Click on FIX CHECKED. Close HJT. Reboot. And see if WinFixer comes back or not.
[If WinFixer is still there... i.e., if this particular O4-line still appears in your log after rebooting... then you should reboot your system into SAFE MODE (by tapping the F8-key during the boot-up process, and selecting SAFE MODE), and try this FIX again while running HJT in SAFE MODE; and then, reboot into NORMAL mode.]
When you're done, generate and post your latest HJT log. And please let me know if you were able to remove this line in NORMAL mode, or if you required SAFE mode.
*************
it seems you WANT flash, yes? if so, you can try downloading/installing it from here:
winfixer can take-on many different forms... and it's not always so obvious, like finding the "explicit" O4-WinFixer line as we did in your case. if the winfixer popups/messages seem to have stopped for you, then we've probably gotten it... [but i'll be calling-in someone else to double-check on this for you].
as for scan disk [and disk defragmenter], as the message indicates, it has to re-start itself any time some program writes to your hard drive... and if there are 10-such writes/restarts, it wants to give up. if you want to complete the scan, first try (temporarily) turning-off your screen saver. that by itself, may be enough. but if scandisk still keeps restarting, then (with your screen saver still disabled) go to your task manager [hit the combination Control-Alt-Delete ] and
end every task there
EXCEPT
explorer and
systray
and then, try to run scandisk.
[to emphasize here, you should end iexplore (which is Internet Explorer) but NOT explorer (which is Windows Explorer).
this should allow scandisk to run to completion. if so, when it's done, reboot your system so that all normally-running processes are re-instated.
what other problems are you having with your Norton anti-virus?
as indicated, at this point, I'm gonna try to ask someone else to step-in, to determine additional problems (if any) that you might have. Please be advised that we're very "understaffed" at the moment, so I can't make any guarantee as to when (or even if) the next helper will arrive.
Thank you so much for your help. I did the log in NORMAL mode...and i believe the one.. "04" item ...is removed now. Could you please review this most recent log ??...as i still have issues with Norton antivirus not working correctly......my scan disk in "safe mode" will not work...repeats 10 times and says there are programs running in the background inhibiting the start of the scan. I haven't loaded the macromedia yet...as i am not sure if winfixer2005 is totally removed. I am such a novice at all this....hopefuuly my new log below will help answer these concern ?? ...but for the moment.....did it remove the winfier2002 from my machine based on the log below ??
Thank you again.
Skit2
Logfile of HijackThis v1.99.1
Scan saved at 6:56:42 PM, on 10/31/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Thank you so much for your help. The scan disc finally worked ( i do scan disk in Safe Mode)...it looks like your fix removed the programs running in the background inhibiting the scan. I tried to Download the Macromedia url you suggested. When i clicked "install now" from the sitea new page comes up....but the only thing in the "picture window" on the page was a square checkerboard icon....there was no piture...so i think it did not accept the download. I could not find any files the confirmed the download.
My norton is still not right. When i bring up the program...it says "norton antiviruew has encountered an internal program error ( 3002,20 )...uninstall and re-install norton antivirus". The norton screen hangs on "refreshing" ( system status box) and will not go to the normal norton screen where it normally would show the renewal date....last live update etc. The error screen pops up over the "refreshng" scren. However...if i click the "live update" in the upper left corner of the "system status" box ( with th error box on top...of the system status box)...it will run the update ( or so it appears).
ASll the above posts---are issues i still have---and i ma still not positive that weinfixer is finally gone LOLOL....but we are progressing -:)
Thank you again. I think these are my biggest issues at the moment......and they are totally killing me. Again ....thank you sooo much for trying to help. Just let me know what i need to do... to move foward here ??
Again---i want to thank you for what you have done already---and for fowarding me to someone who might be as gracious as you in helping me.. About me and my computer?? I'm a songwriter and musician ( a small time "indie" artist )...and am in the middle of a CD project... and 5 other different musical projects which depend heavily on my computer...mainly to market---promote--and upload my original music to sites that can help me with exposure of my material ( i do not use a computer to compose and record my material...only to store and upload to sites...but again...if i can't see what i'm doin ( page flash)...well ..you probably get where i'm coming from. I need cetain things to work right with this computer---and my windows update---norton---scan disk etc. are crucial to keeping me "out of trouble" -:) ). I spend big time hours on music sites uploading my tunes and pics --info etc. and a lot of these sites use this flash stuff ( i am comfortable in my own little world...but take me out...like i am now ??---and it is truly destroying me. I don't even have the ability to SEE ( if its flash connected site) what i am uploading to see if it's even right !!. I don't use this momster as a toy ( believer me---it's basically music music music...........i don't even know how to load a play a video game---no time LOLOL----i need to be doing music. Anyhow----just wanted to thank you for a 10th time -:)...because without my computer---i might as well just hang it up for my music on the internet. This is "life threatening" for me. I don't ask--or want much from my computer...i just want to be able to function...in my own little musical world....with a proper running computer. Winfixer sure did fix me up reallll good...............and it only cost me $40..................and my future. arggghghh !! -:)
My name is dobhar and I am following up on your log after the work you and ky331 did.
