HJT Log...computer really bad shape...please help!

Ashleeanna

Sorry for the delay

1. Rerun Hijackthis (scan only) and place checks beside the following entriesR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O3 - Toolbar: (no name) - {5d4831e0-5a7c-4a46-afd5-a79ab8ce36c2} - (no file)
Close all other open windows except Hijackthis and Select "Fix checked" and close Hijackthis

2. Please download HosterAnd Save it to your Desktop
Rt Click Hoster.zip->>Extract all->>Extract it to your Desktop
Open The Hoster folder->>Double Click Hoster.exe (It will look like a yeild sign with a stop light in the center)
When the program Opens Click The "Restore Original Hosts" Button
Close the Hoster program when complete
Reboot your PC and see if you are able to get online

thanks bamajim

Ashleeanna

Well A little progress <_<

1. *NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!

Download CCleaner from here to clean temp files from your computer.

• Double click on the file to start the installation of the program.
• Select your language and click OK, then next.
• Read the license agreement and click I Agree.
• Click next to use the default install location. Click Install then finish to complete installation.
• Double click the CCleaner shortcut on the desktop to start the program.
• On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
• If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
• Click on the "Options" icon at the left side of the window, then click on "Advanced."
  deselect "Only delete files in Windows Temp folders older than 48 hours."
• Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
• Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
• After CCleaner has completed its process, click Exit.

