Specialty Forums Security and Virus
General Hardware
CPUs/Overclocking
Networking
Digital Photo/Video
Office Software
PC Gaming
Console Gaming
Programming
Database
Web Development
Digital Home
General Forums Windows XP
Windows Vista
Windows 95/98
Windows Me
Windows NT
Windows 2000
Win Server 2008
Win Server 2003
Windows 3.1
Linux
PDAs
BeOS
Novell Netware
OpenVMS
Solaris
Disk Op. System
Unix
Mac
OS/2
Drivers Driver Scan
Driver Forum
Software Automatic Updates
BIOS Updates My Computing.Net Solution Center Free IT eBook Howtos Site Search Message Find RSS Feeds Install Guides Data Recovery About Home
Subject: Do I have whataboutadog.com virus?
Original Message
Name: YoYoMa Date: October 28, 2007 at 17:57:31 PacificSubject: Do I have whataboutadog.com virus?OS: Microsoft Windows XP HomeCPU/Ram: Pentium 4 CPU 2.93 GHz 50Model/Manufacturer: Gateway 420GR
Comment: I've been noticing this whataboutadog.com in my browser history and googled it to find out that its a virus. I haven't noticed any real changes in my computer, but how do I know if I have it or not? (And if so, how can I get rid of it?)
Report Offensive Message For Removal
Response Number 1
Name: jabuck Date: October 28, 2007 at 18:13:47 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Please download and install the latest version of HijackThis v2.0.2:Download the HijackThis Installer from this link: HijackThis
1. Save " HJTInstall.exe" to your desktop.
Please download FindAWL from this link FindAWF
Double-click on the FindAWF.exe file to run it. It will open a command prompt and ask you to "Press any key to continue". You will be presented with a Menu.Press 1 then press Enter. Copy and paste the contents of the AWF.txt file in your next reply.
Report Offensive Follow Up For Removal
Response Number 2
Name: YoYoMa Date: October 28, 2007 at 18:43:22 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Logfile of Trend Micro HijackThis v2.0.2Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FOR... http://g.msn.com/0SEENUS/SAOS01?FOR... http://www.startribune.com/ http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://g.msn.com/0SEENUS/SAOS01?FOR... http://edits.mywebsearch.com/toolba... http://www.miniclip.com/hamsterball... http://www.kaspersky.com/kos/englis... http://ak.exe.imgfarm.com/images/no... http://by110w.bay110.mail.live.com/... http://mediaplayer.walmart.com/inst... http://zone.msn.com/binFramework/v1... http://www.adobe.com/products/acrob... http://ax.phobos.apple.com.edgesuit... http://zone.msn.com/bingame/gold/de... http://www.popcap.com/games/popcapl... http://mvnet.xlontech.net/qm/fox/06... http://fdl.msn.com/zone/datafiles/h...
--
Find AWF report by noahdfear ©2006
The current date is: Sun 10/28/2007
03/11/2004 05:18 PM 135,168 shwiconem.exe
Directory of C:\PROGRA~1\DVD43\BAK
05/22/2006 01:26 PM 694,272 dvd43_tray.exe
Directory of C:\PROGRA~1\ITUNES\BAK
09/26/2007 02:42 PM 267,064 iTunesHelper.exe
Directory of C:\PROGRA~1\QUICKT~1\BAK
06/29/2007 06:24 AM 286,720 QTTask.exe
Directory of C:\PROGRA~1\SYMNET~1\BAK
07/04/2005 12:04 PM 95,960 SNDMon.exe
Directory of C:\WINDOWS\SYSTEM32\BAK
08/04/2004 07:00 AM 15,360 ctfmon.exe
Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK
12/22/2004 05:45 PM 71,280 ccApp.exe
Directory of C:\PROGRA~1\CYBERL~1\POWERDVD\BAK
10/31/2003 09:42 PM 32,768 PDVDServ.exe
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK
08/16/2007 08:38 PM 1,838,592 GoogleDesktop.exe
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK
06/14/2007 08:15 PM 68,856 GoogleToolbarNotifier.exe
Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK
01/19/2006 11:06 AM 11,776 mimboot.exe
Directory of C:\PROGRA~1\SONY\SONICS~1\BAK
06/03/2005 07:16 AM 81,920 SsAAD.exe
Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK
06/10/2005 10:44 AM 81,920 issch.exe
Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK
06/07/2003 05:32 AM 50,688 WkUFind.exe
Directory of C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\BAK
04/02/2006 07:35 PM 28,672 mwsoemon.exe
Directory of C:\PROGRA~1\ADOBE\PHOTOS~1\3.2\APPS\BAK
03/09/2007 11:09 AM 63,712 apdproxy.exe
28172 Oct 8 2007 "C:\Program Files\Digital Media Reader\shwiconem.exe"
Report Offensive Follow Up For Removal
Response Number 3
Name: jabuck Date: October 28, 2007 at 18:58:17 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Temporarily disable any of the following anti-spyware realtime protection programs that you may have Disable Realtime Protection
To disable Norton AntiVirus Script Blocking:
Go to start> control panel> add/remove programs and uninstall this program if found:
MyWebSearch
Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
A text file opens called: files.txt
Next, close and click Yes to save the changes.
