What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Ie Redirect And Porno Pop-ups

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have been hijacked on IE and now I constantly have a new homepage that I have reset numerous times. I also have a porno site that pops up on my screen when I first start my computer in the morning and then returns every two hours. I have run Adaware and Spybot and installed Spyblaster, but the pop up and redirect are still there.
I have run a Hijack scan and included the log. Sure hope someone can help…

Logfile of HijackThis v1.98.2
Scan saved at 11:50:30 AM, on 11/2/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\sdkyj.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\mfciw.exe
C:\WINDOWS\System32\lcobfp.exe
C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\windows\no-credit-card.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\winmm64.exe
C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Real\RealPlayer\realplay.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\PROGRA~1\Netscape\NETSCA~1\Netscp.exe
C:\Documents and Settings\Kelley\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b;=hc
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://s-redirect.com/?b=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\pgacu.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://db105.com:81/cgi-bin/index.cgi?c=0
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b;=hc
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://db105.com:81/cgi-bin/index.cgi?c=0
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6DD01090-84AB-318F-9942-C3C8B055B9B5} - C:\WINDOWS\appqg32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\Msdxm.ocx
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [mfciw.exe] C:\WINDOWS\system32\mfciw.exe
O4 - HKLM\..\Run: [waiejxckoj] C:\WINDOWS\System32\lcobfp.exe
O4 - HKLM\..\Run: [D32B5B4B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\b92euycp.exe
O4 - HKLM\..\Run: [5CB2444E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\22z.exe
O4 - HKLM\..\Run: [4D8004CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vph.exe
O4 - HKLM\..\Run: [8039BA8B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\t2xkci6wsijk.exe
O4 - HKLM\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKLM\..\Run: [FC4F83F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sf0p.exe
O4 - HKLM\..\Run: [DD391D7E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ngoju7lfuz.exe
O4 - HKLM\..\Run: [9B3302FE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\6rnvaef8ohox.exe
O4 - HKLM\..\Run: [84EFD776] C:\DOCUME~1\Kelley\LOCALS~1\Temp\li05rmsp64ol.exe
O4 - HKLM\..\Run: [F92FF883] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vz4j445.exe
O4 - HKLM\..\Run: [EBA359CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k6inp.exe
O4 - HKLM\..\Run: [916F054B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lbyrjqr74e.exe
O4 - HKLM\..\Run: [5DED3ECE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\iitih.exe
O4 - HKLM\..\Run: [BB81E34E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\10p1uopj.exe
O4 - HKLM\..\Run: [A666BDEB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v4khv0ck9q.exe
O4 - HKLM\..\Run: [D70079E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bfjosj6wn.exe
O4 - HKLM\..\Run: [FD2E2DCB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w39qg.exe
O4 - HKLM\..\Run: [4B6C044E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bs7.exe
O4 - HKLM\..\Run: [D5F88B56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\rw9qzzrz.exe
O4 - HKLM\..\Run: [CB40384E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q736g0.exe
O4 - HKLM\..\Run: [A92DF206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9lrmfb3.exe
O4 - HKLM\..\Run: [BC836606] C:\DOCUME~1\Kelley\LOCALS~1\Temp\5sxzyn.exe
O4 - HKLM\..\Run: [40A085CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p59.exe
O4 - HKLM\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKLM\..\Run: [58ECCF86] C:\DOCUME~1\Kelley\LOCALS~1\Temp\e0ehl2w.exe
O4 - HKLM\..\Run: [F0ACC2D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8q94p08bp3.exe
O4 - HKLM\..\Run: [A19965E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ohivyk9zwgd1.exe
O4 - HKLM\..\Run: [B99E61CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sjwelq600q.exe
O4 - HKLM\..\Run: [C4FFC85E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q3svctmxpx.exe
O4 - HKLM\..\Run: [BAB6C08B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dvnafcv.exe
O4 - HKLM\..\Run: [808F3E06] C:\DOCUME~1\Kelley\LOCALS~1\Temp\nz4margh.exe
O4 - HKLM\..\Run: [CB0CEAF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\pxcr.exe
O4 - HKLM\..\Run: [1A2002CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tib.exe
O4 - HKLM\..\Run: [B198EC66] C:\DOCUME~1\Kelley\LOCALS~1\Temp\j3hg9jxa1ja2.exe
