how to get rid of unfirewall.net

Advertise at AfterDawn.com

Link to us!

Private messages

Compose a private message

List of all updated threads

Threads without replies

Search messages

Sunday 7.9.2025 / 22:12

Search AfterDawn Forums:

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > how to get rid of unfirewall.net

Browse by topic

Forums

Start a new thread

how to get rid of unfirewall.net

Jump to:

Posted

Message

shivak

Newbie

31. August 2007 @ 02:37

Link to this message

hi
plz give me solution to my problem
my IE was infected by unfirewall.net
plz try give me solution
here with iam attaching
hijackthis log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:43:57 PM, on 8/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\heap41a\svchost.exe
C:\heap41a\svchost.exe
C:\WINDOWS\svhost.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://unfirewall.net
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = :: UnFireWall.Net...
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Task Manager] C:\WINDOWS\svhost.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [status] present
O4 - HKLM\..\Policies\Explorer\Run: [winlogon] C:\heap41a\svchost.exe C:\heap41a\std.txt
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A50B9BE4-EF3C-444D-9F9D-64BA5DCC7BB0}: NameServer = 202.41.99.9,202.141.1.131
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O24 - Desktop Component 0: (no name) - http://www.bitsadmission.com/admn/applyo...ages/bitsat.jpg

--
End of file - 3746 bytes

[ + quote]

shiva

PeaInAPod

AfterDawn Addict

1 product review

2. September 2007 @ 19:39

Link to this message

Remove these....

C:\heap41a\svchost.exe

C:\heap41a\svchost.exe

C:\WINDOWS\svhost.exe

O4 - HKLM\..\Run: [Task Manager] C:\WINDOWS\svhost.exe

O4 - HKLM\..\Policies\Explorer\Run: [status] present

O4 - HKLM\..\Policies\Explorer\Run: [winlogon] C:\heap41a\svchost.exe C:\heap41a\std.txt

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O17 - HKLM\System\CCS\Services\Tcpip\..\{A50B9BE4-EF3C-444D-9F9D-64BA5DCC7BB0}: NameServer = 202.41.99.9,202.141.1.131

Also download an run this application to remove the worm W32/Sdbot-PY that you seem to be infected with. Also after removing these entries post a new HJT log.

[ + quote]

"Some people have no damn sense." - Nephilim, March 27 2007 @ 18:08

shivak

Newbie

5. September 2007 @ 02:42

Link to this message

Thank you veru much for ur suggestion
I am unable to delete C:\heap41a\svchost.exe
It was removed unfirewall.net successfully but
I got problem in downloading the software for removal of worm W32/Sdbot-PY from the site address given by you
Now I am getting msn.home page in IE plz try to give solution for this also
PLZ see the new log file added below

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:49:33 PM, on 9/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{A50B9BE4-EF3C-444D-9F9D-64BA5DCC7BB0}: NameServer = 202.41.99.9,202.141.9.131
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe

--
End of file - 2094 bytes

[ + quote]

shiva

PeaInAPod

AfterDawn Addict

1 product review

5. September 2007 @ 19:52

Link to this message

Well the program I linked to was McAfee Avert Stinger virus removal tool. It spefically removes the worm infecting your PC. But since you have McAfee as long as it is updated running a full system scan while in safe mode should take care of everything. And for msn.home being your homepage that is because we reset your homepage, you can just set it as you normally would. And your HJT log looks clean.

[ + quote]

"Some people have no damn sense." - Nephilim, March 27 2007 @ 18:08

rajput21

Newbie

12. September 2007 @ 08:39

Link to this message

@PeaInAPod

Quote:
And your HJT log looks clean.

1 entry still present in your fresh logs

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

remove this one also.

[ + quote]

Lets Fight against Spyware
http://www.noSpyware.freeforums.org

Start a new thread

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > how to get rid of unfirewall.net


		User name	Password

		Not registered yet? Register here. Lost your password? Click here.