[Resolved]Hijack This Log And Others

What happens if you try Safe Mode? Restart your computer in Safe Mode. Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen. Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter. This can take several miniutes to load.

ok im in safemode but what do you want me to test?

do you have a desktop?

yes i do have a desktop

Lets see if things are working in Safe Mode. Try the internet. click Start> Run> type in regedit <= Don't do anything, just let me know if it worked.

it worked

Open regedit and go to this key: Let me know if the red highlighted is there. if not. give me exactly what is listed with the "Shell"=
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
"Shell"="Explorer.exe"

what i have here is HEKEY_LOCAL_MACHINE\SOFTWARE\MICROSFT\WINDOWS\CURRENTVERSION\EXPLORER

what i have here is HEKEY_LOCAL_MACHINE\SOFTWARE\MICROSFT\WINDOWS\CURRENTVERSION\EXPLORER

Did you add the E is it HKEY_LOCAL_MACHINE\SOFTWARE\MICROSFT\WINDOWS\CURRENTVERSION\EXPLORER

So you don't have this key?

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

No i do not have this key [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

I need you to check this key: Is there anything after "Debugger"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
"Debugger"=-

all i have in the HKEY_LOCAL_MACHINE\SOFTWARE\MICROSFT\WINDOWS\CURRENTVERSION is just HKEY_LOCAL_MACHINE\SOFTWARE\MICROSFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS

That's a differnent area. Please look again. Windows NT

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
"Debugger"=-

The only windows i have is windows there us no nt

Launch Notepad (Start>All Programs>Accessories), and copy/paste all the Quoted REGEDIT below to it. Don't forget to include REGEDIT4.
Save in: Desktop
File Name: fixme.reg
Save as Type: * files
Click: Save

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe]
"Debugger"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"

Save this as fix.reg Choose to save as *all files and place it on your desktop.
It should look like this: [external image: Posted Image]
Doubleclick on it and when it asks you if you want to merge the contents to the registry, click yes/ok.
(In case you are unsure how to create a reg file, take a look here with screenshots.)

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.