about:blank please someone help

Question

Hello there i know there are many help topics on this extremely irritating about:blank bull****. I've tried a few of them and realise the problem is individual to each user/pc, so i'd just like to start from the beginning and try and kill about:blank once and for all. Like many others i've used a multitude of spyware/adware scanners, and even tried using hijack this in reference to other peoples problems, but still no dice. So i'm running winxp, internet explorer 6.0, and am now using mozilla firefox as my default browser as internet explorer is inundated with trash, i was toying with the idea of formatting my 2 pcs and starting afresh, but then thought 'what if it comes back?' So, How do i make about:blank leave my systems and die a horrible cancerous death, and how do i stop it coming back? Any help would be greatly appreciated, thankyou very much. Joffa D

zbestwun2001 · Answer

Let's start this way:
Go to here and do an online scan and delete whatever it finds. Be sure to highlight the drives you want to have searched. You will have to use IE6 for the scan.
After that could you please go to here
and download AdAwareSE and delete what it finds. Then while using
AdAware, click on add-ons and get their plug-in for the VX2 variant,
and run that and delete what it finds.
After that go to here
and download SpyBot and run that and delete what it finds.
Now go to
here and download HiJackThis to its own folder that you create on your C:\ drive.
After it is downloaded open the program and click Scan and Save to log.

Post the log that it generates here.

Steve

Message Edited by zbestwun2001 on 02-06-2005 09:38 AM

Joffa_d · Answer

i appreciate your help in this matter, i've completed all the tests, that trend housecall is a real beatch. But yeh, various things were found in each of the scans and at the foot of this message is the hijackthis log, thanks for your time in this matter. Jof Logfile of HijackThis v1.99.0 Scan saved at 19:39:31, on 2/6/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\WINNT\System32\svchost.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINNT\System32mctrl.exe C:\WINNT\System32\qttask.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINNT\System32\bcmwltry.exe C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\WINNT\System32\wuauclt.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {1932A2C0-19A3-4CDE-8D7C-360725BBCFB5} - C:\WINNT\System32\plld.dll (file missing) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1	ools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [RemoteControl] C:\WINNT\System32mctrl.exe O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe O4 - HKLM\..\Run: [RemoveCpl] RemoveCpl.exe O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe' O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\RunOnce: [y38dei.exe] C:\WINNT\System32\y38dei.exe /k O4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /Q O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\RunOnce: [y38dei.exe] C:\WINNT\System32\y38dei.exe /k O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dll O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/09265c47d7fd5e03b306/netzip/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101658302233 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: Trend Micro Central Control Component - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe

zbestwun2001 · Answer

OK here we go:

Run HiJackThis then:

1. Click "Config..."
2. Click "Misc Tools"
3. Click "Open Process manager"

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following

C:\WINNT\System32\y38dei.exe /k

Now double-check and make sure that only those item(s) above are highlighted, then click " Kill process". Now, click " Refresh", check again, and repeat this step if any remain.

Now open HJT and scan and delete these entries:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINNT\about.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488
O2 - BHO: (no name) - {1932A2C0-19A3-4CDE-8D7C-360725BBCFB5} - C:\WINNT\System32\plld.dll (file missing)
O4 - HKLM\..\RunOnce: [y38dei.exe] C:\WINNT\System32\y38dei.exe /k
O4 - HKCU\..\RunOnce: [y38dei.exe] C:\WINNT\System32\y38dei.exe /k

Reboot, rescan and repost a new log.

Steve

FORMAT PROVIDED BY MIDNIGHT STAR*

Message Edited by zbestwun2001 on 02-06-2005 12:09 PM

Joffa_d · Answer

Alright brilliant pal, i really appreciate all this. Disk Cleanup freezes so i can'tuse this but its been like that for a while, i'll worry about that some other time, one final question is though, i'm currently using a laptop, and thats now been sorted, do i repeat the same exact process for my desktop PC? Again thanks for all this.
Jof.

zbestwun2001 · Answer

Hi
It looks fine to me now.

Now just do a basic disc cleanup and get rid of all the junk. Temp. internet files
Temp files, and all the other stuff it finds.

As far as preventing it, be very careful what you download, where you surf, and I
am giving you the link to some preventative programs.
My suggestion is to used SpyBlaster and SpyGuard all the time, also a good firewall
and virus protector. AVG is a very good one and it's free.

You just need to be careful, shareware is a big problem.

