ugh!! plz help (RESOLVED)

  1. 12-02-2007  #1
    devanb3
    devanb3 is offline Valued Member

    ugh!! plz help (RESOLVED)

    for the last few weeks when i go online to access the internet all of a sudden my internet explorer will open randomly im curently using windows xp and firefox although i am using firefox it will still open in explorer my antivirus is up to date and is ran weekly but still no fix i have ran adaware se and deleted spyware but no fix what should i do????????


    HJT:

    Logfile of HijackThis v1.99.1
    Scan saved at 7:51:32 PM, on 2/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.5730.0011)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\AIM6\aolsoftware.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com//0seenus/saos01
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com//0seenus/saos01
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
    O3 - Toolbar: Foxie - {09C02180-3B46-4CD8-83FF-34DAF442BDEF} - C:\Program Files\Foxie Suite\foxiecoreu.dll
    O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: (no name) - {013C7E21-DFFA-11D9-AED6-004033A00168} - (no file)
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Desktop Search - {306BBB66-D9E4-4481-833E-C1D5FCA06774} - C:\Program Files\Foxie Suite\Resources\HTML\Desktop.htm
    O9 - Extra 'Tools' menuitem: Desktop Search - {306BBB66-D9E4-4481-833E-C1D5FCA06774} - C:\Program Files\Foxie Suite\Resources\HTML\Desktop.htm
    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: Privacy Cleaner - {546E08AA-809F-4F1A-BE1A-6B122EBFCD5A} - C:\Program Files\Foxie Suite\Cleaner.exe
    O9 - Extra 'Tools' menuitem: Privacy Cleaner - {546E08AA-809F-4F1A-BE1A-6B122EBFCD5A} - C:\Program Files\Foxie Suite\Cleaner.exe
    O9 - Extra button: Swift Sweeper - {61039B22-563D-4922-B844-B076C318A66A} - C:\Program Files\Foxie Suite\Sweeper.exe
    O9 - Extra 'Tools' menuitem: Swift Sweeper - {61039B22-563D-4922-B844-B076C318A66A} - C:\Program Files\Foxie Suite\Sweeper.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: The Infinity Button - {E4143585-2688-4EBC-B264-27C774F600D5} - C:\Program Files\Foxie Suite\Resources\HTML\Infinity.htm
    O9 - Extra 'Tools' menuitem: The Infinity Button - {E4143585-2688-4EBC-B264-27C774F600D5} - C:\Program Files\Foxie Suite\Resources\HTML\Infinity.htm
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/insta...SSWebAgent.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_2.1.1.74.cab
    O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edge...oadManager.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125194918140
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1139960576718
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
    O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
    O23 - Service: PurgPro XP Service (PurgProService) - Unknown owner - C:\Program Files\PurgeIE\PurgPro_Service.exe (file missing)
    O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    Last edited by devanb3; 13-02-2007 at 01:58 AM. Reason: added HJT

  3. 14-02-2007  #2
    devanb3
    devanb3 is offline Valued Member
    anyone? im stilll waitin
  4. 15-02-2007  #3
    devanb3
    devanb3 is offline Valued Member
    ...3 days later...
  5. 17-02-2007  #4
    VopThis
    VopThis is offline Senior Member (Canada)
    Rename HijackThis.exe to 'foolyou.exe' and run it under that name when a HJT log is next requested.



    We will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Accordingly, it is probably a good idea to print out the following directions or copy them to a text file on your desktop using NOTEPAD. Read these instructions carefully and feel free to ask if you're unsure about anything.




    Download and install AVG Anti-Spyware 7.5 (AVG AS - formally known as Ewido anti-spyware 4.0 - uninstall any previous version first).
    • Click the Download BUTTON. On the next page click the Download now BUTTON.
    • Save and then install (Run) from the save location.
    • Open/Run AVG Anti-Spyware
    • Wait a few moments and AVG Anti-Spyware should Auto update itself (note date of last update). If it doesn't update, click the update ICON at top of screen:

    • Click on the Update now LINK at the top of the window
      • Click on the Start update button
      • Wait for the update to download and install
  6. This is very important to get the LATEST updates.
  7. Click on the Status ICON
    • Under "Your computers Security"
      Click change status on Resident shield to inactive (ONLY consider activation of that feature once you are clean)
  8. Click on the Scanner ICON at the top of the window
  9. Click on the Settings tab then select Recommended Actions and choose Quarantine
  10. When updating has finished. Close AVG Anti-Spyware.