2.
1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

thanks bamajim

I ran CC which I have been using on a regular basis. Here is the ComboFix log… JC - Wed 12/20/2006 22:16:15.95 Service Pack 4 ComboFix 06.11.27 - Running from: "C:\" ((((((((((((((((((((((((((((((( Files Created from 2006-11-20 to 2006-12-20 )))))))))))))))))))))))))))))))))) 2006-12-20 21:43 381,390 –a—— C:\combofix.exe 2006-12-20 16:57 21,872 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\usbprint.sys 2006-12-20 16:39 d——– C:\Program Files\Lx_cats 2006-12-20 16:37 27,061,329 –a—— C:\cjb730EN.exe 2006-12-20 16:30 d——– C:\Program Files\Lexmark 730 Series 2006-12-20 16:28 d——– C:\Lexmark 2006-12-18 18:59 d——– C:\Program Files\Lavasoft 2006-12-15 15:04 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP 2006-12-14 20:41 143,360 –a—— C:\WINDOWS\SYSTEM32\dunzip32.dll 2006-12-14 17:58 d-a—— C:\Program Files\Spyware Doctor 2006-12-13 10:25 d——– C:\Program Files\SiteAdvisor 2006-12-13 10:25 d——– C:\Documents and Settings\JC\Application Data\SiteAdvisor 2006-12-13 10:25 d——– C:\Documents and Settings\All Users\Application Data\SiteAdvisor 2006-12-13 10:19 31,944 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mferkdk.sys 2006-12-13 10:18 71,496 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mfeavfk.sys 2006-12-13 10:18 35,048 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mfesmfk.sys 2006-12-13 10:18 34,120 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mfebopk.sys 2006-12-13 10:18 168,392 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mfehidk.sys 2006-12-13 10:18 100,952 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\Mpfp.sys 2006-12-13 10:16 d——– C:\Program Files\Common Files\McAfee 2006-12-13 10:01 d——– C:\Documents and Settings\All Users\Application Data\McAfee 2006-12-10 09:19 d——– C:\Documents and Settings\JC\Application Data\funkitron 2006-12-09 21:13 d——– C:\Documents and Settings\JC\Application Data\PlayFirst 2006-12-09 21:13 d——– C:\Documents and Settings\All Users\Application Data\PlayFirst 2006-12-09 15:53 d——– C:\Documents and Settings\JC\Application Data\Motive 2006-12-06 19:04 d–hs—- C:\WINDOWS\ftpcache 2006-11-30 19:57 d——– C:\WINDOWS\Minidump 2006-11-26 21:58 d——– C:\Documents and Settings\All Users\Application Data\SpinTop Games 2006-11-22 22:11 127,208 –a—— C:\WINDOWS\SYSTEM32\mucltui.dll 2006-11-22 22:09 465,176 –a—— C:\WINDOWS\SYSTEM32\wuapi.dll 2006-11-22 22:09 41,240 –a—— C:\WINDOWS\SYSTEM32\wups.dll 2006-11-22 22:09 194,328 –a—— C:\WINDOWS\SYSTEM32\wuaueng1.dll 2006-11-22 22:09 18,200 –a—— C:\WINDOWS\SYSTEM32\wups2.dll 2006-11-22 22:09 172,312 –a—— C:\WINDOWS\SYSTEM32\wuauclt1.exe 2006-11-22 22:09 127,256 –a—— C:\WINDOWS\SYSTEM32\wucltui.dll 2006-11-22 22:07 d——– C:\WINDOWS\SoftwareDistribution 2006-11-22 19:50 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2006-11-22 18:26 26,787 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\vetmonnt.sys 2006-11-22 18:25 95,344 –a—— C:\WINDOWS\SYSTEM32\ISafeIf.dll 2006-11-22 18:25 74,864 –a—— C:\WINDOWS\SYSTEM32\VetRedir.dll 2006-11-22 18:25 74,864 –a—— C:\WINDOWS\SYSTEM32\iSafProd.dll 2006-11-22 18:25 629,264 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\VetEFile.sys 2006-11-22 18:25 243,824 –a—— C:\WINDOWS\unicows.dll 2006-11-22 18:25 21,031 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\Vet-Filt.sys 2006-11-22 18:25 