No access to any Google page

[brakai295]

Hi there,

I can't believe it but I think somebody hijacked my browser. I can no longer access any Google page (whether .com or .de or ...) with my Internet Explorer. Firefox works fine.

As I've never heard of something like Browser Hijacking, I don't know what exactly to do. There is so much information on these pages that I don't know where to start. I DID run hijackthis and found some O17 codes with Nameserver-Entries that I deleted. But after a restart, my IE still won't show Google pages.

What else can/should I do?

Here my logfile:

Logfile of HijackThis v1.99.1
Scan saved at 3:57:40 PM, on 20/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\BenQ\BenQ Surround\BenQSurround.exe
C:\Program Files\BenQ\QPower\QPower.exe
C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Google\deskbar-0.5.95.0\ggviewer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Kai Brach\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.benq.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BenQ Surround] C:\Program Files\BenQ\BenQ Surround\BenQSurround.exe /s
O4 - HKLM\..\Run: [QPower] C:\Program Files\BenQ\QPower\QPower.exe /s
O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [Q-MediaBar] "C:\Program Files\BenQ\Q-MediaBar\QBar.exe" /stop
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://WWW.BenQ.COM/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

I just bought a new laptop and am very disappointed now, because I can't do much and want this problem fixed first.

BTW my host file (c:/windows/system32/drivers/etc/ has only got one entry: (127.0.0.1 localhost)


I appreciate any help ! THANKS,

Kai Brach

[Ruby]

Welcome to HijackThis.de @ brakai295

Please post your Logfiles in vB Code!....

1
Remember that Hijackthis must be run in an own folder.
C:\Program Files\HJT\HijackThis.exe or C:\HJT\HijackThis.exe
Only if Hijackthis runs in an own folder it will create backups!

Please change this: C:\Documents and Settings\Kai Brach\Desktop\HijackThis.exe

2
Make sure you set windows to see the hidden files and folders.

3
Run a Full System Scan by Panda ActiveScan.
It will last 2-3 hours. You will have to allow ActiveX.
Save the logfile.

4
Reboot the system when the scan is finished.

5
Configure then the IE with these Settings.

-> Post the Panda ActiveScan Logfile.
Thanks

[brakai295]

Hi'

thanks for your answer. I've done all the above. But I still can't access the Google pages... :_((((

Here the code of the PandaActiveScan

Incident                      Status                        Location                                                                                                                                                                                                                                                        

Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP11\A0001888.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP11\A0002862.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP11\A0002869.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP11\A0002874.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP11\A0002882.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP12\A0003134.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP12\A0003140.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP12\A0003144.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP12\A0003152.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP14\A0003308.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP14\A0003315.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP14\A0003321.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP14\A0003329.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP14\A0003335.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP14\A0003343.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP18\A0003583.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP18\A0003593.exe                                                                                                                                                                   
Adware:Adware/QuickWeb        No disinfected                C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003604.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003610.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003618.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003626.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003634.exe                                                                                                                                                                   
Virus:Trj/Downloader.EQS      Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003637.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\System Volume Information\_restore{641C0A29-0290-4527-89ED-270CBD43A683}\RP19\A0003645.exe                                                                                                                                                                   
Virus:Trj/Full.A              Disinfected                   C:\WINDOWS\system32\dmaae.exe

[Ruby]

@ brakai295
we are not finished yet
Let's go on cleaning up your system.

C:\Documents and Settings\Kai Brach\Desktop\HijackThis.exe is not at all the right place 
for HijackThis! 
It must run in an own folder to create BackUps: 
C:\HJT\Hijackthis.exe or C:\Program Files:\HJT\Hijackthis.exe

Please print out this instructions of safe it as a textfile (*.txt)
 since we ask you to work offline in safe mode.

Follow the numbers.

1
Turn off System Restore.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2
Reboot.

3
Turn System Restore Back On.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK

4
Reboot.

5
Turn off System Restore.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

6
Reboot.

7
Make sure you set windows to see the hidden files and folders.

8
Download for free:

CCleaner
Disk Cleaner
RegSeeker 1.45
Ad-Aware SE-> install and update it
Spybot Search & Destroy-> install and update it
CWShredder.
about:Buster,
unzip to C:\aboutbuster, run it, and then:

1. Click "Update".
2. Click "Check For Update"

9
Disconnect to the net.

10
Turn to  safe mode.

11
Close down all windows including Internet Explorer.
Run Hijackthis, click scan, and put a checkmark next to each of these items.
Then click the Fix Checked button:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = hzzp://www.benq.com/

Click on Fix Checked and exit HijackThis.