    11. We will be using this tool in a later step.




    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    ______________________________


    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware , and run a full scan:
    • Click on the default Status ICON and select the Scan now LINK.

      OR

    • Click on the Scanner ICON . Select the Scan TAB.

      • Select Complete System Scan. AVG Anti-Spyware will now begin to scan your system.

    • If AVG Anti-Spyware finds anything it will list them in the Preview WINDOW:
      • Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
      • Select Apply all actions at the bottom of the window (and the items found will be quarantined – and recoverable, if any items are needed back).

    • When the scan has completed, click on the Save Scan Report button and save the scan to your Desktop where it can be easily found.
    • Copy and paste the AVG Anti-Spyware scan results into your next post.
    • Close AVG Anti-Spyware.


    REBOOT and Post your latest HijackThis log. And, let us know how your PC is now behaving – any changes in behavior.
  • 18-02-2007  #5
    devanb3
    devanb3 is offline Valued Member
    my internet explorer is still acting up and opening randomly

    Logfile of HijackThis v1.99.1
    Scan saved at 8:00:20 PM, on 2/17/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com//0seenus/saos01
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com//0seenus/saos01
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
    O3 - Toolbar: Foxie - {09C02180-3B46-4CD8-83FF-34DAF442BDEF} - C:\Program Files\Foxie Suite\foxiecoreu.dll
    O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: (no name) - {013C7E21-DFFA-11D9-AED6-004033A00168} - (no file)
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Desktop Search - {306BBB66-D9E4-4481-833E-C1D5FCA06774} - C:\Program Files\Foxie Suite\Resources\HTML\Desktop.htm
    O9 - Extra 'Tools' menuitem: Desktop Search - {306BBB66-D9E4-4481-833E-C1D5FCA06774} - C:\Program Files\Foxie Suite\Resources\HTML\Desktop.htm
    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: Privacy Cleaner - {546E08AA-809F-4F1A-BE1A-6B122EBFCD5A} - C:\Program Files\Foxie Suite\Cleaner.exe
    O9 - Extra 'Tools' menuitem: Privacy Cleaner - {546E08AA-809F-4F1A-BE1A-6B122EBFCD5A} - C:\Program Files\Foxie Suite\Cleaner.exe
    O9 - Extra button: Swift Sweeper - {61039B22-563D-4922-B844-B076C318A66A} - C:\Program Files\Foxie Suite\Sweeper.exe
    O9 - Extra 'Tools' menuitem: Swift Sweeper - {61039B22-563D-4922-B844-B076C318A66A} - C:\Program Files\Foxie Suite\Sweeper.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: The Infinity Button - {E4143585-2688-4EBC-B264-27C774F600D5} - C:\Program Files\Foxie Suite\Resources\HTML\Infinity.htm
    O9 - Extra 'Tools' menuitem: The Infinity Button - {E4143585-2688-4EBC-B264-27C774F600D5} - C:\Program Files\Foxie Suite\Resources\HTML\Infinity.htm
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/insta...SSWebAgent.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_2.1.1.74.cab
    O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edge...oadManager.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125194918140
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1139960576718
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
    O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
    O23 - Service: PurgPro XP Service (PurgProService) - Unknown owner - C:\Program Files\PurgeIE\PurgPro_Service.exe (file missing)
    O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    heres the avg anti-spyware scan results

    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 7:38:22 PM 2/17/2007

    + Scan result:



