This thread's last reply is from October 26, 2009, 2:59 AM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
Vages
Hello,
My computer is infected with a virus that redirects web searches, on all search engines. I downloaded Hijackthis but the virus does not allow me to run the software.
Any help appreciated!
Vages
Thanks for your reply!
I am ready.
Vages
Update to my problem: The redirecting to different web pages happens only with google, not with yahoo search engine. Also, my antivirus was not working so I unistalled it.
I was able, however, to run a Kaspersky scan on my computer. I am attaching a copy of the report here if it helps:
KASPERSKY ONLINE SCANNER 7.0: scan report
Thursday, October 15, 2009
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Thursday, October 15, 2009 20:37:01
Records in database: 3001101
--------------------------------------------------------------------------------
Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
Scan statistics:
Objects scanned: 173809
Threats found: 5
Infected objects found: 51
Suspicious objects found: 0
Scan duration: 03:26:53
File name / Threat / Threats count
svchost.exe\DA04CA5A.x86.dll/svchost.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 4
globalroot\Device\__max++>\DA04CA5A.x86.dll/globalroot\Device\__max++>\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 22
spoolsv.exe\DA04CA5A.x86.dll/spoolsv.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
iTunesHelper.exe\DA04CA5A.x86.dll/iTunesHelper.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
wcescomm.exe\DA04CA5A.x86.dll/wcescomm.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
msa.exe\DA04CA5A.x86.dll/msa.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
rapimgr.exe\DA04CA5A.x86.dll/rapimgr.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
AppleMobileDeviceService.exe\DA04CA5A.x86.dll/AppleMobileDeviceService.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mDNSResponder.exe\DA04CA5A.x86.dll/mDNSResponder.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
cvpnd.exe\DA04CA5A.x86.dll/cvpnd.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jqs.exe\DA04CA5A.x86.dll/jqs.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
mcrdsvc.exe\DA04CA5A.x86.dll/mcrdsvc.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
alg.exe\DA04CA5A.x86.dll/alg.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
firefox.exe\DA04CA5A.x86.dll/firefox.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
LogitechUpdate.exe\DA04CA5A.x86.dll/LogitechUpdate.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
jucheck.exe\DA04CA5A.x86.dll/jucheck.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
java.exe\DA04CA5A.x86.dll/java.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
wmplayer.exe\DA04CA5A.x86.dll/wmplayer.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
googletalkplugin.exe\DA04CA5A.x86.dll/googletalkplugin.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\b.exe/C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\b.exe Infected: Packed.Win32.Krap.ag 1
b.exe\DA04CA5A.x86.dll/b.exe\DA04CA5A.x86.dll Infected: Trojan-Spy.Win32.Agent.bahu 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temp\b.exe Infected: Packed.Win32.Krap.ag 1
C:\Documents and Settings\HP_Administrator\Local Settings\Temporary Internet Files\Content.IE5\DFF06LCY\index[1].htm Infected: Trojan.HTML.Fraud.d 1
C:\hp\bin\wbug\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\WINDOWS\mplayerplgn.dll Infected: not-a-virus:AdWare.Win32.Agent.lmz 1
D:\I386\APPS\APP25744\src\CompaqPresario_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
D:\I386\APPS\APP25744\src\HPPavillion_Spring06.exe Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
Selected area has been scanned.
xixo_12
Hi,
Notice.
Do you still need our help?
It's almost 3 days since my last replied. (Left approximate 8 hours)
Please let me know if you required more time to reply.
Regards,
xixo_12