fireurza Posted June 12, 2013 Member ID: 677 Group: ***- Inactive Clan Members Followers: 19 Topic Count: 172 Topics Per Day: 0.03 Content Count: 1457 Content Per Day: 0.27 Reputation: 791 Achievement Points: 9890 Solved Content: 0 Days Won: 5 Joined: 11/02/09 Status: Offline Last Seen: January 16 Birthday: 02/20/1986 Device: Windows Share Posted June 12, 2013 got a virus on my pc this weekend... stupid fbi hijack. I got rid of it but just now noticed it set up proxy settings on all my browsers. Link to comment Share on other sites More sharing options... Awards
Prinny Posted June 12, 2013 Member ID: 2887 Group: **- Inactive Registered Users Followers: 24 Topic Count: 18 Topics Per Day: 0.00 Content Count: 353 Content Per Day: 0.08 Reputation: 440 Achievement Points: 2705 Solved Content: 0 Days Won: 0 Joined: 10/14/11 Status: Offline Last Seen: April 21, 2017 Birthday: 08/15/1985 Share Posted June 12, 2013 how to you see that? Link to comment Share on other sites More sharing options...
fireurza Posted June 12, 2013 Member ID: 677 Group: ***- Inactive Clan Members Followers: 19 Topic Count: 172 Topics Per Day: 0.03 Content Count: 1457 Content Per Day: 0.27 Reputation: 791 Achievement Points: 9890 Solved Content: 0 Days Won: 5 Joined: 11/02/09 Status: Offline Last Seen: January 16 Birthday: 02/20/1986 Device: Windows Author Share Posted June 12, 2013 go into the browsers settings and click on the advanced tab if in firefox and click network. for google and ie its through the internet connection its self. network and connections center/ internet options/ connections/ lan settings Link to comment Share on other sites More sharing options... Awards
little_old_man Posted June 12, 2013 Member ID: 1194 Group: ***- Inactive Clan Members Followers: 40 Topic Count: 436 Topics Per Day: 0.08 Content Count: 6692 Content Per Day: 1.29 Reputation: 11691 Achievement Points: 53094 Solved Content: 0 Days Won: 76 Joined: 02/27/10 Status: Offline Last Seen: April 16, 2023 Birthday: 04/15/1960 Share Posted June 12, 2013 Drink plenty of fluids and hot chicken soup. Damage_inc- 1 Link to comment Share on other sites More sharing options... Awards
J3st3r Posted June 12, 2013 Member ID: 2162 Group: ++ COD4 Admin Followers: 153 Topic Count: 152 Topics Per Day: 0.03 Content Count: 5101 Content Per Day: 1.05 Reputation: 5015 Achievement Points: 44748 Solved Content: 0 Days Won: 22 Joined: 01/25/11 Status: Offline Last Seen: 8 hours ago Birthday: 02/26/1972 Device: Windows Share Posted June 12, 2013 hijackthis is good for browser hijackers http://sourceforge.net/projects/hjt/ Link to comment Share on other sites More sharing options... Awards
Tball Posted June 12, 2013 Member ID: 112 Group: **- Inactive Registered Users Followers: 2 Topic Count: 104 Topics Per Day: 0.02 Content Count: 1132 Content Per Day: 0.21 Reputation: 228 Achievement Points: 6975 Solved Content: 0 Days Won: 0 Joined: 09/02/09 Status: Offline Last Seen: January 3, 2015 Birthday: 10/09/1960 Share Posted June 12, 2013 (edited) That and combofix i dont use anything else anymore and i do this for a living Edited June 12, 2013 by Tball Link to comment Share on other sites More sharing options...