AVG-ANTVIRUS
SYGATE FIREWALL
ADAWARE-SE
SPYWAREBLASTER
HIJACKTHIS
CWSHREDDER.EXE
SPYWARE GUARD

Steve

Message Edited by zbestwun2001 on 02-06-2005 02:44 PM

Joffa_d · Answer

ok, it seems to have disappeared for now, log file is below is there anything else i need to do? And also how can i stop it coming back? Thanks, Jof. Logfile of HijackThis v1.99.0 Scan saved at 22:23:27, on 2/6/2005 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\System32\Ati2evxx.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\LEXBCES.EXE C:\WINNT\system32\spoolsv.exe C:\WINNT\system32\LEXPPS.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINNT\System32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe C:\WINNT\system32\Ati2evxx.exe C:\WINNT\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINNT\System32mctrl.exe C:\WINNT\System32\qttask.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\WINNT\System32\bcmwltry.exe C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\Spyware Doctor\swdoctor.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINNT\System32\wuauclt.exe C:\Program Files\Outlook Express\msimn.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\hijackthis\HijackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1	ools\iesdsg.dll O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [RemoteControl] C:\WINNT\System32mctrl.exe O4 - HKLM\..\Run: [QuickTime Task] C:\WINNT\System32\qttask.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [bcmwltry] bcmwltry.exe O4 - HKLM\..\Run: [RemoveCpl] RemoveCpl.exe O4 - HKLM\..\Run: [PE2CKFNT SE] C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe O4 - HKLM\..\Run: [pccguide.exe] 'C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe' O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - HKCU\..\Run: [Spyware Doctor] 'C:\Program Files\Spyware Doctor\swdoctor.exe' /Q O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1	ools\iesdpb.dll O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/09265c47d7fd5e03b306/netzip/RdxIE601.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101658302233 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://support.euro.dell.com/global/apps/systemprofiler/PROFILER.CAB O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab O23 - Service: Ati HotKey Poller - Unknown - C:\WINNT\System32\Ati2evxx.exe O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE O23 - Service: Trend Micro Central Control Component - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1	mproxy.exe

zbestwun2001 · Answer

As far as begining the diagnostic process, yes.

The same programs would be used, but I wouldn't advise you to make changes using the
HJT program until someone has viewed your log and advised you. Every computer is different.

If you have anymore questions feel free to ask.

Take care
Steve

p.s. here is a url for a better clean-up program than comes with Windows.

