[Resolved] Virus Removal

PicassoOwner Topic Starter

Post #1November 13, 2007, 7:28 PM UTC

Hi

My name is PicassoOwner and I am new to this site. I had a similar problem to one of the other users in that I was being greeted by several popups saying 'Windows has detected an Internet attack attempt, Security Warning Worm.Win32Netsky, etc'. My browser kept going to My Privacy Guard. I ran RVAXO.exe, SuperAntispyware Home Edition and Wsxfix and followed all relevant instructions which seem to have cleared the problem but my computer is still running slower than before. I would welcome any advice you can give. I have posted the RVAXO results log, my SuperAnti Spyware scan log and my most recent Highjack This log for your consideration and advice.

Thanks
PicassoOwner

—————RVAXO.exe first run————-

Files found:

C:\WINDOWS\hostctrl.dll
C:\WINDOWS\hstsys.dll
C:\WINDOWS\rs.txt
C:\WINDOWS\nmcuninstall.exe
C:\WINDOWS\search_res.txt
C:\Documents and Settings\Martin\Desktop\Error Cleaner.url
C:\Documents and Settings\Martin\Desktop\Spyware&Malware Protection.url
C:\Documents and Settings\Martin\Desktop\Nokia 6230i Software\Spyware&Malware Protection.url
C:\Documents and Settings\Martin\Desktop\Privacy Protector.url
C:\Docume~1\AllUse~1\Desktop\Online Security Guide.url
C:\Docume~1\AllUse~1\Desktop\Security Troubleshooting.url
C:\Documents and Settings\All Users\STARTM~1\Online Security Guide.url
C:\Documents and Settings\All Users\STARTM~1\Security Troubleshooting.url
C:\Documents and Settings\Martin\FAVORI~1\Online Security Test.url
C:\Documents and Settings\Martin\FAVORI~1\Error Cleaner.url
C:\Documents and Settings\Martin\FAVORI~1\Privacy Protector.url
C:\Documents and Settings\Martin\FAVORI~1\Spyware&Malware Protection.url

Uninstallers Rogue scanners:

Folders Found:

C:\WINDOWS\privacy_danger

Hosts-file was reset, If you use a custom hosts file please replace it…

————–RVAXO.exe last run—————

Files found:

Folders Found:

————–RVAXO.exe finished—————-

Hijack This Log

Logfile of HijackThis v1.99.1
Scan saved at 20:13:53, on 09/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Smtray.exe
C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
C:\Program Files\btbb_wcm\McciTrayApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\COMPAQ\CPQINET\CPQInet.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\BT Home Hub\Help\bin\mpbtn.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\progra~1\mcafee.com\vso\mcvsftsn.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Documents and Settings\Martin\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [Smapp] Smtray.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus C44 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C44 Series" /O6 "USB002" /M "Stylus C44"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PPWebCap] C:\PROGRA~1\ScanSoft\PAPERP~1\PPWebCap.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
O4 - HKCU\..\Run: [eyeBeam SIP Client] "C:\Program Files\BT Broadband Talk Softphone\BTSoftphone.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Home Hub\Help\bin\matcli.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.wanadoo.co.uk/
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.com/molbin/shared/mcinsc…84/mcinsctl.cab
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://bin.mcafee.com/molbin/shared/mcgdmg…,21/mcgdmgr.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/09/2007 at 07:17 PM

Application Version : 3.9.1008

Core Rules Database Version : 3341
Trace Rules Database Version: 1342

Scan type : Complete Scan
Total Scan Time : 02:02:44

Memory items scanned : 435
Memory threats detected : 0
Registry items scanned : 4886
Registry threats detected : 7
File items scanned : 57685
File threats detected : 80