    HKLM\SOFTWARE\BufferZone\Virtual\Untrusted\SOFTWAR E\Classes\CLSID\{364B6276-C6C1-40B6-A6D7-6C48871FD707} -> Adware.Accoona : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\BufferZone\Virtual\Untrusted\SOFTWAR E\Classes\CLSID\{944864A5-3916-46E2-96A9-A2E84F3F1208} -> Adware.Accoona : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\1 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\2 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\3 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\4 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\5 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\6 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKLM\SOFTWARE\FoxIE\Update\Components\7 -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Cleaner -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Groups -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Groups\Blogs Example -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Groups\News Example -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Groups\Sports Example -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Groups\Web Mail Example -> Adware.Kazaap : Cleaned with backup (quarantined).
    HKU\S-1-5-21-3666186597-4113636562-2537564288-1006\Software\FoxIE\Swift Sweeper -> Adware.Kazaap : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1309\A0146939.exe -> Adware.Maxifiles : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1309\A0146957.dll -> Adware.Maxifiles : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\{E000E1C3-09E5-1033-0512-040312040001}\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\{E000E1C3-09E5-1033-0512-040312040001}\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc1\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc1\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc2\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc3\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc3\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc4\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc5\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc5\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc6\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc6\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc7\Update.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\RECYCLER\S-1-5-18\Dc7\system.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1309\A0146955.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1312\A0147126.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1312\A0147173.dll -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1312\A0147174.exe -> Adware.Softomate : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1344\A0155745.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\gebbcyx.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{879E598B-020E-408B-AC9B-13ABBD7D02C3}\RP1322\A0148140.exe -> Adware.WebHancer : Cleaned with backup (quarantined).
    :mozilla.138:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.139:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.2o7 : Cleaned.
    :mozilla.50:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.51:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.52:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.53:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.57:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Advertising : Cleaned.
    :mozilla.26:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
    :mozilla.107:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Bfast : Cleaned.
    :mozilla.140:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
    C:\Documents and Settings\DEVAN BOGAN\Cookies\devan_bogan@bluestreak[2].txt -> TrackingCookie.Bluestreak : Cleaned.
    :mozilla.144:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.145:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.146:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
    :mozilla.92:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.93:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.94:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
    :mozilla.80:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Com : Cleaned.
    C:\Documents and Settings\DEVAN BOGAN\Cookies\devan_bogan@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
    :mozilla.54:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
    :mozilla.71:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.72:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.73:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
    :mozilla.18:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
    :mozilla.127:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.128:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.129:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.130:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
    :mozilla.118:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Realmedia : Cleaned.
    C:\Documents and Settings\DEVAN BOGAN\Cookies\devan_bogan@realmedia[1].txt -> TrackingCookie.Realmedia : Cleaned.
    :mozilla.14:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.15:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.16:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    :mozilla.17:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
    C:\Documents and Settings\DEVAN BOGAN\Cookies\devan_bogan@adopt.specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned.
    :mozilla.119:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.120:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.121:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.122:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.123:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.124:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.125:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.126:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.
    :mozilla.29:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
    :mozilla.32:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.33:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.34:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.35:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    :mozilla.36:C:\Documents and Settings\DEVAN BOGAN\Application Data\Mozilla\Firefox\Profiles\jmzzrcg2.Default User\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
    C:\WINDOWS\system32\winekj32.dll -> Trojan.Agent.qt : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned with backup (quarantined).
    C:\WINDOWS\system32\wtssvsu.exe -> Trojan.Small : Cleaned with backup (quarantined).


    ::Report end
  • 18-02-2007  #6
    devanb3
    devanb3 is offline Valued Member
    am i supposed to fix the problems on the hijackthis
  • 18-02-2007  #7
    VopThis
    VopThis is offline Senior Member (Canada)
    http://castlecops.com/modules.php?na...ery=Boonty.exe

    SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:

    R3 - Default URLSearchHook is missing

    O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe (file missing)

    Make sure that all browser windows and internet links are closed, even this one!
    CLICK ’FIX CHECKED’ with HijackThis.



    Clean out TEMPORARY FILES procedures:
    To clean your temp folder, recycle bin, etc..please download this free tool:

    CCleaner http://www.ccleaner.com/downloadbuilds.asp

    Install Options:
    • Don't install any Toolbars, or other programs, should it ask you!
    • Just uncheck the option of installing the Yahoo toolbar.

    It will put a shortcut on your Desktop.

    Do not run CCleaner until requested later.




    Run CCleaner in SAFE MODE (reboot tapping the F8 key after the beep).

