180 Solutions and 2nd Thought

Just to update, I have downloaded and ran Adaware and Spyhunter. Neither have found the 180Solutions or 2nd Thought entries but AdsGone continues to find them. This is driving me crazy. Anyone with any ideas? Thanks

Hello and welcome to the forums

Download DelDomains.inf
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click and select….. Save Target As….Save

To use: Right-click and select……. Install (no need to restart)
**Note** This will remove all entries in the "Trusted Zone"

Next:

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.


(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time.

Next:

Download AVG Anti-Spyware from HERE and save that file to your
desktop.
This is a 30 day trial of the program

• Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop
  and double-click it to launch the set up program.
• Once the setup is complete you will need run ewido and update the definition
  files.
• On the main screen select the icon "Update" then select the "
  Update now" link.
  • Next select the "Start Update" button, the update will start and a
    progress bar will show the updates being installed.
• Once the update has completed select the "Scanner" icon at the top of
  the screen, then select the "Settings" tab.
• Once in the Settings screen click on "Recommended actions" and then
  select " "Quarantine" .".
• Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"

Close AVG Anti-Spyware, Do Not run a scan just yet, we will shortly.

• Reboot your computer into SafeMode. You can do this by restarting
  your computer and continually tapping the F8 key until a menu appears.
  
  Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or
  programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
• Lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
• Select the "Scanner" icon at the top and then the "Scan" tab
  then click on "Complete System Scan".
• ewido will now begin the scanning process, be patient this may take a little
  time.
  Once the scan is complete do the following:
• If you have any infections you will prompted, then select "Apply all
  actions"
• Next select the "Reports" icon at the top.
• Select the "Save report as" button in the lower left hand of the
  screen and save it to a text file on your system (make sure to remember where
  you saved that file, this is important).
• Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the
  results of the AVG Anti-Spyware report scan along with a new HijackThis log.

Please use the [external image: Posted Image] Button below to reply.

I suggest you do this:



With AVG Anti-Spyware, if you click on the Infections icon, then it will show you all the items in Quarrantine and you can remove them that way. Just click Select All (if all of the items in quarrantine need removing) then Remove Finally


Please do not delete anything unless instructed to.



Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on these:

R3 - Default URLSearchHook is missing
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should
be Intranet Zone (HKLM)
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should
be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should
be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should
be Internet Zone (HKLM)
O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should
be Internet Zone (HKLM)
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -

Close ALL windows and browsers except HijackThis and click "Fix checked"



Empty Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.


Please use the [external image: Posted Image] Button below to reply.

we need to fix those 015's

Download: ResetProtocolDefaults.reg
http://www.mvps.org/winhelp2002/ResetProtocolDefaults.reg

Locate "ResetProtocolDefaults.reg"
Right-click and select: Merge (Ok the prompt)

Post a new HJT log.

