IE redirects to http://www.dh005.com/?72 yet internet options has homepage to to www.yahoo.com. Have ran Kapersky Webscanner, Adaware, AdawareAway Anti-malware, Trend Micro House Call. Spybot S&D, Malwarebytes Anti-malware, AVG and each restart it finds each finds either same things or new objects. Windows XP OS.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:44:34 PM, on 5/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Wednesday, May 12, 2010
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, May 12, 2010 17:18:03
Records in database: 4100928
Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes
Scan area My Computer
A:\
C:\
D:\
Scan statistics
Objects scanned 50323
Threats found 3
Infected objects found 8
Suspicious objects found 0
Scan duration 00:39:40
File name Threat Threats count
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\10 Infected: Trojan-Downloader.Win32.Geral.chl 1
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\11 Infected: Trojan-Downloader.Win32.Geral.chl 1
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\12 Infected: Trojan-Downloader.Win32.Geral.chl 1
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\13 Infected: Trojan-GameThief.Win32.OnLineGames.wsvc 1
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\14 Infected: Trojan-PSW.Win32.Kykymber.enf 1
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\7 Infected: Trojan-PSW.Win32.Kykymber.enf 1
C:\Documents and Settings\Administrator\Local Settings\Temp\HouseCall\log\048D7F9C-9DBF-478A-B360-19807DBC14F2\backup\9 Infected: Trojan-Downloader.Win32.Geral.chl 1
Scan ""Scheduled scan"" was finished."
"Infections";"18";"18";"0"
"Folders selected for scanning:";"Scan whole computer"
"Scan started:";"Wednesday, May 12, 2010, 3:43:44 PM"
"Scan finished:";"Wednesday, May 12, 2010, 3:50:40 PM (6 minute(s) 55 second(s))"
"Total object scanned:";"122532"
"User who launched the scan:";"SYSTEM"
"Infections"
"File";"Infection";"Result"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP22\A0007163.sys";"Trojan horse BackDoor.Generic12.BJPG";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP22\A0007162.dll";"Virus identified Win32/Patched.CM";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0007130.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0007116.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0007088.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0007074.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0006074.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0006051.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP21\A0006010.exe";"Trojan horse Downloader.Generic9.AXYS";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP20\A0004846.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004749.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004739.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004733.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004721.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004703.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004683.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004621.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
"C:\System Volume Information\_restore{ADF03400-6217-45DA-8A19-7AB9D0B00E7C}\RP19\A0004590.sys";"Trojan horse Agent2.TWO";"Moved to Virus Vault"
Not sure what else to do as this occurs each restart and it has disabled Zonealarms firewall from start-up and even after reinstalling ZA, it disables it on next restart, have to manually start ZA. Any help would be greatly appreciated.
run the same antivirus junk in safe mode.. it's finding the crap each time but as it's embedded itself in the registry every time you start up it reinstalls itself..