Adware.Tracking Cookie
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@tribalfusion[2].txt
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\martin@serving-sys[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\[removed][3].txt
C:\Documents and Settings\Martin\Cookies\martin@bizrate[1].txt
C:\Documents and Settings\Martin\Cookies\martin@gomyhit[3].txt
C:\Documents and Settings\Martin\Cookies\martin@indexstats[2].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\martin@brightcove.112.2o7[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][8].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\[removed][6].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@tacoda[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@keywordmax[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][7].txt
C:\Documents and Settings\Martin\Cookies\martin@pro-market[2].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\martin@realmedia[1].txt
C:\Documents and Settings\Martin\Cookies\[removed]-sys[2].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\martin@precisionclick[1].txt
C:\Documents and Settings\Martin\Cookies\martin@gomyhit[5].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@gomyhit[1].txt
C:\Documents and Settings\Martin\Cookies\martin@imrworldwide[2].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@112.2o7[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][3].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@qksrv[2].txt
C:\Documents and Settings\Martin\Cookies\martin@msnportal.112.2o7[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\martin@gomyhit[2].txt
C:\Documents and Settings\Martin\Cookies\martin@metacafe.122.2o7[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][4].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][9].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\[removed]-finity[1].txt
C:\Documents and Settings\Martin\Cookies\martin@aerlingus.122.2o7[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][10].txt
C:\Documents and Settings\Martin\Cookies\martin@questionmarket[2].txt
C:\Documents and Settings\Martin\Cookies\martin@indextools[2].txt
C:\Documents and Settings\Martin\Cookies\martin@sextoysex[1].txt
C:\Documents and Settings\Martin\Cookies\martin@trafficmp[2].txt
C:\Documents and Settings\Martin\Cookies\martin@overture[2].txt
C:\Documents and Settings\Martin\Cookies\martin@revsci[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Martin\Cookies\martin@atdmt[2].txt
C:\Documents and Settings\Martin\Cookies\martin@2o7[1].txt
C:\Documents and Settings\Martin\Cookies\[removed][1].txt
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\[removed]
C:\Documents and Settings\Martin\Cookies\[removed][2].txt
C:\Documents and Settings\Rosemary\Cookies\rosemary@advertising[1].txt
C:\Documents and Settings\Rosemary\Cookies\rosemary@atdmt[2].txt
C:\Documents and Settings\Rosemary\Cookies\rosemary@doubleclick[1].txt
C:\Documents and Settings\Rosemary\Cookies\rosemary@mediaplex[1].txt
C:\Documents and Settings\Rosemary\Cookies\[removed][1].txt
C:\WINDOWS\Temp\Cookies\martin@adinterax[1].txt
C:\WINDOWS\Temp\Cookies\martin@atdmt[2].txt
C:\WINDOWS\Temp\Cookies\martin@doubleclick[1].txt

Browser Hijacker.Internet Explorer Settings Hijack
HKU\S-1-5-21-166745521-1754454779-3683679437-1006\Software\Microsoft\Internet Explorer\Main#Start Page [ http://softwarereferral.com/jump.php?wmid=…6Ojg5&lid=2 ]

Trojan.Net-HST/NMC
HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#hostctrl [ {8740E83F-CC52-4E3A-9C69-92DDF48E1E4E} ]

Trojan.Smitfraud Variant-Gen/PQ
HKCR\optnet.StockBar
HKCR\optnet.StockBar\CLSID
HKCR\optnet.StockBar\CurVer
HKCR\optnet.ToolBar.1
HKCR\optnet.ToolBar.1\CLSID

MrCharlie

Post #2November 15, 2007, 2:29 AM UTC

Welcome to the forum.

Please move HJT into its own permanent folder so backups can be made and found.

Right click on a blank space on your desktop > choose New > Folder > name it HJT > now right click and hold on HiJackThis.exe > drag it into the new folder > release > choose move here.
Now HiJackThis.exe should be in a folder.

—————-

Close ALL programs down, leaving ONLY HijackThis running - Click Scan and…..
Place a check against the following items if found:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customi…fo/bt_side.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/customi…arch.yahoo.com/
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

Click on Fix Checked and exit HijackThis.

———————

Open up Internet Explorer , Tools, General Tab, reset your home page to what you want, now the Programs Tab, click Reset Web Settings
That will change everything back to the default settings.

—————–

Have you cleared out all temp files on the system:

1. Clean out temp files: ATF Cleaner
Download ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All (cookies optional)
Click the Empty Selected button.
If you use Firefox browser
Click Firefox at the top and choose: Select All (cookies optional)
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
Click Opera at the top and choose: Select All (cookies optional)
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.

———————

Also check the links below:
Slow computer:
http://users.telenet.be/bluepatchy/miekiem…owcomputer.html

Make sure your hard drive is in DMA mode
http://www.annoyances.org/exec/forum/winxp/1191368982

Speed up XP:
http://www.connectedinternet.co.uk/2005/12…-up-windows-xp/

Check you services guide:
http://www.theeldergeek.com/background_int…fer_service.htm

Good Luck……MrC

PicassoOwner

Post #3November 15, 2007, 8:50 PM UTC

Mr C Many thanks for this help. I have followed the steps and this appears to have speeded the system up. Thanks Again PicassoOwner

MrCharlie

Post #4November 17, 2007, 1:07 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

✨ Ask AI

Ask AI