'Add/Remove program' entry(s) that include the words 'search', 'new', 'toolbar', etc., or any others that you don't recognize. Mike.

Jean B. · Answer

HI   The One Minute Manager:       The best minute I spend is the one I invest in people. (p. 63) Goals begin behavior, consequences maintain behavior. (p. 97) Share it with others. (p. 107) Hey, there is someone at the other side;)   Here is the Hijack this log you requested, I don't know how to post the add/remove program.   thanks very much!   Cheers Up!!!   Logfile of HijackThis v1.99.0 Scan saved at 11:17:23 AM, on 12/22/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Norton AntiVirus
avapsvc.exe C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\WINDOWS\System32\bsc32.exe C:\WINDOWS\System32\svchosts.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Google\deskbar-0.5.95.0\ggviewer.exe C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe C:\Program Files\WinTV\Ir.exe C:\Program Files\Reality Fusion\Reality Fusion GameCam SE\Program\RFTRay.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Hewlett-Packard\HP PrecisionScan\PrecisionScan LTX\hppsapp.exe C:\Program Files\Norton AntiVirus\SAVScan.exe C:\Program Files\Internet Optimizer\optimize.exe C:\WINDOWS\System32\SahAgent.exe C:\PROGRA~1\INTERN~1\iexplore.exe C:\PROGRA~1\Webshots\WebshotsTray.exe C:\WINDOWS\System32\WISPTIS.EXE C:\Program Files\MSN\MSNCoreFiles\MSN6.EXE C:\Program Files\MSN Messenger\msnmsgr.exe C:\unzipped\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php R3 - Default URLSearchHook is missing O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll O2 - BHO: BHO Class - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - C:\WINDOWS\ELITES~1\ELITES~1.DLL O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [Windows Compliant] ffheja.exe O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 4.0\SetHook.exe O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe O4 - HKLM\..\Run: [hGtyAS] C:\WINDOWS\odogbi.exe O4 - HKLM\..\Run: [Microsoft Services] C:\WINDOWS\System32\bsc32.exe O4 - HKLM\..\Run: [Windows Service] svchosts.exe O4 - HKLM\..\Run: [¢‰¸K0¨4W }ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\odogbi.exe O4 - HKLM\..\Run: [¢‰¸K0¨4W }ïÁzîžigÝC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\odogbi.exe O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 'EPSON Stylus Photo R300 Series' /O6 'USB002' /M 'Stylus Photo R300' O4 - HKLM\..\Run: [¢‰¸K0Ô@ÔÁß]§ú'ü‰üžiC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\odogbi.exe O4 - HKLM\..\Run: [¢‰¸K0Ô@ÔÁß]§ú'ü‰¸K0C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\odogbi.exe O4 - HKLM\..\Run: [Internet Optimizer] 'C:\Program Files\Internet Optimizer\optimize.exe' O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\System32\SahAgent.exe O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvixn32.exe O4 - HKLM\..\RunServices: [Microsoft Services] C:\WINDOWS\System32\bsc32.exe O4 - HKLM\..\RunServices: [Windows Service] svchosts.exe O4 - HKLM\..\RunOnce: [InstallShieldSetup] C:\PROGRA~1\INSTAL~1\{109D2~1\Setup.exe -rebootC:\PROGRA~1\INSTAL~1\{109D2~1eboot.ini  -l0x9 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: Reality Fusion GameCam SE.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE O16 - DPF: ppctlcab - http://69.44.122.156/scanner/ppctlcab.cab O16 - DPF: v3cab - http://searchmiracle.com/cab/5.cab O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} (MeadCo ScriptX Advanced) - https://www.epost.ca/printing/smsx.cab O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://69.44.122.156/scanner/axscanner.cab O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1095199142854 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {B1B7606A-D7B9-42A8-AFA2-476308413211} (VacPro.canada_ver4) - http://advnt01.com/dialer/canada_ver4.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0948447C-BD2A-4F45-A4BB-3C3A320D86A6}: NameServer = 209.197.128.2,209.197.128.5 O17 - HKLM\System\CS1\Services\Tcpip\..\{0948447C-BD2A-4F45-A4BB-3C3A320D86A6}: NameServer = 209.197.128.2,209.197.128.5 O17 - HKLM\System\CS2\Services\Tcpip\..\{0948447C-BD2A-4F45-A4BB-3C3A320D86A6}: NameServer = 209.197.128.2,209.197.128.5 O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Norton AntiVirus Auto Protect Service - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exe O23 - Service: Intel NCS NetService - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton Unerase Protection - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: SymWMI Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Jean B. · Answer