O4 - HKLM\..\Run: [FD4E2A6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\3ejg.exe
O4 - HKLM\..\Run: [B8FA508E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z8jgz62.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [no-credit-card] c:\windows\no-credit-card.exe -m
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape 6\Netscp.exe" -turbo
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PESP] C:\WINDOWS\system32\PESP.exe
O4 - HKCU\..\Run: [D32B5B4B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\b92euycp.exe
O4 - HKCU\..\Run: [5CB2444E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\22z.exe
O4 - HKCU\..\Run: [ntsy] C:\WINDOWS\ntsy.exe
O4 - HKCU\..\Run: [4D8004CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vph.exe
O4 - HKCU\..\Run: [8039BA8B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\t2xkci6wsijk.exe
O4 - HKCU\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKCU\..\Run: [FC4F83F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sf0p.exe
O4 - HKCU\..\Run: [DD391D7E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ngoju7lfuz.exe
O4 - HKCU\..\Run: [SpywareGuardPlus] C:\WINDOWS\system32\winmm64.exe
O4 - HKCU\..\Run: [orhhmsms] C:\WINDOWS\orhhmsms.exe
O4 - HKCU\..\Run: [9B3302FE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\6rnvaef8ohox.exe
O4 - HKCU\..\Run: [84EFD776] C:\DOCUME~1\Kelley\LOCALS~1\Temp\li05rmsp64ol.exe
O4 - HKCU\..\Run: [F92FF883] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vz4j445.exe
O4 - HKCU\..\Run: [EBA359CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k6inp.exe
O4 - HKCU\..\Run: [916F054B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lbyrjqr74e.exe
O4 - HKCU\..\Run: [hhs-hhPESP] C:\WINDOWS\system32\hhs-hhPESP.exe
O4 - HKCU\..\Run: [5DED3ECE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\iitih.exe
O4 - HKCU\..\Run: [BB81E34E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\10p1uopj.exe
O4 - HKCU\..\Run: [A666BDEB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v4khv0ck9q.exe
O4 - HKCU\..\Run: [D70079E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bfjosj6wn.exe
O4 - HKCU\..\Run: [FD2E2DCB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w39qg.exe
O4 - HKCU\..\Run: [4B6C044E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bs7.exe
O4 - HKCU\..\Run: [D5F88B56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\rw9qzzrz.exe
O4 - HKCU\..\Run: [CB40384E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q736g0.exe
O4 - HKCU\..\Run: [A92DF206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9lrmfb3.exe
O4 - HKCU\..\Run: [BC836606] C:\DOCUME~1\Kelley\LOCALS~1\Temp\5sxzyn.exe
O4 - HKCU\..\Run: [40A085CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p59.exe
O4 - HKCU\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKCU\..\Run: [58ECCF86] C:\DOCUME~1\Kelley\LOCALS~1\Temp\e0ehl2w.exe
O4 - HKCU\..\Run: [F0ACC2D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8q94p08bp3.exe
O4 - HKCU\..\Run: [A19965E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ohivyk9zwgd1.exe
O4 - HKCU\..\Run: [B99E61CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sjwelq600q.exe
O4 - HKCU\..\Run: [C4FFC85E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q3svctmxpx.exe
O4 - HKCU\..\Run: [BAB6C08B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dvnafcv.exe
O4 - HKCU\..\Run: [808F3E06] C:\DOCUME~1\Kelley\LOCALS~1\Temp\nz4margh.exe
O4 - HKCU\..\Run: [CB0CEAF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\pxcr.exe
O4 - HKCU\..\Run: [1A2002CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tib.exe
O4 - HKCU\..\Run: [B198EC66] C:\DOCUME~1\Kelley\LOCALS~1\Temp\j3hg9jxa1ja2.exe
O4 - HKCU\..\Run: [FD4E2A6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\3ejg.exe
O4 - HKCU\..\Run: [B8FA508E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z8jgz62.exe
O4 - Startup: AbsoluteShield Internet Eraser.lnk = C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Global Startup: CRQ.lnk = C:\Program Files\DigitalConvergence\CRQ\CRQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: AbsoluteShield Internet Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/08775c3fcc25d4637221/…ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099420886468
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {7EB15626-CB8E-4174-8A72-C055B12B4310} (CQD2Loader Object) - http://smartdownloader.com/installer.dll
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
Post #3
Sorry for the delay, I have been away from my computer and then spent all day doing the scans you requested. I couldn't get Trendmicro Housecall to work or Command on Demand but I ran the others. I am definately infected and there were files that couldn't be "disinfected" throught the programs I ran. I have included a new Hijack this log. Thank you so much,.


