Specialty Forums Security and Virus
General Hardware
CPUs/Overclocking
Networking
Digital Photo/Video
Office Software
PC Gaming
Console Gaming
Programming
Database
Web Development
Digital Home
General Forums Windows XP
Windows Vista
Windows 95/98
Windows Me
Windows NT
Windows 2000
Win Server 2008
Win Server 2003
Windows 3.1
Linux
PDAs
BeOS
Novell Netware
OpenVMS
Solaris
Disk Op. System
Unix
Mac
OS/2
Drivers Driver Scan
Driver Forum
Software Automatic Updates
BIOS Updates My Computing.Net Solution Center Free IT eBook Howtos Site Search Message Find RSS Feeds Install Guides Data Recovery About Home
Subject: whataboutadog.com & Trojan.Zonebac
Original Message
Name: kstingle Date: November 22, 2007 at 13:12:50 PacificSubject: whataboutadog.com & Trojan.ZonebacOS: XPCPU/Ram: AMDModel/Manufacturer: compaq
Comment: Hello. I am also having problems with my internet explorer erroring out. This did not start until I updated my Norton Antivirus.
I'm posting AWF logs.
I would appreciate your help.
07/10/2007 08:18 AM 270,648 iTunesHelper.exe
Directory of C:\PROGRA~1\QUICKT~1\BAK
06/29/2007 05:24 AM 286,720 QTTask.exe
Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\BAK
06/24/2007 10:25 PM 68,856 GoogleToolbarNotifier.exe
Directory of C:\PROGRA~1\HP\HPCORE~1\BAK
05/12/2004 03:18 PM 241,664 hpcmpmgr.exe
Directory of C:\PROGRA~1\COMMON~1\MICROS~1\WORKSS~1\BAK
07/16/2002 03:21 PM 28,672 WkUFind.exe
Directory of C:\PROGRA~1\COMMON~1\SONIC\UPDATE~1\BAK
08/19/2003 01:01 AM 110,592 sgtray.exe
Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK
03/14/2007 02:43 AM 83,608 jusched.exe
270648 Jul 10 2007 "C:\Program Files\iTunes\iTunesHelper.exe"
Report Offensive Message For Removal
Response Number 1
Name: jabuck Date: November 22, 2007 at 13:36:19 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Please download and install the latest version of HijackThis v2.0.2:Download the HijackThis Installer from this link: HijackThis
1. Save " HJTInstall.exe" to your desktop.
Go to star> control panel> add/remove programs and uninstall these versioins of java:
j2re1.4.2_03
jre1.5.0_06
jre1.5.0_10
jre1.5.0_09
jre1.6.0_01
leaving only the newest jre1.6.0_03 .
Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
A text file opens called: files.txt
Next, close and click Yes to save the changes.
Once files.txt is saved, FindAWF does the following:
When done with the above, it automatically runs a new scan and opens a new log.
Report Offensive Follow Up For Removal
Response Number 2
Name: kstingle Date: November 22, 2007 at 14:28:29 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Thank you for you time and help!!Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.surfbest.net/home http://ie.redirect.hp.com/svs/rdr?T... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://www.wildtangent.com/download/ http://security.symantec.com/sscv6/... http://pcmcmail.pcmc.com/iNotes6W.cab http://pcmcmail.pcmc.com/download/d... http://security.symantec.com/sscv6/... http://www.surfbest.net/home
--
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.surfbest.net/home http://ie.redirect.hp.com/svs/rdr?T... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://www.wildtangent.com/download/ http://security.symantec.com/sscv6/... http://pcmcmail.pcmc.com/iNotes6W.cab http://pcmcmail.pcmc.com/download/d... http://security.symantec.com/sscv6/... http://www.surfbest.net/home
--
Report Offensive Follow Up For Removal
Response Number 3
Name: jabuck Date: November 22, 2007 at 14:50:43 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Option 3:If a Security Alert shows, allow the program to run.
A text file opens called: folders.txt
Next, close and click Yes to save the changes.
Once folders.txt is saved, FindAWF does the following:
When done with the above, it automatically runs a new scan and opens a new log.