I have noticed that you do have items in the log that need to be cleaned out. I'm going to ask you to uninstall some software and run a couple programs.
________________________________________________________________________
- Recommend you uninstall
AdwareAlert as it is listed as "dubious" in Spyware Warrior's
Rogue/Suspect Anti-Spyware Products & Web Sites. Site can be found
here ________________________________________________________________________
- Recommend that you uninstall
Viewpoint. Viewpoint components are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting "Disable auto‑updating for the Viewpoint Manager" ‑‑ the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.
To provide a satisfying consumer experience and to operate effectively, the Viewpoint Media Player periodically sends information to servers at Viewpoint. Each installation of the Viewpoint Media Player is identifiable to Viewpoint via a Customer Unique Identifier (CUID), an alphanumeric identifier embedded in the Viewpoint Media Player. The Viewpoint Media Player randomly generates the CUID during installation and uses it to indicate a unique installation of the product. A CUID is never connected to a user's name, email address, or other personal contact information. CUIDs are used for the sole purpose of filtering redundant information. Each of these information exchanges occurs anonymously.
I recommend that you remove the Viewpoint products; however, decide for yourself.
________________________________________________________________________
- Recommend that you uninstall DAP. DAP is not technically malware, but it may include malware and allow it into your system. You can find Safe Alternatives
here ________________________________________________________________________________
Please print out or copy these instructions\tutorials to Notepad as the internet will not be (while in Safe Mode) availble to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes. ________________________________________________________________________________
Step 1. ========== Remove programs only if you decided to accept my recommendations. If not then skip Step 1 and continue on. We need to uninstall some programs
(if found in list) using "
Add or Remove Programs" in the Control Panel:
- Get into
Control Panel.
- Double-click "
Add or Remove Programs".
- Look in the
Currently installed programs box for each program listed below and if it is there:
- Click on it to select it.
- Click "
Change/Remove" (or "
Change") button.
- If you are prompted to confirm the removal of the program, click "
Yes"
AdawareAlert DAP Viewpoint Manager
Step 2. ========== Please download and install
CCleaner from
here
(Note: DO NOT run this program yet)
Step 3. ========== - Download
CWShredder by Trend Micro from
here to your Desktop
- Extract\Unzip the Files to your Desktop
(Note: DO NOT run this program yet)
Step 4. ========== If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup instructions =>
here
(Note: Please do NOT run it yet!)
Step 5. ========== - Reboot computer into "
Safe Mode" Using the
F8 method:
- As soon as the
BIOS is loaded begin
tapping the F8 key until the
Boot Menu appears
- Use the arrow keys to select the
Safe Mode menu item
(Note: For additional help in booting into Safe Mode, see the following site - here)
Step 6. ========== - Please make sure you can view all
hidden files and folders by following the instructions for your Windows 98
here
Step 7. ========== - Close all Windows and programs
- Run
HijackThis...
-
Select\check the following entries,
Double-check to make sure that only these entries are checked...
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.spidersearch.com/frame_results.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=50108 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=50108 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file) O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - (no file) O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe =>>>
Only if you decided to uninstall
O4 - HKLM\..\Run: [AdwareAlert] C:\PROGRAM FILES\ADWAREALERT\ADWAREALERT.Exe -boot =>>>
Only if you decided to uninstall
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm =>>>
Only if you decided to uninstall
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherAutoCAST0010.cab O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install.exe O16 - DPF: {10000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/TURB8108/turbo.cab O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - http://www.spywarelabs.com/ads/1402030731/VBouncerOuter1402030731.exe O16 - DPF: {A19A291A-9653-4498-93F6-5BA06CF699D8} (POP.Loader) - http://download.peopleonpage.com/pop/ads/ICM/ax/PopLoad.cab
- Click the "
Fix checked" button...
- Close HijackThis
Step 8. ========== Delete the following
Folder(s) in
BOLD only.
(Note: Don't be concern if can't find but advise if not found)
Folder(s)... C:\Program Files\
AdwareAlert = Delete This Folder =>>>
Only if you decided to uninstall
C:\Program Files\
DAP = Delete This Folder =>>>
Only if you decided to uninstall
C:\Program Files\
Viewpoint = Delete This Folder =>>>
Only if you decided to uninstall
Step 9. ========== We now need to cleanup all the
Temp, Temorary Internet Files, Recycle Bin, etc... - Start the
CCleaner program
- Get into "
Options" => Select "
Advanced" => Deselect\uncheck "
Only delete files in Windows Temp folders older than 48 hours"
- We are only going to work with the "Cleaner" section.
(Note: Do not use the "Issues" section)
- click on the
Run Cleaner button in the lower right-hand corner
- After complete close program
- Make sure the recycle Bin is empty
Step 10. ========== - Navigate to your Desktop and double-click on
CWShredder.exe to run it
- Make sure all Internet Explorer and computer windows are closed, then click on the
Fix-> button
- Advise if anything found
Step 11. ========== - Start
Ad-aware SE 1.06 and do a full scan
- Remove all it finds
Step 12. ========== - Reboot your PC into "Normal Mode"
- Run Panda's online virus scan from
here and perform a full system scan.