15,735 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\VetFDDNT.sys 2006-11-22 18:25 15,478 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\Vet-Rec.sys 2006-11-22 18:25 115,824 –a—— C:\WINDOWS\UnVet32.exe 2006-11-22 18:25 111,728 –a—— C:\WINDOWS\AVShlExt.dll 2006-11-22 18:25 108,592 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\VetEBoot.sys 2006-11-22 18:25 d——– C:\Program Files\Common Files\Scanner 2006-11-22 17:48 d——– C:\Program Files\TBN 2006-11-22 17:48 d——– C:\Program Files\Common Files\SWF Studio 2006-11-22 15:26 89,088 –a—— C:\WINDOWS\SYSTEM32\ATL71.DLL 2006-11-22 15:19 81,920 ——— C:\WINDOWS\SYSTEM32\W32n50.dll 2006-11-22 15:19 43,391 –a—— C:\WINDOWS\browser.exe 2006-11-22 15:19 17,162 ——— C:\WINDOWS\SYSTEM32\Pcandis5.sys 2006-11-22 15:19 16,848 ——— C:\WINDOWS\SYSTEM32\Pcandis4.sys 2006-11-22 15:19 d-a—— C:\Documents and Settings\All Users\Application Data\Motive 2006-11-22 15:18 d-a—— C:\Program Files\SBC Self Support Tool 2006-11-22 15:18 d-a—— C:\Program Files\Common Files\Motive 2006-11-22 15:18 d——– C:\WINDOWS\Motive 2006-11-22 15:14 d——– C:\Documents and Settings\All Users\Application Data\yahoo! 2006-11-22 12:01 98,816 –a—— C:\WINDOWS\SYSTEM32\dmstyle.dll 2006-11-22 12:01 974,848 –a—— C:\WINDOWS\SYSTEM32\dxdiag.exe 2006-11-22 12:01 83,968 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\nabtsfec.sys 2006-11-22 12:01 80,896 –a—— C:\WINDOWS\SYSTEM32\dpvsetup.exe 2006-11-22 12:01 797,184 –a—— C:\WINDOWS\SYSTEM32\d3dim700.dll 2006-11-22 12:01 79,360 –a—— C:\WINDOWS\SYSTEM32\dpwsockx.dll 2006-11-22 12:01 77,824 –a—— C:\WINDOWS\SYSTEM32\dpmodemx.dll 2006-11-22 12:01 76,800 –a—— C:\WINDOWS\SYSTEM32\dmscript.dll 2006-11-22 12:01 733,184 –a—— C:\WINDOWS\SYSTEM32\qedwipes.dll 2006-11-22 12:01 723,968 –a—— C:\WINDOWS\SYSTEM32\dpnet.dll 2006-11-22 12:01 7,424 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mskssrv.sys 2006-11-22 12:01 7,168 –a—— C:\WINDOWS\SYSTEM32\d3d8thk.dll 2006-11-22 12:01 68,096 –a—— C:\WINDOWS\SYSTEM32\dpnhupnp.dll 2006-11-22 12:01 664,576 –a—— C:\WINDOWS\SYSTEM32\dinput8.dll 2006-11-22 12:01 645,120 –a—— C:\WINDOWS\SYSTEM32\dinput.dll 2006-11-22 12:01 64,512 –a—— C:\WINDOWS\SYSTEM32\amstream.dll 2006-11-22 12:01 602,624 –a—— C:\WINDOWS\SYSTEM32\dx7vb.dll 2006-11-22 12:01 591,120 –a—— C:\WINDOWS\SYSTEM32\d3dramp.dll 2006-11-22 12:01 58,368 –a—— C:\WINDOWS\SYSTEM32\dmcompos.dll 2006-11-22 12:01 56,832 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\msdv.sys 2006-11-22 12:01 5,504 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mstee.sys 2006-11-22 12:01 5,248 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mspclock.sys 2006-11-22 12:01 491,520 –a—— C:\WINDOWS\SYSTEM32\dsdmoprp.dll 2006-11-22 12:01 49,424 –a—— C:\WINDOWS\SYSTEM32\d3dxof.dll 2006-11-22 12:01 480,256 –a—— C:\WINDOWS\SYSTEM32\msvidctl.dll 2006-11-22 12:01 48,512 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\stream.sys 2006-11-22 12:01 470,528 –a—— C:\WINDOWS\SYSTEM32\qdvd.dll 2006-11-22 12:01 47,104 –a—— C:\WINDOWS\SYSTEM32\wstdecod.dll 2006-11-22 12:01 46,592 –a—— C:\WINDOWS\SYSTEM32\dxdllreg.exe 2006-11-22 12:01 459,264 –a—— C:\WINDOWS\SYSTEM32\diactfrm.dll 2006-11-22 12:01 446,224 –a—— C:\WINDOWS\SYSTEM32\d3dim.dll 2006-11-22 12:01 44,032 –a—— C:\WINDOWS\SYSTEM32\dimap.dll 2006-11-22 12:01 4,096 –a—— C:\WINDOWS\SYSTEM32\ksuser.dll 2006-11-22 12:01 4,096 