Please help!!! I have a virus on my computer called a.exe!! It opens a new tabb when i click on a site on goog?

Question

I HAVE A VIRUS CALLED A.EXE IT OPENS A NEW TABB ON GOOGLE WHEN I SEARCH SOMETHING. AND THE LINK OF IT IS GO.GOOGLE. COM/...........
ITS A VIRUS CALLED W32/Melare@MM I THINK.
BUT HOW CAN I REMOVE THIS ONE?
I AM NOW HAVING A SCAN WITH A-SQUARED ANTI MALWARE.



hERE IS MY HIJACK THIS LOG: PLEASE HELP ME!!!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03:10, on 14-9-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Conexant\CnxDslTb.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\VoipRaider.com\VoipRaider\voipraider.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\a-squared Anti-Malware\a2start.exe
C:\Program Files\a-squared Anti-Malware\a2wizard.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http: //go.mic rosoft.c om/fwlink/? LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = ht tp://w ww.go og le.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = htt p://go.micr osoft.com/fwlink /?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = htt p://go.micros oft.com/fwlin k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.m icrosoft.com/fwl ink/ ?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = ht tp: //g o.mi crosoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 85.214.66.232 ww w.tur gay74bo ard.com #23-11-2007
O1 - Hosts: 195.122.131.250 ww w.rap idshare .com #23-11-2007
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {140BD8E3-C167-11D4-B4A3-080000180323} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aanmelden - Help - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvSt

Answer 1

Why do have 4 anti-virus program on the same PC ???

They will conflict with one another.



Install portable version of ClamWin anti-virus in a USB pen drive and scan your PC with it.



ClamWin is a Free Antivirus for Microsoft Windows that uses the GNU General

Public License by the Free Software Foundation and is free (as in freedom)

software. It can detect and remove more than 400,000 Trojans and viruses.



Use another clean PC to download Clamwin portable anti-virus and install it on a USB pen drive.



Download here

http://portableapps.com/apps/utilities/clamwin_portable



Document on how to configure ClamWin

http://support.real-time.com/open-source/clamwin/index.html



Start Clamwin anti-virus and update the latest anti-virus definition files.

Select the tools menu bar, set the preferences to remove virus.

Start the infected PC in safe mode by pressing F8 during start up.

Run the Clamwin Anti-virus that is installed on the USB pen drive to scan the

infected PC.

After removing the virus, install crap cleaner (ccleaner) to get rid of the

viruses left over setting in the windows registry.

Answer 2

2

Answer 3

Hi



You should post Hijack This logs on specialised forums, such as:

http://forums.whatthetech.com/HijackThis_Logs_and_Infections_Removal_f27.html



But I recommend you scan your computer with Superantispyware free and Malwarebytes Antimalware free first, to see if they can clean the malware.

Answer 4

http://www.symantec.com/security_response/writeup.jsp?docid=2003-051914-5016-99&tabid=3

go to the site and see all related info about this virus



http://www.petri.co.il/forums/showthread.php?t=1370

go to the link and see hw to delete a.exe from system32



http://forums.techguy.org/windows-nt-2000-xp/562264-how-delete-exe-file-desktop.html

this link is a forum where they have discussed step by step procedure





if you find the info useful dont forget to choose this as best answer..

thank

Answer 5

http://www.symantec.com/security_response/print_writeup.jsp?docid=2003-051914-5016-99





http://www.kaspersky.com/virusscanner