Will download as you instructed and post back. As further info here is the AdsGone log that might provide you with more info "SOFTWARE\Microsoft\DownloadManager, Found , 1/15/2007 6:08:24 PM" "aspfile\persistenthandler, Found , 1/15/2007 6:08:26 PM" "software\microsoft\mediaplayer\control\playbar, Found , 1/15/2007 6:08:27 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 6:08:29 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 6:08:29 PM" "software\vb and vba program settings, Found , 1/15/2007 6:08:29 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 6:08:30 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 6:08:30 PM" "software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com, Found , 1/15/2007 6:08:31 PM" "software\microsoft\internet explorer\menuext\&download with &dap, Found , 1/15/2007 6:08:32 PM" "software\classes\anigifctrl.anigif\insertable, Found , 1/15/2007 6:08:32 PM" "software\classes\clsid\{5bfa1daf-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 6:08:32 PM" "software\classes\clsid\{61ab12e1-a5ff-11d1-b2e9-444553540000}, Found , 1/15/2007 6:08:32 PM" "software\classes\clsid\{6dc82d15-92f2-11d1-a255-00a0c932c7df}, Found , 1/15/2007 6:08:32 PM" "software\classes\clsid\{8110aea1-ad5b-4b90-883f-04a9a33b106e}, Found , 1/15/2007 6:08:32 PM" "software\classes\clsid\{82351441-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 6:08:32 PM" "software\classes\clsid\{9738b9e6-8afa-11d2-959e-444553540002}, Found , 1/15/2007 6:08:32 PM" "software\classes\interface\{5252ac41-94bb-11d1-b2e7-444553540000}, Found , 1/15/2007 6:08:32 PM" "software\classes\interface\{5bfa1dae-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 6:08:32 PM" "software\classes\interface\{82351440-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 6:08:32 PM" "software\classes\interface\{f32c7705-1dad-4b09-b60a-40f1d9b3dbc9}, Found , 1/15/2007 6:08:32 PM" "software\classes\typelib\{5bfa1da1-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 6:08:32 PM" "software\classes\typelib\{5fe38345-35a8-11d3-bd27-000021c9a4d9}, Found , 1/15/2007 6:08:32 PM" "software\classes\typelib\{82351433-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 6:08:32 PM" "software\speedbit, Found , 1/15/2007 6:08:32 PM" "software\speedbit, Found , 1/15/2007 6:08:32 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net, Found , 1/15/2007 6:08:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com, Found , 1/15/2007 6:08:44 PM" "software\microsoft\windows\currentversion\moduleusage\, Found , 1/15/2007 6:08:48 PM" "software\microsoft\windows\currentversion\shareddlls\, Found , 1/15/2007 6:08:48 PM" "SOFTWARE\Microsoft\DownloadManager, Found , 1/15/2007 7:49:56 PM" "aspfile\persistenthandler, Found , 1/15/2007 7:49:59 PM" "software\microsoft\mediaplayer\control\playbar, Found , 1/15/2007 7:50:01 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 7:50:05 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 7:50:05 PM" "software\vb and vba program settings, Found , 1/15/2007 7:50:05 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 7:50:08 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 7:50:08 PM" "software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com, Found , 1/15/2007 7:50:09 PM" "software\microsoft\internet explorer\menuext\&download with &dap, Found , 1/15/2007 7:50:11 PM" "software\classes\anigifctrl.anigif\insertable, Found , 1/15/2007 7:50:11 PM" "software\classes\clsid\{5bfa1daf-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 7:50:11 PM" "software\classes\clsid\{61ab12e1-a5ff-11d1-b2e9-444553540000}, Found , 1/15/2007 7:50:11 PM" "software\classes\clsid\{6dc82d15-92f2-11d1-a255-00a0c932c7df}, Found , 1/15/2007 7:50:11 PM" "software\classes\clsid\{8110aea1-ad5b-4b90-883f-04a9a33b106e}, Found , 1/15/2007 7:50:11 PM" "software\classes\clsid\{82351441-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 7:50:11 PM" "software\classes\clsid\{9738b9e6-8afa-11d2-959e-444553540002}, Found , 1/15/2007 7:50:11 PM" "software\classes\interface\{5252ac41-94bb-11d1-b2e7-444553540000}, Found , 1/15/2007 7:50:11 PM" "software\classes\interface\{5bfa1dae-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 7:50:11 PM" "software\classes\interface\{82351440-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 7:50:11 PM" "software\classes\interface\{f32c7705-1dad-4b09-b60a-40f1d9b3dbc9}, Found , 1/15/2007 7:50:11 PM" "software\classes\typelib\{5bfa1da1-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 7:50:11 PM" "software\classes\typelib\{5fe38345-35a8-11d3-bd27-000021c9a4d9}, Found , 1/15/2007 7:50:11 PM" "software\classes\typelib\{82351433-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 7:50:11 PM" "software\speedbit, Found , 1/15/2007 7:50:11 PM" "software\speedbit, Found , 1/15/2007 7:50:11 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net, Found , 1/15/2007 7:50:23 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com, Found , 1/15/2007 7:50:23 PM" "software\microsoft\windows\currentversion\moduleusage\, Found , 1/15/2007 7:50:27 PM" "software\microsoft\windows\currentversion\shareddlls\, Found , 1/15/2007 7:50:27 PM" "SOFTWARE\Microsoft\DownloadManager, Found , 1/15/2007 8:03:02 PM" "aspfile\persistenthandler, Found , 1/15/2007 8:03:05 PM" "software\microsoft\mediaplayer\control\playbar, Found , 1/15/2007 8:03:06 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 8:03:09 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 8:03:09 PM" "software\vb and vba program settings, Found , 1/15/2007 8:03:09 