HI   The One Minute Manager:       The best minute I spend is the one I invest in people. (p. 63) Goals begin behavior, consequences maintain behavior. (p. 97) Share it with others. (p. 107)

zbestwun2001 · Answer

You have a lot of visitors. Have you run AdAwareSE and Spybot to get rid of what they find? Also, when you post back, please include any 'Add/Remove program' entry(s) that include the words 'search', 'new', 'toolbar', etc., or any others that you don't recognize. Just go into your add/remove program folder in your control panel and just write down the entries in your post that appear that Mike wanted you to look for. Steve Message Edited by zbestwun2001 on 12-22-2004 09:53 AM

Midnight Star · Answer

Jean,

And just when I thought it was safe to go back in the water ... :smileyvery-happy:

Let's get this sleigh a moving...

First, let's go to www.trendmicro.com and click "Free Online Scan". It'll take a few minutes to download and install. When it's down, select all available drives, then click "Scan". Let's see what it can find.

Reboot your computer into "Safe Mode"

Go to Add/Remove programs and remove(uninstall) the following:

SearchMiracle

Next, let's run HiJackThis, then:

   1. click " Config..."
   2. click " Misc Tools"
   3. click " Delete a file on reboot"
   4. browse to, then double-click on each of the file(s) below, one at a time:

        C:\WINDOWS\System32\bsc32.exe
        C:\WINDOWS\System32\svchosts.exe
        C:\WINDOWS\System32\SahAgent.exe
        C:\WINDOWS\odogbi.exe
        c:\windows\system32\kalvixn32.exe

ffheja.exe
(you'll have to locate this one.)

5. when prompted to " Reboot Now", after selecting each file, select " No"

In the lower-right hand-corner or HiJackThis, click " back" and click " Scan", then check(tick) the following, if present:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.searchmiracle.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchmiracle.com/sp.php

R3 - Default URLSearchHook is missing

O4 - HKLM\..\Run: [Windows Compliant] ffheja.exe
O4 - HKLM\..\Run: [hGtyAS] C:\WINDOWS\odogbi.exe
O4 - HKLM\..\Run: [Microsoft Services] C:\WINDOWS\System32\bsc32.exe
O4 - HKLM\..\Run: [Windows Service] svchosts.exe
O4 - HKLM\..\Run: [¢‰¸K0¨4W
O4 - HKLM\..\Run: [¢‰¸K0¨4W
O4 - HKLM\..\Run: [¢‰¸K0Ô@ÔÁß]§ú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\odogbi.exe
O4 - HKLM\..\Run: [¢‰¸K0Ô@ÔÁß]§ú"ü‰¸K0C:\Program Files\ISTsvc\istsvc.exe] C:\WINDOWS\odogbi.exe
O4 - HKLM\..\Run: [SAHAgent] C:\WINDOWS\System32\SahAgent.exe
O4 - HKLM\..\Run: [kalvsys] c:\windows\system32\kalvixn32.exe
O4 - HKLM\..\RunServices: [Microsoft Services] C:\WINDOWS\System32\bsc32.exe

O16 - DPF: v3cab - http://searchmiracle.com/cab/5.cab

Now, with all windows closed except HiJackThis, click " Fix checked".

Run " Disk Cleanup" and allow it to remove everything it finds; especially temporary internet files and offline content.

Reboot your computer normally.

Post back a new log.

Mike.

Virus & Spyware

Internet Explorer Opens By Itself

Was this post helpful?