    Select the ‘Options’ BUTTON option (top LEFT), ‘Advanced’ BUTTON, and then UNCHECK the ‘Only delete files in Windows Temp Folders older than 48 hours’.

    Select the ‘Cleaner’ BUTTON option (top LEFT), if not already selected. Use the ’Windows’ TAB up front by default.
    • Uncheck ‘Cookies’ option (advisable)
    • Optionally, Uncheck ‘Recently Typed URLs’ option (potentially still useful)
    • Click the ‘Analyse’ button.
    • Thereafter, click ‘Run Cleaner’ after you have reviewed what it proposes to clean.


    REBOOT, post a revised HJT LOG, and let us know how things are now behaving.
  • 18-02-2007  #8
    devanb3
    devanb3 is offline Valued Member
    Logfile of HijackThis v1.99.1
    Scan saved at 11:41:45 AM, on 2/18/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16414)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com//0seenus/saos01
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com//0seenus/saos01
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
    O3 - Toolbar: Foxie - {09C02180-3B46-4CD8-83FF-34DAF442BDEF} - C:\Program Files\Foxie Suite\foxiecoreu.dll
    O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
    O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
    O3 - Toolbar: (no name) - {013C7E21-DFFA-11D9-AED6-004033A00168} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
    O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
    O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: Desktop Search - {306BBB66-D9E4-4481-833E-C1D5FCA06774} - C:\Program Files\Foxie Suite\Resources\HTML\Desktop.htm
    O9 - Extra 'Tools' menuitem: Desktop Search - {306BBB66-D9E4-4481-833E-C1D5FCA06774} - C:\Program Files\Foxie Suite\Resources\HTML\Desktop.htm
    O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\WINDOWS\system32\shdocvw.dll
    O9 - Extra button: Privacy Cleaner - {546E08AA-809F-4F1A-BE1A-6B122EBFCD5A} - C:\Program Files\Foxie Suite\Cleaner.exe
    O9 - Extra 'Tools' menuitem: Privacy Cleaner - {546E08AA-809F-4F1A-BE1A-6B122EBFCD5A} - C:\Program Files\Foxie Suite\Cleaner.exe
    O9 - Extra button: Swift Sweeper - {61039B22-563D-4922-B844-B076C318A66A} - C:\Program Files\Foxie Suite\Sweeper.exe
    O9 - Extra 'Tools' menuitem: Swift Sweeper - {61039B22-563D-4922-B844-B076C318A66A} - C:\Program Files\Foxie Suite\Sweeper.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: The Infinity Button - {E4143585-2688-4EBC-B264-27C774F600D5} - C:\Program Files\Foxie Suite\Resources\HTML\Infinity.htm
    O9 - Extra 'Tools' menuitem: The Infinity Button - {E4143585-2688-4EBC-B264-27C774F600D5} - C:\Program Files\Foxie Suite\Resources\HTML\Infinity.htm
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
    O16 - DPF: {13EC55CF-D993-475B-9ACA-F4A384957956} (Controller Class) - https://www.windowsonecare.com/insta...SSWebAgent.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/ca...C_2.1.1.74.cab
    O16 - DPF: {3EB4F9EA-51A6-48DA-846A-0D69DCBA39EF} (DownloadManager Control) - http://download.akamaitools.com.edge...oadManager.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1125194918140
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1139960576718
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Autodesk Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - Unknown owner - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe (file missing)
    O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE (file missing)
    O23 - Service: PurgPro XP Service (PurgProService) - Unknown owner - C:\Program Files\PurgeIE\PurgPro_Service.exe (file missing)
    O23 - Service: VET Message Service (VETMSGNT) - Unknown owner - C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
  • 18-02-2007  #9
    devanb3
    devanb3 is offline Valued Member
    my internet explorer still opens randomly
  • 18-02-2007  #10
    VopThis
    VopThis is offline Senior Member (Canada)
    Save 20% on AVG Internet Security 2012 Suite!
    How is your PC now behaving? Are you still experiencing 'popup' behaviors?
    • + Reply to Thread
    Page 1 of 3 1 2 3 LastLast
    « A weird startup item | Can't hit AV webpages (RESOLVED) »