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\swenum.sys 2006-11-22 12:01 381,952 –a—— C:\WINDOWS\SYSTEM32\dsound.dll 2006-11-22 12:01 381,952 –a—— C:\WINDOWS\SYSTEM32\dpvoice.dll 2006-11-22 12:01 37,648 –a—— C:\WINDOWS\SYSTEM32\d3dpmesh.dll 2006-11-22 12:01 364,816 –a—— C:\WINDOWS\SYSTEM32\d3drm.dll 2006-11-22 12:01 354,816 –a—— C:\WINDOWS\SYSTEM32\psisdecd.dll 2006-11-22 12:01 34,304 –a—— C:\WINDOWS\SYSTEM32\mciqtz32.dll 2006-11-22 12:01 33,280 –a—— C:\WINDOWS\SYSTEM32\dmloader.dll 2006-11-22 12:01 324,096 –a—— C:\WINDOWS\SYSTEM32\mswebdvd.dll 2006-11-22 12:01 32,768 –a—— C:\WINDOWS\SYSTEM32\dpnhpast.dll 2006-11-22 12:01 316,928 –a—— C:\WINDOWS\SYSTEM32\qdv.dll 2006-11-22 12:01 31,744 –a—— C:\WINDOWS\SYSTEM32\pid.dll 2006-11-22 12:01 3,072 –a—— C:\WINDOWS\SYSTEM32\dpnlobby.dll 2006-11-22 12:01 3,072 –a—— C:\WINDOWS\SYSTEM32\dpnaddr.dll 2006-11-22 12:01 292,864 –a—— C:\WINDOWS\SYSTEM32\ddraw.dll 2006-11-22 12:01 28,160 –a—— C:\WINDOWS\SYSTEM32\dplaysvr.exe 2006-11-22 12:01 27,136 –a—— C:\WINDOWS\SYSTEM32\dmband.dll 2006-11-22 12:01 257,024 –a—— C:\WINDOWS\SYSTEM32\qcap.dll 2006-11-22 12:01 230,400 –a—— C:\WINDOWS\SYSTEM32\dplayx.dll 2006-11-22 12:01 206,336 –a—— C:\WINDOWS\SYSTEM32\gcdef.dll 2006-11-22 12:01 2,297,552 –a—— C:\WINDOWS\SYSTEM32\d3dx9_26.dll 2006-11-22 12:01 19,968 –a—— C:\WINDOWS\SYSTEM32\dpvacm.dll 2006-11-22 12:01 186,880 –a—— C:\WINDOWS\SYSTEM32\dsdmo.dll 2006-11-22 12:01 181,248 –a—— C:\WINDOWS\SYSTEM32\dmime.dll 2006-11-22 12:01 18,944 –a—— C:\WINDOWS\SYSTEM32\encapi.dll 2006-11-22 12:01 18,688 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\wstcodec.sys 2006-11-22 12:01 18,432 –a—— C:\WINDOWS\SYSTEM32\dswave.dll 2006-11-22 12:01 16,896 –a—— C:\WINDOWS\SYSTEM32\msyuv.dll 2006-11-22 12:01 16,896 –a—— C:\WINDOWS\SYSTEM32\dpnsvr.exe 2006-11-22 12:01 16,384 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ccdecode.sys 2006-11-22 12:01 15,104 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mpe.sys 2006-11-22 12:01 14,976 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\streamip.sys 2006-11-22 12:01 132,608 –a—— C:\WINDOWS\SYSTEM32\devenum.dll 2006-11-22 12:01 130,304 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ks.sys 2006-11-22 12:01 13,312 –a—— C:\WINDOWS\SYSTEM32\msdmo.dll 2006-11-22 12:01 122,880 –a—— C:\WINDOWS\SYSTEM32\dmusic.dll 2006-11-22 12:01 112,128 –a—— C:\WINDOWS\SYSTEM32\dpvvox.dll 2006-11-22 12:01 11,392 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\bdasup.sys 2006-11-22 12:01 100,864 –a—— C:\WINDOWS\SYSTEM32\dmsynth.dll 2006-11-22 12:01 10,880 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\slip.sys 2006-11-22 12:01 10,112 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\ndisip.sys 2006-11-22 12:01 1,962,496 –a—— C:\WINDOWS\SYSTEM32\quartz.dll 2006-11-22 12:01 1,798,144 –a—— C:\WINDOWS\SYSTEM32\qedit.dll 2006-11-22 12:01 1,769,472 –a—— C:\WINDOWS\SYSTEM32\dxdiagn.dll 2006-11-22 12:01 1,703,936 –a—— C:\WINDOWS\SYSTEM32\d3d9.dll 2006-11-22 12:01 1,294,336 –a—— C:\WINDOWS\SYSTEM32\dsound3d.dll 2006-11-22 12:01 1,201,152 –a—— C:\WINDOWS\SYSTEM32\d3d8.dll 2006-11-22 12:01 1,189,888 –a—— C:\WINDOWS\SYSTEM32\dx8vb.dll 2006-11-21 17:20 253,952 ——— C:\WINDOWS\SBCDSL.exe (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-20 19:21 ——– d——– C:\Program Files\HijackThis 2006-12-20 11:18 ——– d-a—— C:\Program Files\McAfee 2006-12-18 19:19 ——– d——– C:\Documents and Settings\JC\Application Data\Lavasoft 2006-12-17 18:22 ——– d——– C:\Program Files\Desktop Alert 2006-12-13 10:17 ——– d-a—— C:\Program Files\McAfee.com 2006-12-13 10:16 ——– dra—— C:\Program Files\Common Files 2006-11-28 12:20 ——– d——– C:\Documents and Settings\JC\Application Data\Yahoo! 