12
Stay in safe mode
run Ad-Aware SE (Adaware SE 1.05 Tutorial)
Take a full system scan.
Delete the content of all Ad-aware SE folders and the Quarantine box when the scan is finished.
Safe the logfile.

13
Stay in safe mode
Run Spybot Search & Destroy once more
Turn on Advanced Mode. Put a checkmark into every box.
Scan your system. Let Spybot Search & Setroy delete everything it finds.
Take the immunication for your system.

14
Stay in safe mode
Run CWShredder
press the *fix,* not the scan button
allow it to clean the infection.
Close all browser and explorer windows before hitting the fix button.

15
Stay in safe mode
Run about:Buster
4. Click "Start".
(Wait for the initial ADS scan to complete.)
5. Save the Logfile.
6. Click "Exit".

16
Reboot your system into normal mode.

17
Run the CCleaner
Put a Checkmark next to all items
under "Windows", "Applications" and "Issues".
Have a look to the screenshots.
Press the button "Run Cleaner".

18
 Empty your "Recycle Bin"
Go to START > run and type: cleanmgr and click ok.
Let it scan your system for files to remove.

19
Run the Disk Cleaner
Set a checkmark to every item you want to clean.
Temporary Internet Files and Temporary System Files, Cache, History and Prefetch must be cleaned.
Clean as much folders as you can clean.

20
Run the RegSeeker
Let the program delete everything it finds.

21
Turn System Restore Back On.
Right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK

22
Run HijackThis once more.
Have it save a new Logfile.
.

-> Post the Ad Aware SE Logfile
-> Post the About:Buster Logfile
-> Please post the new HJT-Logfile.

[brakai295]

I've gotten as far as downloading about:buster5.
I can't update it tho. It's giving me a Run-Time Error "5", if I try to run the program... (((

So I'll go on without the update.. :_(

later..

Kai

[brakai295]

oh my goooooood I'm about to throw this whole thing out of the window.
About:Buster won't work (tried on 2 other machines too). Always the same run-time error 5.

Regseeker crashed about 6 times. It gives me a nice exotic french error msg "violation d'access a l'adresse 003CA976. Lecture de l'adresse 001A9000" After trying it 6-7 times it eventually identified 300+ error, but when I selected them all and tried to delete them it would take 3 minutes to delete one entry and crash again after the frist 10..... AHHHHHHHH

I'll keep you posted (if I don't throw myself out of the window too...) ;-)

thanks ruby...

kai

[brakai295]

ok,

here the log files:

Ad-Aware

Ad-Aware SE Build 1.06r1
Logfile Created on:Tuesday, 20 September 2005 6:48:01 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R66 14.09.2005
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
MRU List(TAC index:0):9 total references
Tracking Cookie(TAC index:3):2 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings
===========================
Set : Search for negligible risk entries
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan my Hosts file

Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects


20-09-2005 6:48:01 PM - Scan started. (Full System Scan)

 MRU List Object Recognized!
    Location:          : C:\Documents and Settings\Administrator\recent
    Description        : list of recently opened documents


 MRU List Object Recognized!
    Location:          : S-1-5-21-2891326118-230710004-2670826002-500\software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct3d


 MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct3d


 MRU List Object Recognized!
    Location:          : S-1-5-21-2891326118-230710004-2670826002-500\software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct X


 MRU List Object Recognized!
    Location:          : software\microsoft\direct3d\mostrecentapplication
    Description        : most recent application to use microsoft direct X


 MRU List Object Recognized!
    Location:          : software\microsoft\directdraw\mostrecentapplication
    Description        : most recent application to use microsoft directdraw


 MRU List Object Recognized!
    Location:          : S-1-5-21-2891326118-230710004-2670826002-500\software\microsoft\microsoft management console\recent file list
    Description        : list of recent snap-ins used in the microsoft management console


