winfixer removal

Question

hi   this winfixer and blackworm is irritating., somkeone pls help me to remove.. i have tried all possible scanners (mcafee to trend micro.) i have used adawre, spyware doctor, spysubtract, spoybot, windows defender, trojan hunter). i have tried to used latest version of vundofix, and someother softwares as well still these popups come on. i have tried in  safe mode also. (everything). it shows nothing detected (vundofix) but still popups. i also get a  msg says 'there has been a security breach by blackworm .....'   log file   Logfile of HijackThis v1.99.1 Scan saved at 10:56:55, on 21/03/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32undll32.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\WINDOWS\system32\IDispChg.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe C:\PROGRA~1\WINZIP\winzip32.exe C:\Documents and Settings\Subramanian Selvam\Local Settings\Temp\HijackThis.exe R3 - Default URLSearchHook is missing O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] 'C:\Program Files\MSN Messenger\msnmsgr.exe' /background O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O20 - Winlogon Notify: Unimodem - C:\WINDOWS\system32\e002lado1d0c.dll   then vundo fix   VundoFix V4.2.33 Checking Java version... Java version is 1.4.2.5 Scan started at 11:14:38 14/03/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.33 Checking Java version... Java version is 1.4.2.5 Scan started at 11:18:26 14/03/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.33 Checking Java version... Java version is 1.4.2.5 Scan started at 11:23:15 14/03/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.33 Checking Java version... Java version is 1.4.2.5 Scan started at 01:12:17 17/03/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.33 Checking Java version... Java version is 1.4.2.5 Scan started at 00:27:30 19/03/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.33 Checking Java version... Sun Java not detected Scan started at 01:58:03 23/03/2006 Listing files found while scanning.... No infected files were found. VundoFix V4.2.35 Checking Java version... Java version is 1.5.0.6 Scan started at 03:47:19 23/03/2006 Listing files found while scanning.... No infected files were found.     and VBG [03/23/2006, 1:57:02] - VirtumundoBeGone v1.5 ( 'C:\Documents and Settings\Subramanian Selvam\Desktop\VirtumundoBeGone.exe' ) [03/23/2006, 1:57:09] - Detected System Information: [03/23/2006, 1:57:09] -  Windows Version: 5.1.2600, Service Pack 2 [03/23/2006, 1:57:09] -  Current Username: Subramanian Selvam (Admin) [03/23/2006, 1:57:09] -  Windows is in NORMAL mode. [03/23/2006, 1:57:09] - Searching for Browser Helper Objects: [03/23/2006, 1:57:09] - Finished Searching Browser Helper Objects [03/23/2006, 1:57:09] - Finishing up... [03/23/2006, 1:57:09] - Nothing found! Exiting... [03/23/2006, 2:01:43] - VirtumundoBeGone v1.5 ( 'C:\DOCUME~1\SUBRAM~1\LOCALS~1\Temp\Temporary Internet Files\Content.IE5\0JKL4N67\VirtumundoBeGone[1].exe' ) [03/23/2006, 2:01:45] - Detected System Information: [03/23/2006, 2:01:45] -  Windows Version: 5.1.2600, Service Pack 2 [03/23/2006, 2:01:45] -  Current Username: Subramanian Selvam (Admin) [03/23/2006, 2:01:45] -  Windows is in NORMAL mode. [03/23/2006, 2:01:45] - Searching for Browser Helper Objects: [03/23/2006, 2:01:45] - Finished Searching Browser Helper Objects [03/23/2006, 2:01:45] - Finishing up... [03/23/2006, 2:01:45] - Nothing found! Exiting...   pls help

bamajim · Answer

krssubbu1

Looks like you've tried a number of fixes, however your HJT log is incomplete.

Please rescan your log and post it here

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

an let someone look at your log

bamajim

krssubbu1 · Answer

Logfile of HijackThis v1.99.1Scan saved at 00:20:28, on 24/03/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32undll32.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Java\jre1.5.0_06\bin\jusched.exeC:\Program Files\Spyware Doctor\swdoctor.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\WINDOWS\system32\IDispChg.exeC:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exeC:\Program Files\Spyware Doctor\sdhelp.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exeC:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exeC:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exeC:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Yahoo!\Messenger\YPager.exeC:\Documents and Settings\Subramanian Selvam\Desktop\HijackThis.exe R3 - Default URLSearchHook is missingO3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dllO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exeO4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /QO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.htmlO8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.htmlO8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.htmlO8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.htmlO8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.htmlO8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.htmlO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dllO9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1 \SPYWAR~1	ools\iesdpb.dllO20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32
04s0ah7ed4.dllO23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe thats all is listed help

bamajim · Answer

krssubbu1

Thank your for reposting your log however

please repost your HJT log at the link below

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

the HJT experts don't usually work logs on this board

Thanks

bamajim

Virus & Spyware

Was this post helpful?