2006-11-27 15:07 ——– dra—— C:\Program Files\Common Files\Microsoft Shared 2006-11-27 14:51 ——– d-a—— C:\Program Files\Common Files\Intuit 2006-11-27 14:50 ——– dra—— C:\Program Files\Outlook Express 2006-11-27 14:50 ——– d-a—— C:\Program Files\Uninstall Information 2006-11-27 14:50 ——– d-a—— C:\Program Files\Internet Explorer 2006-11-27 14:50 ——– d-a—— C:\Program Files\Common Files\SYSTEM 2006-11-26 20:44 ——– d——– C:\Program Files\Real 2006-11-24 20:20 ——– d——– C:\Program Files\Spybot - Search & Destroy 2006-11-22 22:09 ——– d-ah—– C:\Program Files\WindowsUpdate 2006-11-22 18:25 ——– d-a—— C:\Program Files\Yahoo! 2006-11-21 17:23 ——– d-a—— C:\Program Files\BroadJump 2006-11-17 21:37 2560 –a—— C:\WINDOWS\_MSRSTRT.EXE 2006-11-17 21:34 ——– d-a—— C:\Program Files\Common Files\Caere 2006-11-15 19:01 ——– d——– C:\Documents and Settings\JC\Application Data\PC Tools 2006-11-15 18:59 ——– d——– C:\Program Files\SpywareBlaster 2006-11-10 08:40 ——– d——– C:\Documents and Settings\JC\Application Data\Digital Album Organizer 2006-11-07 12:56 ——– d–h—– C:\Program Files\InstallShield Installation Information 2006-10-23 21:45 ——– d-a—— C:\Program Files\Microsoft Home Publishing 2000 (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet" "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SystemTray"="SysTray.Exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "YBrowser"="C:\\PROGRA~1\\Yahoo!\\browser\\ybrwicon.exe" "Motive SmartBridge"="C:\\PROGRA~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe" "CaAvTray"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVTray.exe\"" "CAVRID"="\"C:\\Program Files\\Yahoo!\\Antivirus\\CAVRID.exe\"" "YOP"="C:\\PROGRA~1\\Yahoo!\\YOP\\yop.exe /autostart" "McAfee Privacy Service"="C:\\Program Files\\McAfee\\MPS\\mps.exe -r" "MskAgentexe"="C:\\Program Files\\McAfee\\MSK\\MskAgent.exe" "SiteAdvisor"="C:\\Program Files\\SiteAdvisor\\4608\\SiteAdv.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000003 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,00,00,ff,\ ff,ff,3f,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:01,00,00,00 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f0,01,00,00,1f,00,00,00,80,00,00,00,76,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Spyware Doctor"="\"C:\\Program Files\\Spyware Doctor\\swdoctor.exe\" /Q" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{01b55afa-f451-474b-9e91-c35b24d02641}"="boob" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 "CDRAutoRun"=dword:00000000 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "isamini.exe"="C:\\Program Files\\Video ActiveX Object\\isamonitor.exe" [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000095 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "Network.ConnectionTray"="{7007ACCF-3202-11D1-AAD2-00805FC1270E}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\MCODS Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\McQcTask.job C:\WINDOWS\tasks\Tune-up Application Start.job Completion time: Wed 2006-12-20 22:29:43.63 C:\ComboFix.txt … 06-12-20 22:29 C:\ComboFix2.txt … 06-12-20 21:49