Logfile of HijackThis v1.98.2
Scan saved at 2:54:41 PM, on 11/9/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\sdkyj.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\mfciw.exe
C:\WINDOWS\System32\lcobfp.exe
C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\Netscape\NETSCA~1\Netscp.exe
C:\Documents and Settings\Kelley\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b;=hc
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {550CE2AA-708D-C061-B89A-9CD1EE6A9628} - C:\WINDOWS\apphz.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\Msdxm.ocx
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [mfciw.exe] C:\WINDOWS\system32\mfciw.exe
O4 - HKLM\..\Run: [waiejxckoj] C:\WINDOWS\System32\lcobfp.exe
O4 - HKLM\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKLM\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKLM\..\Run: [DCC30476] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p6of.exe
O4 - HKLM\..\Run: [4D002B6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\69fo.exe
O4 - HKLM\..\Run: [5D41CC5E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gpk251759.exe
O4 - HKLM\..\Run: [111D54F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9j1528bda7r.exe
O4 - HKLM\..\Run: [4BCC2E4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lm0.exe
O4 - HKLM\..\Run: [19CF45D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\mw3y7v3x.exe
O4 - HKLM\..\Run: [E7835306] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w7a3bhs97.exe
O4 - HKLM\..\Run: [50C578D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ubdpjbd.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape 6\Netscp.exe" -turbo
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [D32B5B4B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\b92euycp.exe
O4 - HKCU\..\Run: [5CB2444E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\22z.exe
O4 - HKCU\..\Run: [4D8004CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vph.exe
O4 - HKCU\..\Run: [8039BA8B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\t2xkci6wsijk.exe
O4 - HKCU\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKCU\..\Run: [FC4F83F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sf0p.exe
O4 - HKCU\..\Run: [DD391D7E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ngoju7lfuz.exe
O4 - HKCU\..\Run: [9B3302FE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\6rnvaef8ohox.exe
O4 - HKCU\..\Run: [84EFD776] C:\DOCUME~1\Kelley\LOCALS~1\Temp\li05rmsp64ol.exe
O4 - HKCU\..\Run: [F92FF883] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vz4j445.exe
O4 - HKCU\..\Run: [EBA359CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k6inp.exe
O4 - HKCU\..\Run: [916F054B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lbyrjqr74e.exe
O4 - HKCU\..\Run: [5DED3ECE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\iitih.exe
O4 - HKCU\..\Run: [BB81E34E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\10p1uopj.exe
O4 - HKCU\..\Run: [A666BDEB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v4khv0ck9q.exe
O4 - HKCU\..\Run: [D70079E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bfjosj6wn.exe
O4 - HKCU\..\Run: [FD2E2DCB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w39qg.exe
O4 - HKCU\..\Run: [4B6C044E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bs7.exe
O4 - HKCU\..\Run: [D5F88B56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\rw9qzzrz.exe
O4 - HKCU\..\Run: [CB40384E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q736g0.exe
O4 - HKCU\..\Run: [A92DF206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9lrmfb3.exe
O4 - HKCU\..\Run: [BC836606] C:\DOCUME~1\Kelley\LOCALS~1\Temp\5sxzyn.exe
O4 - HKCU\..\Run: [40A085CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p59.exe
O4 - HKCU\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKCU\..\Run: [58ECCF86] C:\DOCUME~1\Kelley\LOCALS~1\Temp\e0ehl2w.exe
O4 - HKCU\..\Run: [F0ACC2D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8q94p08bp3.exe
O4 - HKCU\..\Run: [A19965E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ohivyk9zwgd1.exe
O4 - HKCU\..\Run: [B99E61CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sjwelq600q.exe
O4 - HKCU\..\Run: [C4FFC85E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q3svctmxpx.exe
O4 - HKCU\..\Run: [BAB6C08B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dvnafcv.exe
O4 - HKCU\..\Run: [808F3E06] C:\DOCUME~1\Kelley\LOCALS~1\Temp\nz4margh.exe
O4 - HKCU\..\Run: [CB0CEAF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\pxcr.exe
O4 - HKCU\..\Run: [1A2002CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tib.exe
O4 - HKCU\..\Run: [B198EC66] C:\DOCUME~1\Kelley\LOCALS~1\Temp\j3hg9jxa1ja2.exe
O4 - HKCU\..\Run: [FD4E2A6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\3ejg.exe
O4 - HKCU\..\Run: [B8FA508E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z8jgz62.exe
O4 - HKCU\..\Run: [8C032B63] C:\DOCUME~1\Kelley\LOCALS~1\Temp\2d3jd0lvoh.exe
O4 - HKCU\..\Run: [8F670DF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k3lgt3kt4.exe
O4 - HKCU\..\Run: [EDB9F20E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\zh65kv66.exe
O4 - HKCU\..\Run: [8CB4C2E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bxue.exe
O4 - HKCU\..\Run: [B9C40B0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\jkr0ku.exe
O4 - HKCU\..\Run: [F9C747F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\zotz9hnbpj.exe
O4 - HKCU\..\Run: [B9023B4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\734qlyxx7f.exe
O4 - HKCU\..\Run: [CBD686E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\qldoeicu9d.exe
O4 - HKCU\..\Run: [5085A4DE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gjyjz93qbv9.exe
O4 - HKCU\..\Run: [F0CDD706] C:\DOCUME~1\Kelley\LOCALS~1\Temp\7j4pxtx6lo.exe
O4 - HKCU\..\Run: [5EA0FE0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\0ewk9m.exe
O4 - HKCU\..\Run: [DA65C206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\17olm4d.exe
O4 - HKCU\..\Run: [BC0C10DE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tbz50b6.exe
O4 - HKCU\..\Run: [FBC98363] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ev3q.exe
O4 - HKCU\..\Run: [AA214C0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\i0rzwp.exe
O4 - HKCU\..\Run: [BBAE128B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8pktr.exe
O4 - HKCU\..\Run: [B394FE6B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ag14qpzz1n5i.exe
O4 - HKCU\..\Run: [CC3D9886] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v05pkah33.exe
O4 - HKCU\..\Run: [11D0EDCE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\cgk.exe
O4 - HKCU\..\Run: [AE2F494E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q02xbr.exe
O4 - HKCU\..\Run: [D05928EE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\2re2.exe
O4 - HKCU\..\Run: [B82C4DDE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\a3d28n7s.exe
O4 - HKCU\..\Run: [ABB873D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\4obh4o.exe
O4 - HKCU\..\Run: [FB55A88E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dxo089hkmi7.exe
O4 - HKCU\..\Run: [DCC30476] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p6of.exe
O4 - HKCU\..\Run: [4D002B6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\69fo.exe
O4 - HKCU\..\Run: [5D41CC5E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gpk251759.exe
O4 - HKCU\..\Run: [111D54F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9j1528bda7r.exe
O4 - HKCU\..\Run: [4BCC2E4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lm0.exe
O4 - HKCU\..\Run: [19CF45D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\mw3y7v3x.exe
O4 - HKCU\..\Run: [E7835306] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w7a3bhs97.exe
O4 - HKCU\..\Run: [50C578D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ubdpjbd.exe
O4 - Startup: AbsoluteShield Internet Eraser.lnk = C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Global Startup: CRQ.lnk = C:\Program Files\DigitalConvergence\CRQ\CRQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: AbsoluteShield Internet Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/08775c3fcc25d4637221/…ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099420886468
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7EB15626-CB8E-4174-8A72-C055B12B4310} (CQD2Loader Object) - http://smartdownloader.com/installer.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
Post #4 last edited
Click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. Reboot when done.