Once files.txt is saved, FindAWF does the following:
When done with the above, it automatically runs a new scan and opens a new log.
Report Offensive Follow Up For Removal
Response Number 4
Name: YoYoMa Date: October 28, 2007 at 19:17:26 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )The current date is: Sun 10/28/2007
03/11/2004 05:18 PM 135,168 shwiconem.exe
Directory of C:\PROGRA~1\DVD43\BAK
05/22/2006 01:26 PM 694,272 dvd43_tray.exe
Directory of C:\PROGRA~1\ITUNES\BAK
09/26/2007 02:42 PM 267,064 iTunesHelper.exe
Directory of C:\PROGRA~1\QUICKT~1\BAK
06/29/2007 06:24 AM 286,720 QTTask.exe
Directory of C:\PROGRA~1\SYMNET~1\BAK
07/04/2005 12:04 PM 95,960 SNDMon.exe
Directory of C:\WINDOWS\SYSTEM32\BAK
08/04/2004 07:00 AM 15,360 ctfmon.exe
Directory of C:\PROGRA~1\COMMON~1\SYMANT~1\BAK
12/22/2004 05:45 PM 71,280 ccApp.exe
Directory of C:\PROGRA~1\CYBERL~1\POWERDVD\BAK
10/31/2003 09:42 PM 32,768 PDVDServ.exe
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK
08/16/2007 08:38 PM 1,838,592 GoogleDesktop.exe
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~2\BAK
06/14/2007 08:15 PM 68,856 GoogleToolbarNotifier.exe
Directory of C:\PROGRA~1\MUSICM~1\MUSICM~1\BAK
01/19/2006 11:06 AM 11,776 mimboot.exe
Directory of C:\PROGRA~1\SONY\SONICS~1\BAK
06/03/2005 07:16 AM 81,920 SsAAD.exe
Directory of C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\BAK
06/10/2005 10:44 AM 81,920 issch.exe
Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK
06/07/2003 05:32 AM 50,688 WkUFind.exe
Directory of C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\BAK
04/02/2006 07:35 PM 28,672 mwsoemon.exe
Directory of C:\PROGRA~1\ADOBE\PHOTOS~1\3.2\APPS\BAK
03/09/2007 11:09 AM 63,712 apdproxy.exe
135168 Mar 11 2004 "C:\Program Files\Digital Media Reader\shwiconem.exe"
Report Offensive Follow Up For Removal
Response Number 5
Name: jabuck Date: October 28, 2007 at 19:24:59 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Option 3:If a Security Alert shows, allow the program to run.
A text file opens called: folders.txt
Next, close and click Yes to save the changes.
Once folders.txt is saved, FindAWF does the following:
When done with the above, it automatically runs a new scan and opens a new log.
If a Security Alert shows, allow the program to run.
This removes all entries from the domain zones.
Next,
Launch Notepad, and copy/paste everything between the X's making "regedit4" the very top line.
