TechSpot - PC Technology News and Analysis

fabejr · #1 10-05-2008

My pc is running horrible. i keep getting that damn google go redirect virus. plz check my log.
i currently have avg running. but may swticth to superanitspyware.

moderator note: please attach logs instead of copy pasting.

Bobbye · #2 10-05-2008

Please follow the malware cleaning directions here:
http://www.techspot.com/vb/post645589-1.html

When through Attach the logs to this thread. Run HijackThis again, after Malwarebytes and SuperAntispyware.

How to post your Hijackthis log-file as an ATTACHMENT:
http://www.techspot.com/vb/topic19133.html

fabejr · #3 10-07-2008

here is my logs guys.
symptoms are
my clock is showing military time and i can't change, also iam getting google redirect virus.
basically running like ****.

pc seams clean but clock still in military time and its wrong

kimsland · #4 10-07-2008

Your clock setting

Go to Control Panel
Open Regional and language settings
Click on Customize button, then Time tab
Change it to h:mm:ss tt

fabejr · #5 10-07-2008

Wow thanks alot.

kimsland · #6 10-07-2008

Thanks for the reply

It's nice to see such well spoken (well typed) words

fabejr · #7 10-08-2008

now it changes back, is this virus still on?

kimsland · #8 10-08-2008

Probably seeming I never checked your logs!

Please run HJT and tick then fix these entries:

Quote:

O2 - BHO: (no name) - {049C8983-7907-4028-AEA8-8E170CED2CF4} - C:\WINDOWS\system32\nnnlMcYO.dll (file missing)
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)

Edit

Inside your Malarebytes scan:
Registry Keys Infected:

Quote:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.

Files Infected:

Quote:

C:\Documents and Settings\Fabe\Local Settings\Temp\TDSS4163.tmp (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Fabe\Local Settings\Temp\TDSS52c5.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\Temp\TDSS626e.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\Temp\TDSS6469.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\Temp\TDSS6479.tmp (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\TDSSerrors.log (Trojan.TDSS) -> No action taken.

Please run Malwarebytes again, and then update it (on the Update tab->check for updates)
Do a full scan
And this time Repair all of the above (and anything else found), by clicking on view results

fabejr · #9 10-08-2008

Wow thanks Kim,
i've done all what you said, i'm running a full scan now. after it's complete, all should be good on my pc now?

kimsland · #10 10-08-2008

Well you would probably need to attach

another new HiJackThis log to confirm

But up to you (I hate reading them basically)

Similar Topics
Thread	Thread Starter	Forum	Replies	Last Post
Keyboard Virus? BIOS Virus?	Mad Bad Monk	Security and the Web	1	11-16-2007 09:47 AM
Myzor virus, networm-i virus on my computer	faticar	Security and the Web	3	11-06-2007 05:13 PM
AIM Virus...Facebook Message caused virus please help!!!!	X05TiburonX	Security and the Web	3	02-17-2007 07:19 PM
Spyware or Virus disabled my anti-virus and ad-aware - HJT log included	idontknowwww	Security and the Web	11	10-31-2006 01:03 PM
Greek virus collector - virus.gr/english	Pazuzu	Security and the Web	1	11-22-2005 10:56 PM