Go to this folder: C:\DOCUMENTS AND SETTINGS\Kelley\LOCAL SETTINGS\Temp\

and delete all files in there. Rescan with HJT and post a new log.
Post #5
Okay, I ran CW Shredder and then tried to clear out my local settings temp file. There were two files that wouldn't delete and when I reboot my system, the exact same ones come back that I know I shouldn't have in there. You will see by my new Hijack log that there are still tons of temp files in my Run file. ( I know where this is in my registry but wasn't sure if I should delete them.) Here is my new Hijack log. Thanks for all the help.


Logfile of HijackThis v1.98.2
Scan saved at 10:24:50 AM, on 11/10/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\mfciw.exe
C:\WINDOWS\System32\lcobfp.exe
C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
C:\Program Files\Netscape\Netscape 6\Netscp.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\sdkyj.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Kelley\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b;=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b;=hc
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {EE64A147-0632-C709-5117-0C86990AC423} - C:\WINDOWS\system32\appbt32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\Msdxm.ocx
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [mfciw.exe] C:\WINDOWS\system32\mfciw.exe
O4 - HKLM\..\Run: [waiejxckoj] C:\WINDOWS\System32\lcobfp.exe
O4 - HKLM\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKLM\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKLM\..\Run: [DCC30476] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p6of.exe
O4 - HKLM\..\Run: [4D002B6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\69fo.exe
O4 - HKLM\..\Run: [5D41CC5E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gpk251759.exe
O4 - HKLM\..\Run: [111D54F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9j1528bda7r.exe
O4 - HKLM\..\Run: [4BCC2E4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lm0.exe
O4 - HKLM\..\Run: [19CF45D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\mw3y7v3x.exe
O4 - HKLM\..\Run: [E7835306] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w7a3bhs97.exe
O4 - HKLM\..\Run: [50C578D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ubdpjbd.exe
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Program Files\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /startmonitor
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\Program Files\Netscape\Netscape 6\Netscp.exe" -turbo
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [D32B5B4B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\b92euycp.exe
O4 - HKCU\..\Run: [5CB2444E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\22z.exe
O4 - HKCU\..\Run: [4D8004CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vph.exe
O4 - HKCU\..\Run: [8039BA8B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\t2xkci6wsijk.exe
O4 - HKCU\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKCU\..\Run: [FC4F83F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sf0p.exe
O4 - HKCU\..\Run: [DD391D7E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ngoju7lfuz.exe
O4 - HKCU\..\Run: [9B3302FE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\6rnvaef8ohox.exe
O4 - HKCU\..\Run: [84EFD776] C:\DOCUME~1\Kelley\LOCALS~1\Temp\li05rmsp64ol.exe
O4 - HKCU\..\Run: [F92FF883] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vz4j445.exe
O4 - HKCU\..\Run: [EBA359CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k6inp.exe
O4 - HKCU\..\Run: [916F054B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lbyrjqr74e.exe
O4 - HKCU\..\Run: [5DED3ECE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\iitih.exe
O4 - HKCU\..\Run: [BB81E34E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\10p1uopj.exe
O4 - HKCU\..\Run: [A666BDEB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v4khv0ck9q.exe
O4 - HKCU\..\Run: [D70079E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bfjosj6wn.exe
O4 - HKCU\..\Run: [FD2E2DCB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w39qg.exe
O4 - HKCU\..\Run: [4B6C044E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bs7.exe
O4 - HKCU\..\Run: [D5F88B56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\rw9qzzrz.exe
O4 - HKCU\..\Run: [CB40384E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q736g0.exe
O4 - HKCU\..\Run: [A92DF206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9lrmfb3.exe
O4 - HKCU\..\Run: [BC836606] C:\DOCUME~1\Kelley\LOCALS~1\Temp\5sxzyn.exe
O4 - HKCU\..\Run: [40A085CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p59.exe
O4 - HKCU\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKCU\..\Run: [58ECCF86] C:\DOCUME~1\Kelley\LOCALS~1\Temp\e0ehl2w.exe
O4 - HKCU\..\Run: [F0ACC2D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8q94p08bp3.exe
O4 - HKCU\..\Run: [A19965E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ohivyk9zwgd1.exe
O4 - HKCU\..\Run: [B99E61CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sjwelq600q.exe
O4 - HKCU\..\Run: [C4FFC85E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q3svctmxpx.exe
O4 - HKCU\..\Run: [BAB6C08B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dvnafcv.exe
O4 - HKCU\..\Run: [808F3E06] C:\DOCUME~1\Kelley\LOCALS~1\Temp\nz4margh.exe
O4 - HKCU\..\Run: [CB0CEAF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\pxcr.exe
O4 - HKCU\..\Run: [1A2002CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tib.exe
O4 - HKCU\..\Run: [B198EC66] C:\DOCUME~1\Kelley\LOCALS~1\Temp\j3hg9jxa1ja2.exe
