Dear experts,


Pl solve my browser hijacking problem.
/%20 is being prefixed to the url in the address bar.
I am posting the log file.

thanks

vgc


------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 3:30:59 PM, on 02-Aug-05
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
E:\MBA Project\AVGNT.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Program Files\QuickTime\qttask.exe
D:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\taskswitch.exe
C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe
D:\Program Files\Lotus\Sametime Client\connect.exe
C:\Program Files\MsgPopupEN\MsgPopup.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe
E:\MBA Project\AVGUARD.EXE
E:\MBA Project\AVWUPSRV.EXE
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
D:\PROGRA~1\MICROS~2\MSSQL$~1\binn\sqlservr.exe
C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlservr.exe
C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\PROGRA~1\MI6841~1\MSSQL\binn\sqlagent.exe
D:\Program Files\Pluck Corporation\Pluck\PluckSvr.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\isqlw.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\notepad2\Notepad2.exe
C:\Program Files\notepad2\Notepad2.exe
C:\WINDOWS\System32\dllhost.exe
d:\Program Files\IrfanView\I_VIEW32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\Software2\vgc\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cbs/news/sel00.asp?p=&c=All&t=HeadLines&s=Search&cp=1
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = www1.vizagsteel.com:3128
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = cbs;www.vspsite.org;csm;vgc;<local>
R3 - Default URLSearchHook is missing
O1 - Hosts: 128.128.1.177 cbs
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Pluck Toolbar - {7385D9F8-418B-4e6a-938F-F7596857CB54} - D:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
O4 - HKLM\..\Run: [AVGCtrl] "E:\MBA Project\AVGNT.EXE" /min
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Picasa Media Detector] d:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe
O4 - HKCU\..\Run: [Copernic Desktop Search] "C:\Program Files\Copernic Desktop Search\CopernicDesktopSearch.exe" /tray
O4 - HKCU\..\Run: [Sametime Connect] "d:\Program Files\Lotus\Sametime Client\connect.exe"
O4 - HKCU\..\Run: [PluckSvr] D:\Program Files\Pluck Corporation\Pluck\pluckupdater.exe /startplucksvr
O4 - HKCU\..\Run: [ChikkaIM] D:\PROGRA~1\Chikka\Chikka.exe
O4 - Startup: ScreenHunter.lnk = C:\Program Files\Wisdom-soft ScreenHunter\ScreenHunter.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Access\Office10\OSA.EXE
O4 - Global Startup: MsgPopup.lnk = C:\Program Files\MsgPopupEN\MsgPopup.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: MK> Toggle Link Highlights - C:\Program Files\IE Context Menu Toolset\highlight_links.html
O8 - Extra context menu item: MK> ZOOM --> in <-- - C:\Program Files\IE Context Menu Toolset\zoom.html
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Grab &Image - C:\Program Files\Cogitum\Image Co-Tracker\grab.htm
O8 - Extra context menu item: Grab &Selected Text... - res://C:\Program Files\Cogitum Co-Citer\CogitumHelpers.dll/ctGrab.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Pluck - {053017A8-53F7-4EA3-AA38-A4CCAAF1F9E7} - D:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
O9 - Extra 'Tools' menuitem: Pluck - {053017A8-53F7-4EA3-AA38-A4CCAAF1F9E7} - D:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
O9 - Extra button: Pluck this page - {1FA9B650-D1BC-4E43-96B3-13A32FC39732} - D:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
O9 - Extra 'Tools' menuitem: Pluck this page - {1FA9B650-D1BC-4E43-96B3-13A32FC39732} - D:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
O9 - Extra button: Image Co-Tracker - {7F17B2B0-A7EA-11d3-AA97-00C0F048995B} - C:\Program Files\Cogitum\Image Co-Tracker\app.hta
O9 - Extra 'Tools' menuitem: &Image Co-Tracker - {7F17B2B0-A7EA-11d3-AA97-00C0F048995B} - C:\Program Files\Cogitum\Image Co-Tracker\app.hta
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Co-Citer - {CDE56277-42BE-11d4-B79C-00C0F04903DC} - C:\Program Files\Cogitum Co-Citer\Co-Citer.exe
O9 - Extra 'Tools' menuitem: Cogitum &Co-Citer - {CDE56277-42BE-11d4-B79C-00C0F04903DC} - C:\Program Files\Cogitum Co-Citer\Co-Citer.exe
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O18 - Protocol: pluck - {A5DD5FEC-8239-4A12-B791-4B6067F85CCC} - D:\Program Files\Pluck Corporation\Pluck\PluckExplorerBar.dll
O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - E:\MBA Project\AVGUARD.EXE
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - E:\MBA Project\AVWUPSRV.EXE
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm1 2.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

-------------------------------------------------------

Hello,jayaramvgc & Welcome

We ask that you please have a look at these 2 links here first

http://www.d-a-l.com/help/showthread.php?t=15083

http://www.d-a-l.com/help/showthread.php?t=605

then once that is done we here will be more then happy to
help with your HijackThis logfile.

HGD

I have visited these two links but to no avail. May pl see what is wrong.

thanks
jayaram

Hi,jayaramvgc

Ok please run this online scan give me feedback on what
if anything could not be removed.

then show me a new logfile

HGD