http://home.comcast.net/~sgould4567/software/cleanup/

Message Edited by zbestwun2001 on 02-06-2005 03:03 PM

gtb34 · Answer

I've been reading your post on the about:blank virus that you helped someone with and tried to do the things you stated. None has been able to help me with this and I was hoping you could spare a quick minute. The about ting has taken over my home page and I can't run norton or even  the trendmicro file scan because it prompts me with a microsoft shut down winpop box. I ran the other 2 you'd mentioned and have this report; Logfile of HijackThis v1.99.1Scan saved at 6:24:11 PM, on 2/21/2005Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Nhksrv.exeC:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\Norton AntiVirus
avapsvc.exeC:\WINDOWS\System32
vsvc32.exeC:\WINDOWS\wanmpsvc.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\WINDOWS\ipir.exeC:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeC:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeC:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeC:\WINDOWS\System32\hphmon03.exeC:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exeC:\Program Files\Common Files\Real\Update_OB\evntsvc.exeC:\PROGRA~1\NORTON~1
avapw32.exeC:\Program Files\QuickTime\qttask.exeC:\WINDOWS\System32\devldr32.exeC:\Program Files\Common Files\AOL\ACS\AOLDial.exeC:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exeC:\WINDOWS\apiah32.exeC:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exeC:\DOCUME~1\Amy\LOCALS~1\Temp\35.tmp.exeC:\WINDOWS\System32	ibs5.exeC:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exeC:\WINDOWS\System32\HPHipm09.exeC:\Program Files\America Online 9.0a\aoltray.exeC:\pilot\HOTSYNC.EXEC:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exeC:\Program Files\Nikon\NkView4\NkVwMon.exeC:\Program Files\Yahoo!\Messenger\ymsgr_tray.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Amy\Local Settings\Temp\Temporary Directory 3 for hijackthis[1].zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blankR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\xjrxa.dll/sp.html#37049R3 - Default URLSearchHook is missingO2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dllO2 - BHO: (no name) - {FD36CB53-F43E-C115-ED98-E1F307C77FD6} - C:\WINDOWS\ipir.dllO3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocxO3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dllO3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dllO4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exeO4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe'O4 - HKLM\..\Run: [MMTray] C:\Program Files\MusicMatch\MusicMatch Jukebox\mm_tray.exeO4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exeO4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\System32\hphmon03.exeO4 - HKLM\..\Run: [CXMon] 'C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe'O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exeO4 - HKLM\..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe -osbootO4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1
avapw32.exeO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe 'C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll',cdaEngineMainO4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exeO4 - HKLM\..\Run: [AOL Spyware Protection] 'C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe'O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exeO4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exeO4 - HKLM\..\Run: [Pure Networks Port Magic] 'C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe' -RunO4 - HKLM\..\Run: [apiah32.exe] C:\WINDOWS\apiah32.exeO4 - HKLM\..\Run: [35.tmp] C:\DOCUME~1\Amy\LOCALS~1\Temp\35.tmp.exe 3 10001O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\System32	ibs5.exeO4 - HKLM\..\Run: [35.tmp.exe] C:\DOCUME~1\Amy\LOCALS~1\Temp\35.tmp.exe 4 10001O4 - HKLM\..\RunOnce: [ipir.exe] C:\WINDOWS\ipir.exeO4 - HKCU\..\Run: [MoneyAgent] 'C:\Program Files\Microsoft Money\System\Money Express.exe'O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quietO4 - HKCU\..\Run: [PopUpStopperFreeEdition] 'C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe'O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exeO4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0a\aoltray.exeO4 - Global Startup: Camio Viewer 2000.lnk = C:\Program Files\Sierra Imaging\Image Expert 2000\IXApplet.exeO4 - Global Startup: HotSync Manager.lnk = C:\pilot\HOTSYNC.EXEO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?O4 - Global Startup: NkVwMon.exe.lnk = C:\Program Files\Nikon\NkView4\NkVwMon.exeO8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTMLO9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dllO9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes12031.dllO9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dllO9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\WINDOWS\System32\shdocvw.dllO9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exeO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dllO9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dllO9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)O15 - Trusted Zone: *.05p.comO15 - Trusted Zone: *.awmdabest.comO15 - Trusted Zone: *.blazefind.comO15 - Trusted Zone: *.clickspring.netO15 - Trusted Zone: *.flingstone.comO15 - Trusted Zone: *.frame.crazywinnings.comO15 - Trusted Zone: *.mt-download.comO15 - Trusted Zone: *.my-internet.infoO15 - Trusted Zone: *.scoobidoo.comO15 - Trusted Zone: *.searchbarcash.comO15 - Trusted Zone: *.searchmiracle.comO15 - Trusted Zone: *.slotch.comO15 - Trusted Zone: *.static.topconverting.comO15 - Trusted Zone: *.xxxtoolbar.comO15 - Trusted Zone: *.05p.com (HKLM)O15 - Trusted Zone: *.awmdabest.com (HKLM)O15 - Trusted Zone: *.blazefind.com (HKLM)O15 - Trusted Zone: *.clickspring.net (HKLM)O15 - Trusted Zone: *.flingstone.com (HKLM)O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)O15 - Trusted Zone: *.mt-download.com (HKLM)O15 - Trusted Zone: *.my-internet.info (HKLM)O15 - Trusted Zone: *.scoobidoo.com (HKLM)O15 - Trusted Zone: *.searchbarcash.com (HKLM)O15 - Trusted Zone: *.searchmiracle.com (HKLM)O15 - Trusted Zone: *.slotch.com (HKLM)O15 - Trusted Zone: *.static.topconverting.com (HKLM)O15 - Trusted Zone: *.xxxtoolbar.com (HKLM)O15 - Trusted IP range: 206.161.125.149O15 - Trusted IP range: 206.161.125.149 (HKLM)O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet ZoneO15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone (HKLM)O16 - DPF: Yahoo! NFL GameChannel StatTracker - http://aud9.sports.sc5.yahoo.com/java/y/nflgcst1010_x.cabO16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://www.photoparade.com/autoinstall/phpsetup.cabO16 - DPF: {11311111-1111-1111-1111-111111111157} - file://C:\Recycled\Q678340.exeO16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cabO16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/yinst/yinst_current.cabO16 - DPF: {5763F8E8-0DD7-4A0F-ADB0-9F64C8F2C349} (Pixami/Snapfish Upload UI Control) - http://www.snapfish.com/SnapfishUploader.cabO16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cabO16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cabO16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cabO23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exeO23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\aolserv.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXEO23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Roxio Inc. - C:\WINDOWS\System32\ImapiRox.exeO23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus
avapsvc.exeO23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exeO23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exeO23 - Service: Pml Driver - HP - C:\WINDOWS\System32\HPHipm09.exeO23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exeO23 - Service: Network Security Service (%AFå¤¶À¨) - Unknown owner - C:\WINDOWS\system32\winbz32.exe (file missing) i tried to check some of the 015 boxes, but they come back. Do you have any ideas for me. Again, sorry to bother you, but I am running out of options, thanks, ben

Joffa_d · Answer

heyamate ithik your best bet would be to open a NEW message thread and write the problems you are having, me personally, i had the problem and was able to fix it throughthe help of someone else, so i wouldn't be able to help you myself, and i think the odds of the person who helped me reading this thread are very slim. So i think your best bet would be to open a NEW message thread and writ your problem there, hope it works out for you.

Virus & Spyware

Was this post helpful?