O4 - HKCU\..\Run: [FD4E2A6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\3ejg.exe
O4 - HKCU\..\Run: [B8FA508E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z8jgz62.exe
O4 - HKCU\..\Run: [8C032B63] C:\DOCUME~1\Kelley\LOCALS~1\Temp\2d3jd0lvoh.exe
O4 - HKCU\..\Run: [8F670DF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k3lgt3kt4.exe
O4 - HKCU\..\Run: [EDB9F20E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\zh65kv66.exe
O4 - HKCU\..\Run: [8CB4C2E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bxue.exe
O4 - HKCU\..\Run: [B9C40B0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\jkr0ku.exe
O4 - HKCU\..\Run: [F9C747F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\zotz9hnbpj.exe
O4 - HKCU\..\Run: [B9023B4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\734qlyxx7f.exe
O4 - HKCU\..\Run: [CBD686E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\qldoeicu9d.exe
O4 - HKCU\..\Run: [5085A4DE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gjyjz93qbv9.exe
O4 - HKCU\..\Run: [F0CDD706] C:\DOCUME~1\Kelley\LOCALS~1\Temp\7j4pxtx6lo.exe
O4 - HKCU\..\Run: [5EA0FE0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\0ewk9m.exe
O4 - HKCU\..\Run: [DA65C206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\17olm4d.exe
O4 - HKCU\..\Run: [BC0C10DE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tbz50b6.exe
O4 - HKCU\..\Run: [FBC98363] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ev3q.exe
O4 - HKCU\..\Run: [AA214C0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\i0rzwp.exe
O4 - HKCU\..\Run: [BBAE128B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8pktr.exe
O4 - HKCU\..\Run: [B394FE6B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ag14qpzz1n5i.exe
O4 - HKCU\..\Run: [CC3D9886] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v05pkah33.exe
O4 - HKCU\..\Run: [11D0EDCE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\cgk.exe
O4 - HKCU\..\Run: [AE2F494E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q02xbr.exe
O4 - HKCU\..\Run: [D05928EE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\2re2.exe
O4 - HKCU\..\Run: [B82C4DDE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\a3d28n7s.exe
O4 - HKCU\..\Run: [ABB873D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\4obh4o.exe
O4 - HKCU\..\Run: [FB55A88E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dxo089hkmi7.exe
O4 - HKCU\..\Run: [DCC30476] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p6of.exe
O4 - HKCU\..\Run: [4D002B6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\69fo.exe
O4 - HKCU\..\Run: [5D41CC5E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gpk251759.exe
O4 - HKCU\..\Run: [111D54F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9j1528bda7r.exe
O4 - HKCU\..\Run: [4BCC2E4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lm0.exe
O4 - HKCU\..\Run: [19CF45D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\mw3y7v3x.exe
O4 - HKCU\..\Run: [E7835306] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w7a3bhs97.exe
O4 - HKCU\..\Run: [50C578D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ubdpjbd.exe
O4 - Startup: AbsoluteShield Internet Eraser.lnk = C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Global Startup: CRQ.lnk = C:\Program Files\DigitalConvergence\CRQ\CRQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: AbsoluteShield Internet Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/08775c3fcc25d4637221/…ip/RdxIE601.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099420886468
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {7EB15626-CB8E-4174-8A72-C055B12B4310} (CQD2Loader Object) - http://smartdownloader.com/installer.dll
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
Post #6
Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://db105.com:81/cgi-bin/index.cgi?c=0
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\oicrj.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://s-redirect.com/?a=2&b=hc
R3 - Default URLSearchHook is missing
F3 - REG:win.ini: load=
O4 - HKLM\..\Run: [mfciw.exe] C:\WINDOWS\system32\mfciw.exe
O4 - HKLM\..\Run: [waiejxckoj] C:\WINDOWS\System32\lcobfp.exe
O4 - HKLM\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKLM\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKLM\..\Run: [DCC30476] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p6of.exe
O4 - HKLM\..\Run: [4D002B6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\69fo.exe
O4 - HKLM\..\Run: [5D41CC5E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gpk251759.exe
O4 - HKLM\..\Run: [111D54F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9j1528bda7r.exe
O4 - HKLM\..\Run: [4BCC2E4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lm0.exe
O4 - HKLM\..\Run: [19CF45D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\mw3y7v3x.exe
O4 - HKLM\..\Run: [E7835306] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w7a3bhs97.exe
O4 - HKLM\..\Run: [50C578D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ubdpjbd.exe
O4 - HKCU\..\Run: [D32B5B4B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\b92euycp.exe
O4 - HKCU\..\Run: [5CB2444E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\22z.exe
O4 - HKCU\..\Run: [4D8004CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vph.exe
O4 - HKCU\..\Run: [8039BA8B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\t2xkci6wsijk.exe
O4 - HKCU\..\Run: [8E1980D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z5tzl3an2qm.exe
O4 - HKCU\..\Run: [FC4F83F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sf0p.exe
O4 - HKCU\..\Run: [DD391D7E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ngoju7lfuz.exe