fireurza Posted June 13, 2013 Member ID: 677 Group: ***- Inactive Clan Members Followers: 19 Topic Count: 172 Topics Per Day: 0.03 Content Count: 1457 Content Per Day: 0.27 Reputation: 791 Achievement Points: 9890 Solved Content: 0 Days Won: 5 Joined: 11/02/09 Status: Offline Last Seen: January 16 Birthday: 02/20/1986 Device: Windows Author Share Posted June 13, 2013 ya i just pissed it off lol got home from work and it was back and would not let me do a restart... so far i have restored to a few months ago and i am running a virus check right now.... here is a hijackthis log. FIREFOX: 21.0 (en-US)Boot mode: NormalRunning processes:C:\Users\Fireurza\AppData\Roaming\Google\Google Talk\googletalk.exeC:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exeC:\Program Files (x86)\ROCCAT\Isku Keyboard\IskuMonitor.exeC:\Program Files (x86)\Razer\Mamba\RazerMambaSysTray.exeF:\Games\iTunesHelper.exeC:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360\A5E82D02\20.3.0.36\InstStub.exeF:\New folder\vcredist_x86.exef:\96b3ff7d4f819525daa9c27649fa09\install.exeC:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exeC:\Program Files (x86)\Mozilla Firefox\firefox.exeC:\Windows\SysWOW64\DllHost.exeC:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exeC:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_202.exeF:\New folder\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =O2 - BHO: AMD SteadyVideo BHO - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dllO2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dllO2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLLO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dllO4 - HKLM\..\Run: [RoccatIsku] "C:\Program Files (x86)\ROCCAT\Isku Keyboard\IskuMonitor.EXE"O4 - HKLM\..\Run: [Razer Mamba Elite Driver] C:\Program Files (x86)\Razer\Mamba\RazerMambaSysTray.exeO4 - HKLM\..\Run: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunO4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"O4 - HKLM\..\Run: [iTunesHelper] "F:\Games\iTunesHelper.exe"O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"O4 - HKLM\..\RunOnce: [N360] "C:\Program Files (x86)\NortonInstaller\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360\A5E82D02\20.3.0.36\InstStub.exe" /RELAUNCH /RUNONCE /NOPROMPT /PRODID N360O4 - HKCU\..\Run: [googletalk] C:\Users\Fireurza\AppData\Roaming\Google\Google Talk\googletalk.exe /autostartO4 - Startup: Stardock ObjectDock.lnk = C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dllO9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dllO9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dllO9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\vsocklib.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\vsocklib.dllO11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphicsO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLLO18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLLO18 - Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dllO18 - Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dllO23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeO23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeO23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exeO23 - Service: AODService - Unknown owner - C:\Program Files (x86)\AMD\OverDrive\AODAssist.exeO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exeO23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exeO23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)O23 - Service: VMware USB Arbitration Service (VMUSBArbService) - Unknown owner - C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe (file missing)O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)--End of file - 9362 bytes Link to comment Share on other sites More sharing options... Awards
DEEJAYKEG Posted June 13, 2013 Member ID: 1238 Group: ***- Inactive Clan Members Followers: 35 Topic Count: 1207 Topics Per Day: 0.23 Content Count: 6083 Content Per Day: 1.17 Reputation: 4984 Achievement Points: 50727 Solved Content: 0 Days Won: 11 Joined: 03/12/10 Status: Offline Last Seen: April 11 Device: Kindle Fire Share Posted June 13, 2013 Malwarebytes should get rid of it. Disable Java in your browsers! Link to comment Share on other sites More sharing options... Awards
BUDMAN Posted June 13, 2013 Member ID: 800 Group: *** Clan Members Followers: 152 Topic Count: 137 Topics Per Day: 0.03 Content Count: 6969 Content Per Day: 1.32 Reputation: 4508 Achievement Points: 58487 Solved Content: 0 Days Won: 6 Joined: 11/27/09 Status: Offline Last Seen: 18 minutes ago Birthday: 05/29/1957 Device: Android Share Posted June 13, 2013 Malwarebytes should get rid of it. Disable Java in your browsers! Run Malwarebytes in safe mode or from a thumb drive......hope this helps Link to comment Share on other sites More sharing options... Awards
Tball Posted June 13, 2013 Member ID: 112 Group: **- Inactive Registered Users Followers: 2 Topic Count: 104 Topics Per Day: 0.02 Content Count: 1132 Content Per Day: 0.21 Reputation: 228 Achievement Points: 6975 Solved Content: 0 Days Won: 0 Joined: 09/02/09 Status: Offline Last Seen: January 3, 2015 Birthday: 10/09/1960 Share Posted June 13, 2013 Try combofixhttp://www.bleepingcomputer.com/combofix/how-to-use-combofix Link to comment Share on other sites More sharing options...
FLDMARSHAL Posted June 13, 2013 Member ID: 5490 Group: ***- Inactive Clan Members Followers: 3 Topic Count: 136 Topics Per Day: 0.03 Content Count: 469 Content Per Day: 0.11 Reputation: 243 Achievement Points: 4101 Solved Content: 0 Days Won: 0 Joined: 02/06/13 Status: Offline Last Seen: April 24 Birthday: 10/18/1976 Device: Windows Share Posted June 13, 2013 (edited) right here u go find out what the vires is called or malware and restart in safe mode and when u do go to run command type regedit the f3 and type the name of the virus or malwere and delete all entrys or an eay way is restart in safe mode and do a system restore to a time when everything was ok and oncw u have done that and everything is ok then go to run command and make sure its all gone the malwere and virus of and if i were u i would put a passwerd in ur bios as well as ur start up cause they can hack ur bios and if they do there is no coming back from that u will have a nice fancy paper wate lol its seems u have been spyed on so here is some advise for every one in america instal advanced system care and only run spy ware and that will give u an idea how many people are watching what u are doing and u can get rid of them now the program it self is free here is the link http://www.iobit.com/advancedsystemcarepro.html if u install it and need a hand to work out this program hit me up on ts at the end of the day we are been attacked by nsa sia and fbi after all they own face book google and twitter so if u use any of those well i have warned u oh and msn and skype so dont think i can have a private talk u carnt its all out there now so stay safe and be carful what u say Edited June 13, 2013 by FLELDMARSHALL Link to comment Share on other sites More sharing options... Awards
Recommended Posts