 MRU List Object Recognized!
    Location:          : S-1-5-21-2891326118-230710004-2670826002-500\software\microsoft\search assistant\acmru
    Description        : list of recent search terms used with the search assistant


 MRU List Object Recognized!
    Location:          : S-1-5-21-2891326118-230710004-2670826002-500\software\microsoft\windows\currentversion\applets\wordpad\recent file list
    Description        : list of recent files opened using wordpad


Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]
    FilePath           : \SystemRoot\System32\
    ProcessID          : 132
    ThreadCreationTime : 20-09-2005 8:43:57 AM
    BasePriority       : Normal


#:2 [csrss.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 184
    ThreadCreationTime : 20-09-2005 8:44:15 AM
    BasePriority       : Normal


#:3 [winlogon.exe]
    FilePath           : \??\C:\WINDOWS\system32\
    ProcessID          : 208
    ThreadCreationTime : 20-09-2005 8:44:18 AM
    BasePriority       : High


#:4 [services.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 252
    ThreadCreationTime : 20-09-2005 8:44:23 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Services and Controller app
    InternalName       : services.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : services.exe

#:5 [lsass.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 264
    ThreadCreationTime : 20-09-2005 8:44:23 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : LSA Shell (Export Version)
    InternalName       : lsass.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : lsass.exe

#:6 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 448
    ThreadCreationTime : 20-09-2005 8:44:30 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:7 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 512
    ThreadCreationTime : 20-09-2005 8:44:32 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:8 [svchost.exe]
    FilePath           : C:\WINDOWS\system32\
    ProcessID          : 564
    ThreadCreationTime : 20-09-2005 8:44:34 AM
    BasePriority       : Normal
    FileVersion        : 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 5.1.2600.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Generic Host Process for Win32 Services
    InternalName       : svchost.exe
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : svchost.exe

#:9 [zcfgsvc.exe]
    FilePath           : C:\Program Files\Intel\Wireless\Bin\
    ProcessID          : 724
    ThreadCreationTime : 20-09-2005 8:44:56 AM
    BasePriority       : Normal
    FileVersion        : 9, 0, 0, 42
    ProductVersion     : 1, 0, 0, 2
    ProductName        : ZeroCfgSvc Application
    CompanyName        : Intel Corporation
    FileDescription    : ZeroCfgSvc MFC Application
    InternalName       : ZeroCfgSvc
    LegalCopyright     : Copyright (c) Intel Corporation 1999-2004
    OriginalFilename   : ZeroCfgSvc.EXE

#:10 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 812
    ThreadCreationTime : 20-09-2005 8:44:57 AM
    BasePriority       : Normal
    FileVersion        : 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)
    ProductVersion     : 6.00.2900.2180
    ProductName        : Microsoft® Windows® Operating System
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName       : explorer
    LegalCopyright     : © Microsoft Corporation. All rights reserved.
    OriginalFilename   : EXPLORER.EXE

#:11 [ad-aware.exe]
    FilePath           : C:\Program Files\Ad-Aware\
    ProcessID          : 1084
    ThreadCreationTime : 20-09-2005 8:47:52 AM
    BasePriority       : Normal
    FileVersion        : 6.2.0.236
    ProductVersion     : SE 106
    ProductName        : Lavasoft Ad-Aware SE
    CompanyName        : Lavasoft Sweden
    FileDescription    : Ad-Aware SE Core application
    InternalName       : Ad-Aware.exe
    LegalCopyright     : Copyright © Lavasoft AB Sweden
    OriginalFilename   : Ad-Aware.exe
    Comments           : All Rights Reserved

Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9


Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9


Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9


Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 9



Deep scanning and examining files (C:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : kai brach@statcounter[2].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : 
    Value              : C:\Documents and Settings\Kai Brach\Cookies\kai brach@statcounter[2].txt

 Tracking Cookie Object Recognized!
    Type               : IECache Entry
    Data               : kai brach@tribalfusion[1].txt
    TAC Rating         : 3
    Category           : Data Miner
    Comment            : 
    Value              : C:\Documents and Settings\Kai Brach\Cookies\kai brach@tribalfusion[1].txt

Disk Scan Result for C:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Deep scanning and examining files (D:)
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11