O4 - HKCU\..\Run: [9B3302FE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\6rnvaef8ohox.exe
O4 - HKCU\..\Run: [84EFD776] C:\DOCUME~1\Kelley\LOCALS~1\Temp\li05rmsp64ol.exe
O4 - HKCU\..\Run: [F92FF883] C:\DOCUME~1\Kelley\LOCALS~1\Temp\vz4j445.exe
O4 - HKCU\..\Run: [EBA359CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k6inp.exe
O4 - HKCU\..\Run: [916F054B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lbyrjqr74e.exe
O4 - HKCU\..\Run: [5DED3ECE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\iitih.exe
O4 - HKCU\..\Run: [BB81E34E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\10p1uopj.exe
O4 - HKCU\..\Run: [A666BDEB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v4khv0ck9q.exe
O4 - HKCU\..\Run: [D70079E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bfjosj6wn.exe
O4 - HKCU\..\Run: [FD2E2DCB] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w39qg.exe
O4 - HKCU\..\Run: [4B6C044E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bs7.exe
O4 - HKCU\..\Run: [D5F88B56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\rw9qzzrz.exe
O4 - HKCU\..\Run: [CB40384E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q736g0.exe
O4 - HKCU\..\Run: [A92DF206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9lrmfb3.exe
O4 - HKCU\..\Run: [BC836606] C:\DOCUME~1\Kelley\LOCALS~1\Temp\5sxzyn.exe
O4 - HKCU\..\Run: [40A085CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p59.exe
O4 - HKCU\..\Run: [BD54FF56] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9fboo.exe
O4 - HKCU\..\Run: [58ECCF86] C:\DOCUME~1\Kelley\LOCALS~1\Temp\e0ehl2w.exe
O4 - HKCU\..\Run: [F0ACC2D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8q94p08bp3.exe
O4 - HKCU\..\Run: [A19965E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ohivyk9zwgd1.exe
O4 - HKCU\..\Run: [B99E61CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\sjwelq600q.exe
O4 - HKCU\..\Run: [C4FFC85E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q3svctmxpx.exe
O4 - HKCU\..\Run: [BAB6C08B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dvnafcv.exe
O4 - HKCU\..\Run: [808F3E06] C:\DOCUME~1\Kelley\LOCALS~1\Temp\nz4margh.exe
O4 - HKCU\..\Run: [CB0CEAF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\pxcr.exe
O4 - HKCU\..\Run: [1A2002CE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tib.exe
O4 - HKCU\..\Run: [B198EC66] C:\DOCUME~1\Kelley\LOCALS~1\Temp\j3hg9jxa1ja2.exe
O4 - HKCU\..\Run: [FD4E2A6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\3ejg.exe
O4 - HKCU\..\Run: [B8FA508E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\z8jgz62.exe
O4 - HKCU\..\Run: [8C032B63] C:\DOCUME~1\Kelley\LOCALS~1\Temp\2d3jd0lvoh.exe
O4 - HKCU\..\Run: [8F670DF6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\k3lgt3kt4.exe
O4 - HKCU\..\Run: [EDB9F20E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\zh65kv66.exe
O4 - HKCU\..\Run: [8CB4C2E6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\bxue.exe
O4 - HKCU\..\Run: [B9C40B0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\jkr0ku.exe
O4 - HKCU\..\Run: [F9C747F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\zotz9hnbpj.exe
O4 - HKCU\..\Run: [B9023B4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\734qlyxx7f.exe
O4 - HKCU\..\Run: [CBD686E3] C:\DOCUME~1\Kelley\LOCALS~1\Temp\qldoeicu9d.exe
O4 - HKCU\..\Run: [5085A4DE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gjyjz93qbv9.exe
O4 - HKCU\..\Run: [F0CDD706] C:\DOCUME~1\Kelley\LOCALS~1\Temp\7j4pxtx6lo.exe
O4 - HKCU\..\Run: [5EA0FE0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\0ewk9m.exe
O4 - HKCU\..\Run: [DA65C206] C:\DOCUME~1\Kelley\LOCALS~1\Temp\17olm4d.exe
O4 - HKCU\..\Run: [BC0C10DE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\tbz50b6.exe
O4 - HKCU\..\Run: [FBC98363] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ev3q.exe
O4 - HKCU\..\Run: [AA214C0E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\i0rzwp.exe
O4 - HKCU\..\Run: [BBAE128B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\8pktr.exe
O4 - HKCU\..\Run: [B394FE6B] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ag14qpzz1n5i.exe
O4 - HKCU\..\Run: [CC3D9886] C:\DOCUME~1\Kelley\LOCALS~1\Temp\v05pkah33.exe
O4 - HKCU\..\Run: [11D0EDCE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\cgk.exe
O4 - HKCU\..\Run: [AE2F494E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\q02xbr.exe
O4 - HKCU\..\Run: [D05928EE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\2re2.exe
O4 - HKCU\..\Run: [B82C4DDE] C:\DOCUME~1\Kelley\LOCALS~1\Temp\a3d28n7s.exe
O4 - HKCU\..\Run: [ABB873D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\4obh4o.exe
O4 - HKCU\..\Run: [FB55A88E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\dxo089hkmi7.exe
O4 - HKCU\..\Run: [DCC30476] C:\DOCUME~1\Kelley\LOCALS~1\Temp\p6of.exe
O4 - HKCU\..\Run: [4D002B6E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\69fo.exe
O4 - HKCU\..\Run: [5D41CC5E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\gpk251759.exe
O4 - HKCU\..\Run: [111D54F6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\9j1528bda7r.exe
O4 - HKCU\..\Run: [4BCC2E4E] C:\DOCUME~1\Kelley\LOCALS~1\Temp\lm0.exe
O4 - HKCU\..\Run: [19CF45D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\mw3y7v3x.exe
O4 - HKCU\..\Run: [E7835306] C:\DOCUME~1\Kelley\LOCALS~1\Temp\w7a3bhs97.exe
O4 - HKCU\..\Run: [50C578D6] C:\DOCUME~1\Kelley\LOCALS~1\Temp\ubdpjbd.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/08775c3fcc25d4637221/…ip/RdxIE601.cab
O16 - DPF: {7EB15626-CB8E-4174-8A72-C055B12B4310} (CQD2Loader Object) - http://smartdownloader.com/installer.dll