Ashleeanna

That gave us some of what we need

1. Please go HERE

And Download SmitFraudFix by S!riSave it to your Desktop->>Rt Click->>Extract all->>and extract it to your desktop
Open The Smitfraud folder
Double-click smitfraudfix.cmd
Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt
Open that file, Ctrl+A to copy, and post a copy of that log as a reply to this thread
Do Not run option 2 until instructed to do so

Please note that some Antivirus programs flag process.exe as an infection, but it is actually a needed componient of this tool

your reply should includeyour rapport.txt from Smitfraudfix
thanks bamajim

here is the report SmitFraudFix v2.131 Scan done at 10:05:25.36, Thu 2006-12-21 Run from C:\unzipped\SmitfraudFix\SmitfraudFix OS: Microsoft Windows 2000 [Version 5.00.2195] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\migicons.exe FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\JC »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\JC\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JC\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler] "{01b55afa-f451-474b-9e91-c35b24d02641}"="boob" »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32 »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

Ashleeanna

You may want to print out these instructions for reference

1. Go here and Download AVG Anti-Spyware
(30 day free trial version) Save it to Your Desktop
 
Double Click AVG Anti-Spyware-setup
(It will create its own folder)
Once the program starts You will be at the Status menuUnder "Your computers Security"
Click change status on Resident shield to inactive
Click Update now (next to last update)
After the update loads
Under Automatic updates Uncheck download and install updates automatically(recommended)
(you can always select maual updates the next day)
At the top toolbar Click Scanner Then the settings tabUnder How to act? Set default action for detected malwareTo Quarantine
Under how to scan All boxes should be checked
Under Possibly unwanted software All boxes should be checked
Under reports Select Automatically generate report after every scan
Uncheck Only if threats were found
Under what to scan Scan every file should be highlited
Exit AVG(But do not run it yet)

2. Reboot into Safe Mode
This can be done byRestart your PC, and after it starts, but before you see the Windows Splash screen
Begin tapping the F8 key twice a second untill you reach another menu screen (black background with white menu choices)
Use your arrow keys and select Safe Mode and then Enter
3. Open the SmitfraudFix Folder, then double-click smitfraudfix.cmd file to start the tool.Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.
A reboot may be needed to finish the cleaning process, if your computer does not restart automatically please do it yourself manually. Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

4. Run AVG Anti-SpywareClick scanner
Select Complete system scan
Once the scan finishesSelect Apply all actions (The items found will be quarantined)
Click save report as (Another window will open)
Save it to your desktop
(By default It will be saved in the AVG folder as)
C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports
Exit AVG

Reboot your PC in Normal Mode->>Re run Hijackthis and post a fresh Hijackthis log.Double click the report-scan txt. you saved to your desktop
It will open in Notepad
Copy and paste that report as a reply to this thread
Your reply should includea fresh hijackthis log
your c:rapport.txt log from Smitfraudfix
your report_scan.txt from AVG
You may have to post the results in more than one reply

thanks bamajim

Ashleeanna

I did want you to run AVG in Safe mode

1. We need to make sure we can see hidden files and foldersClick Start.
Click My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Uncheck the Hide file extensions for known file types.
Click OK.
Next Using Windows Explorer(Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)
Locate and delete the following folderC:\\Program Files\\Video ActiveX Object
Close windows explorer->>Reboot your PC

I need to know if that file was there

thanks bamajim

Did not find the file

Ashleeana That's good, How's your PC running now? Could I see a frsh Hijackthis log thanks bamajim

I still cannot get online. When I open a window it will take a long time to load. when you close it out it still goes to about blank. All programs run slow. We got all this off of my space. went to download the video player and got hijacked or something. Will post back with HJt log

Ashleeanna

Sorry for the delay in responding, could I see a fresh Combofix log please.

thanks bamajim