4 replies to this topic

[Daemon]

Could you download HijackThis, create a new folder called C:\HijackThis, extract the HijackThis.exe file from the zip file into the new folder and run it from there to scan your computer. When the scan is finished, the "Scan" button will change into a "Save Log" button. Save the log, Ctrl-A to Select All and post it here for examination. Don't fix anything yet as most of what it lists will be harmless.

[Daemon]

You have a bit more than Lop in there. First of all, could you download CWShredder and run it, hit 'fix' as opposed to 'scan only'.

Then download Spybot Search & Destroy - install, update, scan and fix all RED items it finds. Reboot when done.

Next, make sure that you have no other browsers or windows open as this could prevent the fix from working properly. Open HijackThis, scan and when complete, remove the following entries (if still there) by checking the box to the left and clicking 'fixed checked':

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch...px?tb_id=%tb_id
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearchnow.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://mysearchnow.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch...px?tb_id=%tb_id
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch...px?tb_id=%tb_id
R3 - URLSearchHook: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - C:\PROGRA~1\COMMON~1\BTLINK\btlink.dll
O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\Program Files\CommonName\Toolbar\CNBabe.dll (file missing)
O2 - BHO: (no name) - {4257eb5c-629d-40f5-8f1a-af8668241de8} - C:\DOCUME~1\Wil\APPLIC~1\afrkbdrxst.dll
O2 - BHO: (no name) - {63B78BC1-A711-4D46-AD2F-C581AC420D41} - C:\WINDOWS\System32\btiein.dll
O2 - BHO: (no name) - {D6DFF6D8-B94B-4720-B730-1C38C7065C3B} - C:\PROGRA~1\COMMON~1\BTLINK\btlink.dll
O4 - HKLM\..\Run: [qudrxfr] C:\DOCUME~1\Wil\APPLIC~1\oeckbrcq.exe -QuieT
O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O8 - Extra context menu item: Power Search - res://C:\PROGRA~1\COMMON~1\MSIETS\msielink.dll//iemenu
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/i...etup1.0.0.5.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://dst.trafficsy...0006/btiein.cab
O16 - DPF: {8522F9B3-38C5-4AA4-AE40-7401F1BBC851} - http://216.65.38.226...load_Plugin.exe


Go here and download Mosaic1's Show & Find All then unzip the file. It contains a script to reset hidden file settings for both Search and Folder Options. Double click on the vbs to execute it. Reboot into safe mode, find and delete the following:

O4 - HKLM\..\Run: [qudrxfr] C:\DOCUME~1\Wil\APPLIC~1\oeckbrcq.exe
O4 - HKLM\..\Run: [AutoUpdater] C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EXE

Rescan with HJT and post a new log here for a final check over.