If a Security Alert shows, allow the program to run.
This removes all entries from the domain zones.
Next,
Launch Notepad, and copy/paste everything between the X's making "regedit4" the very top line.
Please download ComboFix to the desktop from this link:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Double-click combofix.exeDon't click on the window while the program is running, it may cause your system to hang. )
Please post the log it produces.
Report Offensive Follow Up For Removal
Response Number 4
Name: kstingle Date: November 22, 2007 at 22:27:41 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )The Combofix hangs and I am unable to get a log file. I tried the combofix several times with the same hanging result. The first time I ran the combofix it rebooted my computer.Here is the AWF log file. Seems to be getting shorter.
Version 1.40
The current date is: 2007-11-22
0 File(s) 0 bytes
531 Nov 14 2007 "C:\Program Files\HP\hpcoretech\data\EvntData-1893671301.xml"
Report Offensive Follow Up For Removal
Response Number 5
Name: jabuck Date: November 22, 2007 at 22:58:49 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Disconnect from the intermet, turn off Nortons Antivirus.Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
A text file opens called: files.txt
Next, close and click Yes to save the changes.
Once files.txt is saved, FindAWF does the following:
When done with the above, it automatically runs a new scan and opens a new log. Do not post the log.
Option 3:
If a Security Alert shows, allow the program to run.
A text file opens called: folders.txt
Next, close and click Yes to save the changes.
Once folders.txt is saved, FindAWF does the following:
When done with the above, it automatically runs a new scan and opens a new log. Do not post the log.
If a Security Alert shows, allow the program to run.
This removes all entries from the domain zones.
Next,
Launch Notepad, and copy/paste everything between the X's making "regedit4" the very top line.
Run Combofix and save the log so you can find it.
Restart the computer and make sure your antivirus is on before you go online then post the Combofix log please..
Report Offensive Follow Up For Removal
Response Number 6
Name: kstingle Date: November 23, 2007 at 09:30:39 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )The ComboFix program runs through all its scans and hangs at creating a log file. I've tried 10 or so times trying to get ComboFix to create a log. But it always hangs at the same place.The AWF log file had one file still in it.
What else would you like me to try?
Thanks again.
Report Offensive Follow Up For Removal
Response Number 7
Name: jabuck Date: November 23, 2007 at 10:26:48 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Run Hijack This, close all windows and browsers except Hijack This, place a check tot he left of the following items and press "fix checked":O2 - BHO: IE - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
Exit Hijack This.
Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok.
Navigate to and delete this file if found:
C:\Program Files\WinBudget\bin\matrix.dll
Navigate to and delete this folder if found:
C:\Program Files\WinBudget
Post a new Hijack This log please.
Report Offensive Follow Up For Removal
Response Number 8
Name: kstingle Date: November 23, 2007 at 13:14:12 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )In HiJackThis this one did not show upO2 - BHO: IE - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
I was also not able to locate the the matrix.dll file to delete and the Winbudget folder did not exist.
Here is the Log
Logfile of Trend Micro HijackThis v2.0.2
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://go.microsoft.com/fwlink/?Lin... http://www.wildtangent.com/download/ http://security.symantec.com/sscv6/... http://pcmcmail.pcmc.com/iNotes6W.cab http://pcmcmail.pcmc.com/download/d... http://security.symantec.com/sscv6/... http://www.surfbest.net/home
--
Report Offensive Follow Up For Removal
Response Number 9
Name: jabuck Date: November 23, 2007 at 21:36:01 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Your Hijack This log is clean.Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Please delete all the programs we used as they are continuously update and can damage the computer in the wrong hands.
Is the computer operating better?
Report Offensive Follow Up For Removal
Response Number 10
Name: kstingle Date: November 25, 2007 at 19:52:28 PacificSubject: whataboutadog.com & Trojan.Zonebac
Reply: (edit )Everything is working great. thank you for taking your time. I greatly appreciate it!
Report Offensive Follow Up For Removal
Use following form to reply to current message:
Version Tracker Pro
Driver Agent