Reboot when done, rescan with HJT and post a new log here for a final check over.
Post #7
ARGGH ! As you will see by my new log there are still files that you told me to "fix" with HJT . I did this and then rebooted and it looked good. Then I checked the IE. My IE was still being redirected so I rescanned with HJT and some of those files were back! . I went into my Temp file and sure enough there is still one file that won't delete. It says it is being used by some program and won't delete. I suspect this file is the culprit but I can't get rid of it. At least the porn site appears to be gone.
Anyway here is my new log.

Logfile of HijackThis v1.98.2
Scan saved at 5:29:34 PM, on 11/11/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\WINDOWS\system32\mfciw.exe
C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\system32\sdkyj.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Kelley\My Documents\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {EE64A147-0632-C709-5117-0C86990AC423} - C:\WINDOWS\system32\appbt32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\Msdxm.ocx
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - HKLM\..\Run: [mfciw.exe] C:\WINDOWS\system32\mfciw.exe
O4 - Startup: AbsoluteShield Internet Eraser.lnk = C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Global Startup: CRQ.lnk = C:\Program Files\DigitalConvergence\CRQ\CRQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: AbsoluteShield Internet Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099420886468
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
Post #8
It's a bit more managable now - click here to download ServiceFilter, a little script by rand1038 that reveals potential unauthorised running services in your system. Download, unzip and double-click ServiceFilter.vbs (you may need to enable your antivirus program to run the file). This script will create a text file named Post_This.txt in the same folder as the script itself has been saved - copy and paste the contents of Post_This.txt in your next reply here.
Post #9
Okay, here is the ServiceFilter text file. And again, thanks for all your help. The script did not recognize the services listed below. This does not mean that they are a problem. To copy the entire contents of this document for posting: At the top of this window click "Edit" then "Select All" Next click "Edit" again then "Copy" Now right click in the forum post box then click "Paste" ######################################## ServiceFilter 1.1 by rand1038 Microsoft Windows XP Home Edition Version: 5.1.2600 Nov 12, 2004 9:46:11 AM —> Begin Service Listing <— Unknown Service # 1 Service Name: O?’ŽrtñåȲ$Ó Display Name: Network Security Service Start Mode: Auto Start Name: LocalSystem Description: … Service Type: Share Process Path: c:\windows\system32\sdkyj.exe /s State: Running Process ID: 1300 Started: True Exit Code: 0 Accept Pause: False Accept Stop: True Unknown Service # 2 Service Name: AvSynMgr Display Name: AVSync Manager Start Mode: Auto Start Name: LocalSystem Description: McAfee AVSync … Service Type: Own Process Path: "c:\program files\mcafee\mcafee virusscan\avsynmgr.exe" State: Running Process ID: 1252 Started: True Exit Code: 0 Accept Pause: False Accept Stop: True Unknown Service #3 Service Name: McShield Display Name: McShield Start Mode: Manual Start Name: LocalSystem Description: McAfee On Access … Service Type: Own Process Path: "c:\program files\common files\network associates\mcshield\mcshield.exe" State: Running Process ID: 1792 Started: True Exit Code: 0 Accept Pause: False Accept Stop: True Unknown Service #4 Service Name: SwPrv Display Name: MS Software Shadow Copy Provider Start Mode: Manual Start Name: LocalSystem Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this … Service Type: Own Process Path: c:\windows\system32\dllhost.exe /processid:{574583db-1b01-4ac9-b1f1-f8508196b1d1} State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False —> End Service Listing <—
Post #10
Print out these instructions as most of the steps need to be done in Safe Mode and you won't be able to go online.

