CiD popup hijack(RESOLVED) CiD popup hijack(RESOLVED) Hi all,http://start.earthlink.net http://www.earthlink.net/partner/mor...on/search.html http://start.earthlink.net http://start.earthlink.net/AL/Search http://63.135.125.104 http://support.dell.com/systemprofiler/SysPro.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://www.ibm.com/ibm/accessibility...web/WebRDC.dll http://WWW.EARTHLINK.NET
Welcome,COMBOFIX Here is the ComboFix:http://www.gmer.net Logfile of HijackThis v1.99.1http://www.earthlink.net/partner/mor...on/search.html http://www.yahoo.com/ http://63.135.125.104 http://support.dell.com/systemprofiler/SysPro.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://www.ibm.com/ibm/accessibility...web/WebRDC.dll http://WWW.EARTHLINK.NET Please Download NoLop to your desktop from one of the links below...Link 1 Link 2 Link 3 First close any other programs you have running as this will require a reboot Double click NoLop.exe to run it Now click the button labelled "Search and Destroy <<your computer will now be scanned for infected files>> When scanning is finished you will be prompted to reboot only if infected, Click OK Now click the "REBOOT A Message should popup from NoLop. If not, double click the program again and it will finish Please Post the contents of C:\NoLop.log along with a fresh HijackThis log --If you receive an error, "mscomctl.ocx or one of its dependencies are not correctly registered," please download mscomctl.ocx OK, ran NoLoop. (The second two links on your list are dead BTW).http://www.earthlink.net/partner/mor...on/search.html http://63.135.125.104 http://support.dell.com/systemprofiler/SysPro.CAB http://go.microsoft.com/fwlink/?linkid=39204 http://www.ibm.com/ibm/accessibility...web/WebRDC.dll http://WWW.EARTHLINK.NET Here is the uninstall list:VB Runtime Run hijackthis and click on scan only button and put checks next to these: R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) > If you did not set this or an admin you can fix this too Nothing open but hijackthis and click on "fix checked" tapping your F8 key Navigate to these files or folders DELETE FILES: DELETE FOLDERS grey soft 1 beep Reboot normal mode Hey Neal, Your very welcome,If you are no longer having any more trouble here is some preventative measures for you. Be sure to re-hide hidden files/folders if you were asked to unhide them Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated. http://www.d-a-l.com/help/showthread.php?t=32403 Flush your restore points in ME and XP, by turning System Restore off and then back on. Explained Here: Windows XP: http://vil.nai.com/vil/SystemHelpDoc...ysRestore.aspx Explained Here Microsoft ME: http://service1.symantec.com/SUPPORT...rc=sec_doc_nam RegProtect This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry. http://www.diamondcs.com.au/index.php?page=regprot To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions: 1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser. http://v5.windowsupdate.microsoft.co....aspx?ln=en-us http://www.microsoft.com/windows/ie/default.asp 2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!. AVG: http://free.grisoft.com/doc/1 Avast: http://www.avast.com/eng/avast_4_home.html 3. In addtion to using Ad-aware consider using another free malware scanning/removal program: Windows Defender http://www.microsoft.com/athome/secu...e/default.mspx 4. Consider using a free firewall if you are not already using one. Some good free ones are: Kerio http://www.sunbelt-software.com/Kerio.cfm Zone Labs Personal Firewall: Zone Labs 5. Consider using an alternate free browser for general web surfing but you must use IE for windows update. Mozilla Firefox: www.mozilla.org/products/firefox/ 6. Consider increasing your browser security by using these programs: SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here: http://www.javacoolsoftware.com/spywareblaster.html If you use SpywareBlaster you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/ IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here: https://netfiles.uiuc.edu/ehowes/www/resource.htm Block access to Untrustworthy Sites You can prevent your computer from visiting a myriad of untrustworthy sites and ad-servers by installing a customised hosts file. One of the best available is the: MVPS Hosts File Simply follow the instructions to install the file in the correct location. This will not only make surfing safer but will improve website load times and block popups from many of the large ad-servers. *Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free
02 -------- d-----w C:\Program Files\Google