Hijackthis Log

Baffling. OK, do it manually. You have been there before when you altered the value of the key. Using regedit, navigate to this key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar Highlight this value: D49E9D35-254C-4c6a-9D17-95018D228FF5 and delete it. Reboot and post a new HJT log.

Yes, that's clean. How is it running now?

It seems good now, I think I'm set, while i still can do you think theres a trojan program that can open page editor or other programs and open temp files? I ask because when I am on the net at random times Macromedia Dreamweaver 8 opens up into the temp folder. It may be nothing but i would just like to ask. Other than that the computer seems to run fine.

Not that I am aware of. We can do a a couple more final scans to make sure nothing is lurking.

Please download AVG Anti-Rootkit Beta from here and save it to your desktop.

Double click the file to install it. Accept the licence and follow the prompts to install and reboot. After rebooting, you should see the icon for AVG Anti-Rootkit Beta on your desktop. Double click it to open the program. You will see a window with 4 buttons at the bottom of it. Click Search For Rootkits and the program will start a scan, you will see the progress bar moving from left to right. When the scan is complete, a small window will open alerting you to the result. If anything was found, click Save Result To File and post that in your reply.

If nothing was found, please click the Perform in-depth Search saving anything found to file as before.

Click here to run ActiveScan.

• Once you are on the Panda site click the Scan your PC button
• A new window will open…click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Paste the contents of the Panda scan report

do you think theres a chance that the internet explorer i use is not internet explorer?i say this because in any window thats in IE the word "intranet" is there in place of internet, for example internet setting would be "intranet settings" local internet is "local intranet". I brought this up because I have my security settings on IE extremely high so scan my pc wont open and in the options menu I noticed the intranet thing. I use firefox as my default browser but panda doesn't support it, I will try to find a way to get the IE to click on the button. Okay i got it too work except the activeX part I enabled them in the options menu but they dont work

Alright I got past that activX problem by booting in safe mode and opening the site and from Panda active scan I got results: Incident Status Location Potentially unwanted tool:Application/VSToolbar Not disinfected C:\Documents and Settings\Administrator\Local Settings\Temp\dprkneti.exe Spyware:Spyware/New.net Not disinfected C:\Documents and Settings\Cody\My Documents\filelib\saiyancj2\Cdivx.exe[NNCLXA638.EXE] Potentially unwanted tool:Application/MyWay Not disinfected C:\Documents and Settings\Cody\My Documents\filelib\saiyancj2\Cdivx.exe[s4BarSp.exe] Adware:Adware/ClockSync Not disinfected C:\Documents and Settings\Cody\My Documents\filelib\saiyancj2\Cdivx.exe[VVSNInst.exe] Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@adultfriendfinder[2].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@apmebf[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@atwola[1].txt Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@bravenet[2].txt Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@ct.360i[2].txt Spyware:Cookie/Date Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@date[2].txt Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@did-it[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Naomi\Cookies\[removed][1].txt Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@domainsponsor[2].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@go[1].txt Spyware:Cookie/Kount Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@kount[1].txt Spyware:Cookie/DomainSponsor Not disinfected C:\Documents and Settings\Naomi\Cookies\[removed][1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Naomi\Cookies\[removed][2].txt Spyware:Cookie/Qsrch Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@qsrch[1].txt Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@seeq[2].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@target[2].txt Spyware:Cookie/Tickle Not disinfected C:\Documents and Settings\Naomi\Cookies\naomi@tickle[2].txt Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Naomi\Cookies\[removed][1].txt Spyware:Spyware/ClearSearch Not disinfected C:\Documents and Settings\Naomi\Local Settings\Temp\ClrSch\IEHook.EX_[C:\Documents and Settings\Naomi\Local Settings\Temp\ClrSch\IEHook.EXe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\fixwareout\FindT\nircmd.exe Spyware:Spyware/ClearSearch Not disinfected C:\WINDOWS\iClearSearch\98112975.exe Adware:adware/dollarrevenue Not disinfected C:\WINDOWS\keyboard1.dat The AVG rootkit found nothing however I ran it on normal boot, Panda online scan was ran while in safemode.

another thing I forgot to mention is I have Mirc (irc) and my spyware scanner picks it up as a maleware component, I checked to skip on every scan from then on but does having that pose any dangers?

Is your PC part of a network?

Click here to download System Security Suite. Extract it from the zip file into a folder and doubleclick on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. You will be prompted to reboot, do so. Repeat for all log-in accounts on your computer.

mIRC is OK provided you use it sensibly, i.e. don't accept file transfers from people you don't know etc.

Your log is clean. What garbage do you believe to be present? IESpyads is a good product and will help you stay clean.

various adware and spyware, one I remember removing was smitfraud and I think Cydoor, There were a total of about 7 adware/spyware infections on my system, although the log is clean, I can't think of where they might be coming from. I do get an incredibly anoying list of websites trying to add themselves to my Intternet Explorer safe site's which is causing the computer to slow down because I need to accept or deny each and every one lol theres 100's of sites I have added so far I hope im down soon.

Could you update both AVG antispyware and SuperAntispyware, scan with each and post what they find here?

I have removed the threats I told you about by quarantining most of them. I think I'm fine now.