	[x] Posted via EE Mobile
	Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question

	[x] Attachment Details

[x]

The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

The Grade of the Solution
The Zone Rank of the Expert Providing the Solution
The Number of Author and Expert Comments
The Number of Experts Contributing
The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.2

Help with Hijackthis log to remove browser hijack

Asked by OldeEnglish in HijackThis Software

Tags: Hijackthis, virus, malware, spyware, trojan, rootkit, browser hijack, dns poisoning

Hi experts -

I've tried to do as much leg work as possible before posting, please let me know what else you need.

I am helping a relative with his computer. I believe he must have been infected with a virus or trojan which is hijacking some of his web activity. This happens in both IE and Firefox: He is able to browse to google.com for instance, but then his search results links redirect to unwanted pages when clicked. I ran hijackthis and analyzed it through the automatic analyzer on hijackthis.de. By comparing those results with some google searching I think I've identified a number of suspicious entries, but as I'm not very knowledgable about such things I'd like someone to help make sure I know what I'm doing before I destroy his computer! I've attached the full hijackthis log and the hijackthis startup log for review. Please let me know what I've missed, and especially if I should NOT have hijackthis fix the following entries!:

R3 - URLSearchHook: (no name) - {A4B8AF35-783A-9A9C-C1A9-B422E0576CB2} - teqq32.dll (file missing)File Missing

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)File Missing

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeCtfmon.exe

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1UpdateMgr

O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?cf7be09ab032493ba7ea5154fce752a6

O17 - HKLM\System\CCS\Services\Tcpip\..\{5BE4801C-2566-491C-8CE5-29B21CE8C5D0}: NameServer = 69.50.161.132,85.255.112.15Internet Settings

O17 - HKLM\System\CCS\Services\Tcpip\..\{B74CF85C-893A-4D7D-9324-DF8EDDFDA503}: NameServer = 69.50.161.132,85.255.112.15Internet Settings

O17 - HKLM\System\CCS\Services\Tcpip\..\{CB585ED0-E22F-42FC-95E9-8F61F89ED041}: NameServer = 69.50.161.132,85.255.112.15Internet Settings

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLAppInit_DLLs Registry value autorun.

O22 - SharedTaskScheduler: OLE Object - {9E9F0BCD-366B-44BA-AA12-314C9F9E839A} - blank (file missing)File Missing

O22 - SharedTaskScheduler: OLE Module - {190EE07F-D388-410c-A42D-11BD588E10FE} - blank (file missing)File Missing

P.S. does anyone know what trojan or virus his computer is infected with which would cause these symptoms? I've had no luck identifying it. Thanks!

View the Solution FREE for 30 Days

Attachments:

hijackthis.txt (14 KB) (File Type Details)

HijackThis log

StartupLog.txt (10 KB) (File Type Details)

HijackThis Startup log

Related Solutions

Keywords: Help with Hijackthis log to remove brow…

	Title
1	Hijackthis
2	hijackthis
3	Assistance with contents of Hijackthis …
4	Help with interpreting HiJackThis log
5	HIJACKTHIS log
6	HijackThis Log

Loading Advertisement...

20091021-EE-VQP-81 - Hierarchy / EE_QW_3_20080625

Hall of Fame

1. rpggamer...229,911
2. David-Ho...72,351
3. greyknigh...52,174
4. warturtle44,723
5. Admin3k40,905
6. johnb676718,184
7. IndiGenus17,552
8. optoma17,087
9. xmachine14,366
10. younghv11,440
11. Jonvee8,140
12. JeremySB...6,352
13. Computer...5,380
14. flubbster5,360
15. Dooflegna5,300
16. TK-775,250
17. dstewartjr5,000
18. nobus4,670
19. moh10ly4,640
20. dbrunton4,000
20. willcomp4,000
20. jhyiesla4,000
20. uucknaaa4,000
24. xxdcmast3,800
25. thinkpads...3,560

1. rpggamer...718,936
2. IndiGenus261,540
3. David-Ho...87,305
4. Admin3k66,840
5. greyknigh...62,699
6. warturtle44,723
7. johnb676728,627
8. Sheharya...26,160
9. phototropic25,080
10. Jonvee24,702
11. younghv22,155
12. orangutang19,765
13. optoma17,087
14. xmachine14,366
15. willcomp14,258
16. war113,875
17. nobus12,645
18. moh10ly11,715
19. rindi11,290
20. flubbster10,660
21. Firstedition09,800
22. 1972vet9,200
23. briancassin8,686
24. r-k7,845
25. devil_him...7,028

Help with Hijackthis log to remove browser hijack

Asked by OldeEnglish in HijackThis Software

Tags: Hijackthis, virus, malware, spyware, trojan, rootkit, browser hijack, dns poisoning

About this solution