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 8:03:11 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 8:03:11 PM" "software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com, Found , 1/15/2007 8:03:13 PM" "software\microsoft\internet explorer\menuext\&download with &dap, Found , 1/15/2007 8:03:14 PM" "software\classes\anigifctrl.anigif\insertable, Found , 1/15/2007 8:03:14 PM" "software\classes\clsid\{5bfa1daf-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 8:03:14 PM" "software\classes\clsid\{61ab12e1-a5ff-11d1-b2e9-444553540000}, Found , 1/15/2007 8:03:14 PM" "software\classes\clsid\{6dc82d15-92f2-11d1-a255-00a0c932c7df}, Found , 1/15/2007 8:03:14 PM" "software\classes\clsid\{8110aea1-ad5b-4b90-883f-04a9a33b106e}, Found , 1/15/2007 8:03:14 PM" "software\classes\clsid\{82351441-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 8:03:14 PM" "software\classes\clsid\{9738b9e6-8afa-11d2-959e-444553540002}, Found , 1/15/2007 8:03:14 PM" "software\classes\interface\{5252ac41-94bb-11d1-b2e7-444553540000}, Found , 1/15/2007 8:03:14 PM" "software\classes\interface\{5bfa1dae-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 8:03:14 PM" "software\classes\interface\{82351440-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 8:03:14 PM" "software\classes\interface\{f32c7705-1dad-4b09-b60a-40f1d9b3dbc9}, Found , 1/15/2007 8:03:14 PM" "software\classes\typelib\{5bfa1da1-5edc-11d2-959e-00c00c02da5e}, Found , 1/15/2007 8:03:14 PM" "software\classes\typelib\{5fe38345-35a8-11d3-bd27-000021c9a4d9}, Found , 1/15/2007 8:03:14 PM" "software\classes\typelib\{82351433-9094-11d1-a24b-00a0c932c7df}, Found , 1/15/2007 8:03:14 PM" "software\speedbit, Found , 1/15/2007 8:03:14 PM" "software\speedbit, Found , 1/15/2007 8:03:14 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.com, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.com, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net, Found , 1/15/2007 8:03:27 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com, Found , 1/15/2007 8:03:27 PM" "software\microsoft\windows\currentversion\moduleusage\, Found , 1/15/2007 8:03:31 PM" "software\microsoft\windows\currentversion\shareddlls\, Found , 1/15/2007 8:03:31 PM" "SOFTWARE\Microsoft\DownloadManage, Remove, 1/15/2007 8:03:40 PM" "aspfile\persistenthandle, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\mediaplayer\control\playba, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\internet explorer\urlsearchhook, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\internet explorer\urlsearchhook, Remove, 1/15/2007 8:03:40 PM" "software\vb and vba program setting, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.co, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\internet explorer\menuext\&download with &da, Remove, 1/15/2007 8:03:40 PM" "software\classes\anigifctrl.anigif\insertabl, Remove, 1/15/2007 8:03:40 PM" "software\classes\clsid\{5bfa1daf-5edc-11d2-959e-00c00c02da5e, Remove, 1/15/2007 8:03:40 PM" "software\classes\clsid\{61ab12e1-a5ff-11d1-b2e9-444553540000, Remove, 1/15/2007 8:03:40 PM" "software\classes\clsid\{6dc82d15-92f2-11d1-a255-00a0c932c7df, Remove, 1/15/2007 8:03:40 PM" "software\classes\clsid\{8110aea1-ad5b-4b90-883f-04a9a33b106e, Remove, 1/15/2007 8:03:40 PM" "software\classes\clsid\{82351441-9094-11d1-a24b-00a0c932c7df, Remove, 1/15/2007 8:03:40 PM" "software\classes\clsid\{9738b9e6-8afa-11d2-959e-444553540002, Remove, 1/15/2007 8:03:40 PM" "software\classes\interface\{5252ac41-94bb-11d1-b2e7-444553540000, Remove, 1/15/2007 8:03:40 PM" "software\classes\interface\{5bfa1dae-5edc-11d2-959e-00c00c02da5e, Remove, 1/15/2007 8:03:40 PM" "software\classes\interface\{82351440-9094-11d1-a24b-00a0c932c7df, Remove, 1/15/2007 8:03:40 PM" "software\classes\interface\{f32c7705-1dad-4b09-b60a-40f1d9b3dbc9, Remove, 1/15/2007 8:03:40 PM" "software\classes\typelib\{5bfa1da1-5edc-11d2-959e-00c00c02da5e, Remove, 1/15/2007 8:03:40 PM" "software\classes\typelib\{5fe38345-35a8-11d3-bd27-000021c9a4d9, Remove, 1/15/2007 8:03:40 PM" "software\classes\typelib\{82351433-9094-11d1-a24b-00a0c932c7df, Remove, 1/15/2007 8:03:40 PM" "software\speedbi, Remove, 1/15/2007 8:03:40 PM" "software\speedbi, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.co, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\flingstone.co, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchbarcash.co, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.co, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.co, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.co, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.ne, Remove, 1/15/2007 8:03:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.co, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\windows\currentversion\moduleusage, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\windows\currentversion\shareddlls, Remove, 1/15/2007 8:03:40 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/15/2007 8:05:02 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/15/2007 8:05:02 PM" "software\speedbit, Found , 1/15/2007 8:05:03 PM" "software\microsoft\internet explorer\urlsearchhook, Remove, 1/15/2007 8:05:26 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/15/2007 8:05:26 PM" "software\speedbi, Remove, 1/15/2007 8:05:26 PM" "software\vb and vba program settings, Found , 1/15/2007 8:06:35 PM" "software\vb and vba program setting, Remove, 1/15/2007 8:07:04 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine15-01-2007-20-03-40.asr, Removed from Quarantined, 1/15/2007 8:11:23 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine15-01-2007-20-05-26.asr, Removed from Quarantined, 1/15/2007 8:11:28 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine15-01-2007-20-07-04.asr, Removed from Quarantined, 1/15/2007 8:11:32 PM" "software\vb and vba program settings, Found , 1/16/2007 12:46:51 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/16/2007 12:46:54 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/16/2007 12:46:54 PM" "software\vb and vba program setting, Remove, 1/16/2007 12:48:18 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/16/2007 12:48:18 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/16/2007 12:48:18 PM" "aspfile\persistenthandler, Found , 1/16/2007 6:31:05 PM" "software\vb and vba program settings, Found , 1/16/2007 6:31:11 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/16/2007 6:31:14 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/16/2007 6:31:14 PM" "aspfile\persistenthandle, Remove, 1/16/2007 7:13:57 PM" "software\vb and vba program setting, Remove, 1/16/2007 7:13:58 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/16/2007 7:13:58 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/16/2007 7:13:58 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/16/2007 7:16:03 PM" "software\microsoft\windows\currentversion\shareddlls\, Found , 1/16/2007 7:16:18 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/16/2007 7:30:09 PM" "software\microsoft\windows\currentversion\shareddlls, Remove, 1/16/2007 7:30:09 PM" "aspfile\persistenthandler, Found , 1/17/2007 7:14:38 PM" "software\vb and vba program settings, Found , 1/17/2007 7:14:40 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/17/2007 7:14:41 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/17/2007 7:14:41 PM" "software\microsoft\windows\currentversion\shareddlls\, Found , 1/17/2007 7:14:55 PM" "aspfile\persistenthandle, Remove, 1/17/2007 7:40:53 PM" "software\vb and vba program setting, Remove, 1/17/2007 7:40:53 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/17/2007 7:40:53 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/17/2007 7:40:53 PM" "software\microsoft\windows\currentversion\shareddlls, Remove, 1/17/2007 7:40:53 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine16-01-2007-12-48-18.asr, Removed from Quarantined, 1/17/2007 8:22:42 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine17-01-2007-19-40-53.asr, Removed from Quarantined, 1/17/2007 8:22:49 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine16-01-2007-19-30-09.asr, Removed from Quarantined, 1/17/2007 8:22:53 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine16-01-2007-19-13-58.asr, Removed from Quarantined, 1/17/2007 8:22:57 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/17/2007 8:24:49 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/17/2007 8:24:49 PM" "software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.com, Found , 1/17/2007 8:24:50 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.com, Found , 1/17/2007 8:25:03 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.com, Found , 1/17/2007 8:25:03 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.com, Found , 1/17/2007 8:25:03 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.com, Found , 1/17/2007 8:25:03 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.net, Found , 1/17/2007 8:25:03 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.com, Found , 1/17/2007 8:25:03 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/17/2007 8:33:22 PM" "software\microsoft\windows\currentversion\internet settings\zonemap\domains\xxxtoolbar.co, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\blazefind.co, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\searchmiracle.co, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\slotch.co, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ysbweb.co, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\clickspring.ne, Remove, 1/17/2007 8:33:22 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\mt-download.co, Remove, 1/17/2007 8:33:22 PM" "software\vb and vba program settings, Found , 1/17/2007 8:34:44 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/17/2007 8:34:45 PM" "software\vb and vba program setting, Remove, 1/17/2007 8:35:10 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/17/2007 8:35:10 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/18/2007 8:51:28 PM" "software\vb and vba program settings, Found , 1/18/2007 8:51:28 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/18/2007 8:51:32 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/18/2007 8:51:32 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine17-01-2007-20-35-10.asr, Removed from Quarantined, 1/18/2007 9:05:24 PM" "C:\Program Files\AdsGone\Quarantine\Quarantine17-01-2007-20-33-22.asr, Removed from Quarantined, 1/18/2007 9:05:30 PM" "software\microsoft\internet explorer\urlsearchhooks, Found , 1/18/2007 9:13:32 PM" "software\vb and vba program settings, Found , 1/18/2007 9:13:33 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/18/2007 9:13:35 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/18/2007 9:13:35 PM" "software\microsoft\internet explorer\urlsearchhook, Remove, 1/18/2007 9:20:17 PM" "software\vb and vba program setting, Remove, 1/18/2007 9:20:17 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/18/2007 9:20:17 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/18/2007 9:20:17 PM" Thanks again for all of your help. Chuck