Do this so you can see hidden files and folders - click here to download xphidden.zip. Extract xphidden.reg from the zip file and save it to the desktop. When done, double-click the xphidden.reg and when asked to merge say yes. Click here to download About:Buster and unzip it to your desktop. Don´t run it yet. Also, click here to download System Security Suite. Extract it from the zip file into a folder.

Next, go to Start->Run and type Services.msc then hit Ok. Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then click on properties and under the General Tab, change the Startup Type to Disabled. Now hit Apply and then Ok and close any open windows.

Reboot into Safe Mode by tapping F8 after the BIOS has loaded.

Make sure that you have no browser windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xgfej.dll/sp.html#12802
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {EE64A147-0632-C709-5117-0C86990AC423} - C:\WINDOWS\system32\appbt32.dll
O4 - HKLM\..\Run: [mfciw.exe] C:\WINDOWS\system32\mfciw.exe

Find and delete the following:

C:\WINDOWS\system32\mfciw.exe
C:\WINDOWS\system32\sdkyj.exe

Now double click AboutBuster.exe that you downloaded earlier. Click Start then click OK. This will scan your computer for the bad files and delete them. Save the report (copy and paste into notepad or wordpad and save as a .txt file) and post a copy back here when you are done with all the steps.

Rescan with Adaware and let it remove any bad files found.

Reboot back into Normal Mode. Open System Security Suite and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

Rescan with HijackThis and post a new log here.
Post #11
Okay, I did everything and here is the log. I haven't checked the IE yet but that is next. Keep your fingers crossed!


Logfile of HijackThis v1.98.2
Scan saved at 12:49:02 PM, on 11/12/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\McAfee\McAfee VirusScan\Avsynmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\McAfee\McAfee VirusScan\VsStat.exe
C:\Program Files\McAfee\McAfee VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\McAfee VirusScan\Webscanx.exe
C:\Program Files\McAfee\McAfee VirusScan\Avconsol.exe
C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe
C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
C:\Program Files\Lexmark X74-X75\lxbbbmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Kelley\My Documents\HijackThis.exe

N3 - Netscape 7: user_pref("browser.startup.homepage", "http://www.msn.com/"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Kelley\Application Data\Mozilla\Profiles\default\trjvccy2.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\Msdxm.ocx
O4 - HKLM\..\Run: [Alogserv] C:\Program Files\McAfee\McAfee VirusScan\alogserv.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Lexmark X74-X75] "C:\Program Files\Lexmark X74-X75\lxbbbmgr.exe"
O4 - Startup: AbsoluteShield Internet Eraser.lnk = C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe
O4 - Startup: Billminder.lnk = C:\QUICKENW\billmind.exe
O4 - Global Startup: CRQ.lnk = C:\Program Files\DigitalConvergence\CRQ\CRQ.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: AbsoluteShield Internet Eraser - {4A0EF50C-6A4A-4b30-84D8-53D5BC95C043} - C:\Program Files\SysShield Tools\Internet Eraser\cseraser.exe (HKCU)
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {51045741-8C4E-4EAC-8F03-08E43A6FBB29} - http://aft.ancestry.com/aftfiles/files/ins…yFamilyTree.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1099420886468
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…StatsClient.cab
O16 - DPF: {9076A11F-5EA6-4A67-BDE9-8D3C7C453DAC} - http://www.thecoolbar.com/installfiles/coolbar.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} (CSS Web Installer Class) - http://www.commandondemand.com/eval/cod/cabs/cssweb.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
Post #13
OOPS Sorry about that. I checked the IE and it isn't being redirected ! Yah! HEre is the About buster log. And THANK YOU! Scanned at: 12:31:30 PM on: 11/12/2004 – Scan 1 ————————— About:Buster Version 3.0 Reference List : 15 No ADS found on system Removed 3 Random Key Entries Deleted 2 Service Keys Successfully! Removed! : C:\WINDOWS\conscorr.exe Removed! : C:\WINDOWS\guvgm.dat Removed! : C:\WINDOWS\javabc32.exe Removed! : C:\WINDOWS\msoq32.exe Removed! : C:\WINDOWS\sdoxkliv.exe Removed! : C:\WINDOWS\tffdc.dat Removed! : C:\WINDOWS\tyxupyt.exe Removed! : C:\WINDOWS\wupdt.exe Removed! : C:\WINDOWS\System32\addhn.exe Removed! : C:\WINDOWS\System32\mbusb.dat Removed! : C:\WINDOWS\System32\ucxik.dat Attempted Clean Of Temp folder. Removed Uninstall Key (HSA) Removed Uninstall Key (SE) Removed Uninstall Key (SW) Pages Reset… Done! – Scan 2 ————————— About:Buster Version 3.0 Reference List : 15 No ADS found on system Removed 3 Random Key Entries Attempted Clean Of Temp folder. Pages Reset… Done!
Post #15
Everything appears to be running okay. YAH! No more freaking out my customers with porno pop ups ! ( I run a bookstore where the computer screen can be easily seen by my customers). I can never thank you enough. This forum and the knowledgeable people helping out, are the best !

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI