Cannot change home page

Question

I was have recently noticed that my home page has changed to a strange search engine and i cannot seem to get it to change back, I have tried changing the information in the Internet options as well as removing the annoying web page with Ad aware, Spy-Bot, CWShredder and Hijackthis. Unfortunately i have had no success. The only thing i haven't done is to dive into the registry, in which i am a bit leary about doing. Does anyone have any suggestions? Message Edited by whistler20 on 05-07-2004 11:02 PM

whistler20 · Answer

Here is the log. Logfile of HijackThis v1.97.7 Scan saved at 11:06:04 PM, on 5/7/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe C:\WINDOWS\system32\dla	fswctrl.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\Netscape\Netscape\Netscp.exe C:\Documents and Settings\Dave Murphy\My Documents\Temp Folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.html N3 - Netscape 7: user_pref('browser.startup.homepage', 'http://home.netscape.com/bookmark/7_1/home.html'); (C:\Documents and Settings\Dave Murphy\Application Data\Mozilla\Profiles\default\m4fcbyyw.slt\prefs.js) N3 - Netscape 7: user_pref('browser.search.defaultengine', 'engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src'); (C:\Documents and Settings\Dave Murphy\Application Data\Mozilla\Profiles\default\m4fcbyyw.slt\prefs.js) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [dla] 'C:\WINDOWS\system32\dla	fswctrl.exe' O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [DVDSentry] 'C:\WINDOWS\System32\DSentry.exe' O4 - HKLM\..\Run: [DwlClient] 'C:\Program Files\Common Files\Dell\EUSW\Support.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [P2P Networking] 'C:\WINDOWS\System32\P2P Networking\P2P Networking.exe ' /AUTOSTART O4 - HKLM\..\Run: [Lexmark X1100 Series] 'C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe' O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\winampa.exe' O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [McAfee Guardian] 'C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe ' /SU O4 - HKLM\..\Run: [MCAgentExe] 'c:\PROGRA~1\mcafee.com\agent\mcagent.exe' O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [MSKDetectorExe] 'C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe ' /startup O4 - HKLM\..\Run: [MPFTray] 'C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe' O4 - HKLM\..\Run: [NvCplDaemon] 'RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKLM\..\Run: [McRegWiz] C:\PROGRA~1\McAfee.com\Agent\McRegWiz.exe /autorun O4 - HKCU\..\Run: [Sonic RecordNow!] '' O4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: Privacy Bar (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab

Texruss · Answer

Post a HJT log and we'll tell you if it's one of the new varieties. Texruss

ChrisRLG · Answer

Check these in hijackthis, AND WITH ALL OTHER WINDOWS CLOSED, fix checked. R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.htmlR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.htmlThen Reboot and post a fresh log for me to check.

whistler20 · Answer

I selected the items that you have listed below and clicked Fix Checked then rebooted. Here is the log file that was pulled after the reboot. Still, the same files are listed. Logfile of HijackThis v1.97.7 Scan saved at 11:44:30 PM, on 5/8/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\LEXPPS.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\system32\dla	fswctrl.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\Program Files\Netscape\Netscape\Netscp.exe C:\Documents and Settings\Dave Murphy\My Documents\Temp Folder\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.html N3 - Netscape 7: user_pref('browser.startup.homepage', 'http://home.netscape.com/bookmark/7_1/home.html'); (C:\Documents and Settings\Dave Murphy\Application Data\Mozilla\Profiles\default\m4fcbyyw.slt\prefs.js) N3 - Netscape 7: user_pref('browser.search.defaultengine', 'engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src'); (C:\Documents and Settings\Dave Murphy\Application Data\Mozilla\Profiles\default\m4fcbyyw.slt\prefs.js) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [dla] 'C:\WINDOWS\system32\dla	fswctrl.exe' O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [DVDSentry] 'C:\WINDOWS\System32\DSentry.exe' O4 - HKLM\..\Run: [DwlClient] 'C:\Program Files\Common Files\Dell\EUSW\Support.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [P2P Networking] 'C:\WINDOWS\System32\P2P Networking\P2P Networking.exe ' /AUTOSTART O4 - HKLM\..\Run: [Lexmark X1100 Series] 'C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe' O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\winampa.exe' O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [McAfee Guardian] 'C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe ' /SU O4 - HKLM\..\Run: [MCAgentExe] 'c:\PROGRA~1\mcafee.com\agent\mcagent.exe' O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [MSKDetectorExe] 'C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe ' /startup O4 - HKLM\..\Run: [MPFTray] 'C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe' O4 - HKLM\..\Run: [NvCplDaemon] 'RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKCU\..\Run: [Sonic RecordNow!] '' O4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: Privacy Bar (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash2/cabs/swflash.cab

Texruss · Answer

Recheck them again and fix checked in Hijackthis (make sure your IE or Netscape browser is not open).

Then immediately run Windows Disk Cleaner (type cleanmgr at Start/Run) and delete all files in all categories at the end of the scan.

Next:

Download and run these two programs (Spybot S&D and Adaware). Use Spybot first.

Chris has posted an excellent tutorial by dgosling on how to run Spybot S&D and also how to enable customized deep scanning functions for Adaware. Once you set these options they will be retained for future scans by Adaware.

Follow the directions in this detailed guide for Spybot and Adaware...go slow on the directions for the custom setup of Adaware:

http://www.cjwd.demon.co.uk/spybot-adaware.html

After running the programs as detailed browse a bit and then run a fresh log and post here.

HTH,

Texruss

whistler20 · Answer

I have followed the instructions that you gave with precise detail and still no luck:( Here is the log file that you had requested after a bit of browsing. What else can i do? Logfile of HijackThis v1.97.7 Scan saved at 12:33:36 AM, on 5/14/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\McAfee\McAfee Privacy Service\GUARDDOG.EXE C:\WINDOWS\system32\dla	fswctrl.exe C:\WINDOWS\System32\DSentry.exe C:\Program Files\Common Files\Dell\EUSW\Support.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe c:\progra~1\mcafee.com\vso\mcvsescn.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe c:\PROGRA~1\mcafee.com\vso\mcshield.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Dave Murphy\My Documents\Temp Folder\HijackThis.exe C:\Program Files\Netscape\Netscape\Netscp.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mylegsfetish.com/index.html N3 - Netscape 7: user_pref('browser.startup.homepage', 'http://home.netscape.com/bookmark/7_1/home.html'); (C:\Documents and Settings\Dave Murphy\Application Data\Mozilla\Profiles\default\m4fcbyyw.slt\prefs.js) N3 - Netscape 7: user_pref('browser.search.defaultengine', 'engine://C%3A%5CPROGRA%7E1%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src'); (C:\Documents and Settings\Dave Murphy\Application Data\Mozilla\Profiles\default\m4fcbyyw.slt\prefs.js) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll O2 - BHO: McAfee Privacy Service - {cc4b2ee5-4803-11d7-8a38-00b0d0c6b814} - C:\Program Files\McAfee\McAfee Privacy Service\GDIEHELP.DLL O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [dla] 'C:\WINDOWS\system32\dla	fswctrl.exe' O4 - HKLM\..\Run: [StorageGuard] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [DVDSentry] 'C:\WINDOWS\System32\DSentry.exe' O4 - HKLM\..\Run: [DwlClient] 'C:\Program Files\Common Files\Dell\EUSW\Support.exe' O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [P2P Networking] 'C:\WINDOWS\System32\P2P Networking\P2P Networking.exe ' /AUTOSTART O4 - HKLM\..\Run: [Lexmark X1100 Series] 'C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe' O4 - HKLM\..\Run: [WinampAgent] 'C:\Program Files\Winamp\winampa.exe' O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VSOCheckTask] 'c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe' /checktask O4 - HKLM\..\Run: [McAfee Guardian] 'C:\Program Files\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe ' /SU O4 - HKLM\..\Run: [MCAgentExe] 'c:\PROGRA~1\mcafee.com\agent\mcagent.exe' O4 - HKLM\..\Run: [VirusScan Online] 'c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe' O4 - HKLM\..\Run: [MSKDetectorExe] 'C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe ' /startup O4 - HKLM\..\Run: [MPFTray] 'C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe' O4 - HKLM\..\Run: [NvCplDaemon] 'RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup' O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe' -osboot O4 - HKCU\..\Run: [Sonic RecordNow!] '' O4 - HKCU\..\Run: [MsnMsgr] 'C:\Program Files\MSN Messenger\MsnMsgr.Exe' /background O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O9 - Extra button: Privacy Bar (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM) P.S. Thank you for the assistance thus far.

Texruss · Answer

Must be a hidden file reactivating...we need another tool to look.

Canned message borrowed from Chris:

Download this zip.

http://www.downloads.subratam.org/pv.zip

Please unzip it to the desktop. It will not work if you run it from inside the zip.

After unzipped go to the desktop. Open the pv folder. Double click on the runme.bat

A DOS window will open. Please select option 1 for Explorer dll's by typing 1 and then pressing enter.

Notepad will open with a log in it. Please copy and paste the log into this post.

Texruss

ChrisRLG · Answer

A Tutorial on how to set up PV.zip is here http://forums.subratam.org/index.php?showtopic=549

Virus & Spyware

Was this post helpful?