Scanning Hosts file......
Hosts file location:"C:\WINDOWS\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 11




Performing conditional scans...
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 11

6:57:16 PM Scan Complete

Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:09:14.796
Objects scanned:108222
Objects identified:2
Objects ignored:0
New critical objects:2

HJT

Logfile of HijackThis v1.99.1
Scan saved at 9:02:13 PM, on 20/09/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\Program Files\AVPersonal\AVGUARD.EXE
C:\Program Files\AVPersonal\AVWUPSRV.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\BenQ\BenQ Surround\BenQSurround.exe
C:\Program Files\BenQ\QPower\QPower.exe
C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\AVPersonal\AVGNT.EXE
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Google\deskbar-0.5.95.0\ggviewer.exe
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\WINDOWS\system32\wuauclt.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BenQ Surround] C:\Program Files\BenQ\BenQ Surround\BenQSurround.exe /s
O4 - HKLM\..\Run: [QPower] C:\Program Files\BenQ\QPower\QPower.exe /s
O4 - HKLM\..\Run: [SmartAudio] C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [AVGCtrl] "C:\Program Files\AVPersonal\AVGNT.EXE" /min
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://WWW.BenQ.COM/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5free/asinst.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\Program Files\AVPersonal\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

As I mentioned before, the about:buster program is not working properly and I cant get it to scan my computer.

I tried accessing a google website again and it still does NOT work.

Is there anything else I can do?

I'm not even sure if my browser was hijacked... maybe it has to do with the Google Deskbar, Toolbar or Desktop Search??

Thanks for your help,

Kai

[Ruby]

Hello Kai

Nice to see you back, healthy and online

Please scan these files with Virustotal and/or Jotti

C:\Program Files\BenQ\BenQ Surround\BenQSurround.exe
C:\Program Files\BenQ\QPower\QPower.exe
C:\Program Files\Conexant\SmartAudio\SmartAudio.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

Please make us know every result of the Online Scans by copy&paste.

[brakai295]

THANKS ;-)

Here the result:

BenQSurround.exe

File:  BenQSurround.exe  
Status:  OK  
MD5  3a8ca4ea14f93a07358664952ad6b009  
Packers detected:  - 
Scanner results  
AntiVir  Found nothing 
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found nothing 
ClamAV  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found nothing 
UNA  Found nothing 
VBA32  Found nothing

QPower.exe

File:  QPower.exe  
Status:  OK  
MD5  4bd8c67a74c428846aa6777e7be8d5b4  
Packers detected:  - 
Scanner results  
AntiVir  Found nothing 
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found nothing 
ClamAV  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found nothing 
UNA  Found nothing 
VBA32  Found nothing

SmartAudio

File:  SmartAudio.exe  
Status:  OK  
MD5  88de015de63f2db3c8c01cbc842cca0c  
Packers detected:  - 
Scanner results  
AntiVir  Found nothing 
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found nothing 
ClamAV  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found nothing 
UNA  Found nothing 
VBA32  Found nothing

ifrmwrk

File:  iFrmewrk.exe  
Status:  OK  
MD5  7f476b45a4b0a7dbd04312528a6374bb  
Packers detected:  - 
Scanner results  
AntiVir  Found nothing 
ArcaVir  Found nothing 
Avast  Found nothing 
AVG Antivirus  Found nothing 
BitDefender  Found nothing 
ClamAV  Found nothing 
Dr.Web  Found nothing 
F-Prot Antivirus  Found nothing 
Fortinet  Found nothing 
Kaspersky Anti-Virus  Found nothing 
NOD32  Found nothing 
Norman Virus Control  Found nothing 
UNA  Found nothing 
VBA32  Found nothing

All these programs came pre installed with my BenQ notebook and everything worked fine in the beginning.

BTW: MS AntiSpyware has found the following earlier today (maybe that helps to identify the problem: Trojan.Downloader.Small.popcorn64

Just 10 minutes ago, I got Google to work for a while. But when I restarted the same thing happens: I just get a white browser window and it keeps loading and loading and nothing happens

THanks for your help again,

Kai

[Ruby]

Hello Kai

Please scan your system now first with the Malware Sweeper.
Try to get a logfile. I need the results, what was found.

You may let the program delete everything what it finds.