Please download ComboFix to the desktop from this link:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double-click combofix.exeDon't click on the window while the program is running, it may cause your system to hang. )
Please post the log it produces.
Report Offensive Follow Up For Removal
Response Number 6
Name: YoYoMa Date: October 28, 2007 at 19:56:09 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )The current date is: Sun 10/28/2007
Duplicate files of bak directory contents
end of report
ComboFix 07-10-28.2 - Owner 2007-10-28 21:37:46.1 - NTFSx86
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\Program Files\MyWebSearch
.
2007-10-28 21:37 51,200 --a------ C:\WINDOWS\NirCmd.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak software updater.lnk]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5120d541-176a-11d9-9fe5-806d6172696f}]
*Newly Created Service* - HTTPFILTER
catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
**************************************************************************
Report Offensive Follow Up For Removal
Response Number 7
Name: jabuck Date: October 28, 2007 at 20:15:12 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Run Hijack This, close all windows and browsers except Hijack This, place a check to the left of the following items if they exist and press "fix checked":R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: IE - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: My &Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolba...
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcapl...
Exit Hijack This.
Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Your java is out of date and can be exploited.
Download the latest version of http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
. Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version.
POst a new Hiajck This log please.
Report Offensive Follow Up For Removal
Response Number 8
Name: YoYoMa Date: October 28, 2007 at 21:05:37 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Logfile of Trend Micro HijackThis v2.0.2Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startribune.com/ http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://g.msn.com/0SEENUS/SAOS01?FOR... http://www.miniclip.com/hamsterball... http://ak.exe.imgfarm.com/images/no... http://by110w.bay110.mail.live.com/... http://mediaplayer.walmart.com/inst... http://zone.msn.com/binFramework/v1... http://www.adobe.com/products/acrob... http://ax.phobos.apple.com.edgesuit... http://zone.msn.com/bingame/gold/de... http://mvnet.xlontech.net/qm/fox/06... http://fdl.msn.com/zone/datafiles/h...
--
Report Offensive Follow Up For Removal
Response Number 9
Name: jabuck Date: October 29, 2007 at 13:55:59 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Make sure norton's script blocking is turned off and any real time protection as dicussed in response #3.Then run Hijack This and remove these items:
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: My &Search Bar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL (file missing)
Exit Hijack This
Post a new Hijack This log please.
Report Offensive Follow Up For Removal
Response Number 10
Name: YoYoMa Date: October 29, 2007 at 17:19:18 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Sorry it took so long to get back to you... I just got home :)Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startribune.com/ http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://g.msn.com/0SEENUS/SAOS01?FOR... http://www.miniclip.com/hamsterball... http://ak.exe.imgfarm.com/images/no... http://by110w.bay110.mail.live.com/... http://mediaplayer.walmart.com/inst... http://zone.msn.com/binFramework/v1... http://www.adobe.com/products/acrob... http://ax.phobos.apple.com.edgesuit... http://zone.msn.com/bingame/gold/de... http://mvnet.xlontech.net/qm/fox/06... http://fdl.msn.com/zone/datafiles/h...
--
Report Offensive Follow Up For Removal
Response Number 11
Name: jabuck Date: October 29, 2007 at 19:09:44 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Your Hijack This log is clean.You might want to do a little cleanup and increase your spyware protection.
Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
You should add "Spywareblaster" to your arsenol of antispyware tools, just do a google search for spywareblaster, download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.
Report Offensive Follow Up For Removal
Response Number 12
Name: YoYoMa Date: October 29, 2007 at 19:46:11 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )I'm guessing that I did have the whataboutadog.com malware on my system? Thanks for the help!!!
Report Offensive Follow Up For Removal
Response Number 13
Name: jabuck Date: October 29, 2007 at 19:58:11 PacificSubject: Do I have whataboutadog.com virus?
Reply: (edit )Yes you did as the first Hijack This log 015 item revealed, also Mywebsearch. But your logs appear to be clean. Is the computer operating better now?
Report Offensive Follow Up For Removal
Use following form to reply to current message:
Version Tracker Pro
Driver Agent