The items in the Domain is what the 015's are.

Lets see if this will cleanup the registry issues.

Backup Your Registry with ERUNT

• Please use the following link and scroll down to ERUNT and download it.
  http://aumha.org/freeware/freeware.php
• For version with the Installer:
  Use the setup program to install ERUNT on your computer
• For the zipped version:
  Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

Note: to restore your registry, go to the folder and start ERDNT.exe



I recommend you download RegSeeker. Extract it to it's own folder, open and double click RegSeeker.exe to start the program. Maximize the window and click clean registry. Check all sections and click OK. When the scan is complete, verify the backup box in lower left corner is checked and click the select all button, then select all again. Then right click within the search results and select delete. Run it again and again, deleting everything it finds until it finds nothing. Reboot and make sure your programs are working properly, control panel and add/remove programs windows open, etc (basically just do a quick check of everything). In the event anything was 'broken', you can open RegSeeker, click backups and double click any/all files to put the information back. A reboot may be required for the effects to be seen. Reboot When done.

NOTE: To be extra safe you can choose to only remove the items in RED.
Some items may come back because of the programs you have running.

I get 8 files that keep showing up

Don't worry about those.

Launch Notepad, and copy/paste all the bold REGEDIT below to it
Don't forget the REGEDIT4
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
@=""
"http"=dword:00000003
"https"=dword:00000003
"ftp"=dword:00000003
"file"=dword:00000003
"@ivt"=dword:00000001
"shell"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
@=""
"http"=dword:00000003
"https"=dword:00000003
"ftp"=dword:00000003
"file"=dword:00000003
"@ivt"=dword:00000001
"shell"=dword:00000000

Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.

Lets see if that took care of it.

Not sure if I plan to shoot myself or the computer. Ran the file and it ran OK. Rebooted the computer just for grins. Ran the AdsGone scan and guess what. There they were same as always. Here is the log "software\microsoft\internet explorer\urlsearchhooks, Found , 1/19/2007 4:47:35 PM" "software\vb and vba program settings, Found , 1/19/2007 4:47:35 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/19/2007 4:47:38 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Settings, Found , 1/19/2007 4:47:38 PM" "software\microsoft\internet explorer\urlsearchhook, Remove, 1/19/2007 4:48:09 PM" "software\vb and vba program setting, Remove, 1/19/2007 4:48:09 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/19/2007 4:48:10 PM" "Software\Microsoft\Windows\CurrentVersion\Internet Setting, Remove, 1/19/2007 4:48:10 PM" The top two are 180Solutions and the second two are 2ndThought.