- Once you are on the Panda site click the "
Scan your PC" button
- A new window will open...click the big "
Check Now" button
- Enter your
Country - Enter your
State/Province - Enter your
Valid E-mail - Select either
Home User or Company - Click the big
Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on "
Local Disks" to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
- Post Panda scan results in your next reply
Step 13. ========== - Reboot back into "Normal Mode"
- Post back a fresh new HijackThis log
- Post back Panda ActiveScan log
Thank you for excepting to help me -:) I wanted you to know i am still working on the 13 steps you sent above. Steps 1 through 11 are cpmpleted....but for step 12....i cannot run Pand's online antivirus. It says: " error on on downloading Panda Active Scan". Also said possible cause might be: 1) not allowing the applications ActiveX control to be downloaded. 2) problems with the internet. 3) error could be due to a download error or an installation error due to lack of disk space, privileges etc."
I do not believe # 2 above is an issue...and i should have plenty of disk space. Anyhow---that's where i am at...step 12. I wont go further until i hear from you ( like i would really know what to do to go further ?? hehe). Also----i noticed for your step 10 ( shredder)...did find something...and removed it. It was: CWS.QTTASKS.
Logfile of HijackThis v1.99.1
Scan saved at 3:08:33 AM, on 11/2/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
We have a couple items to clean up still and I have another recommendation but it is your decision. Please read the following 2 articles on
Incredimail then make your own decision whether you would like to keep this software. If you decide to remove it use "Add or Remove Programs".
The articles can be found
here _______________________________________________________
Step 1. ========== - Close all Windows and programs
- Run
HijackThis...
-
Select\check the following entries,
Double-check to make sure that only these entries are checked...
R3 - Default URLSearchHook is missing O1 - Hosts: 217.116.231.7 aimtoday.aol.com O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm=>>> Only if you decided to uninstall the program O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab=>>> Only if you decided to uninstall the program
- Click the "
Fix checked" button...
- Close HijackThis
Step 2. ========== We now need to cleanup all the
Temp, Temorary Internet Files, Recycle Bin, etc... - Start the
CCleaner program
- Get into "
Options" => Select "
Advanced" => Deselect\uncheck "
Only delete files in Windows Temp folders older than 48 hours"
- We are only going to work with the "Cleaner" section.
(Note: Do not use the "Issues" section)
- click on the
Run Cleaner button in the lower right-hand corner
- After complete close program
- Make sure the recycle Bin is empty
Step 3. ========== - Start
Ad-aware SE 1.06 and do a full scan
- Remove all it finds
Step 4. ========== - Post back a fresh new HijackThis log
Logfile of HijackThis v1.99.1 Scan saved at 9:46:19 PM, on 11/3/05 Platform: Windows 98 SE (Win9x 4.10.2222A) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
I did your recommendation ...select/check....to remove incredimail......i hope my log reflects that ? I followed the directions in step 1....and i thought i got rid of incredimail that way....however...i can still access incredimail...............nothing there has changed. Did i do something wrong ?? I didn't go to the icons... to "uninstall incredimail" that way.......i followed your instructions and did just what was recommended. Hope this info helps some ?
Oh man.....i just messed this all up. I never went to add/remove...for incredimail. That's why i still have it.....dang-----i'm sorry. I put the check mark in for that in step 1---but never removed the program before i got started.....so the immediate hijack log above---is probably uselss. I'll try to do this all again tonght .....or as soona s i can. Again...sorry.
ky331
3 Apprentice
•
15.6K Posts
0
October 31st, 2005 13:00
To remove WinFixer:
Run HJT. Place a check-mark in the box in front of the line:
O4 - HKLM\..\Run: [WinFixer] C:\My Documents\WinFixer\wfx5.exe /min
Click on FIX CHECKED. Close HJT. Reboot. And see if WinFixer comes back or not.
[If WinFixer is still there... i.e., if this particular O4-line still appears in your log after rebooting... then you should reboot your system into SAFE MODE (by tapping the F8-key during the boot-up process, and selecting SAFE MODE), and try this FIX again while running HJT in SAFE MODE; and then, reboot into NORMAL mode.]
When you're done, generate and post your latest HJT log. And please let me know if you were able to remove this line in NORMAL mode, or if you required SAFE mode.
*************
it seems you WANT flash, yes? if so, you can try downloading/installing it from here:
http://www.macromedia.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash
ky331
3 Apprentice
•
15.6K Posts
0
October 31st, 2005 23:00
skit2
17 Posts
0
October 31st, 2005 23:00
Scan saved at 6:56:42 PM, on 10/31/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\CREATIVE\SBAUDIGY LS\SURROUND MIXER\CTSYSVOL.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\MY DOCUMENTS\RONS-HIJACK\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=50108
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=50108
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://home.starband.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by StarBand
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9877
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r5.attbi.com;
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O2 - BHO: AdPurger - {56796C51-A689-4360-B813-18A47C9D05C2} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [IPA] C:\Program Files\StarBand\\Internet Page Accelerator\AS_Agent.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdwareAlert] C:\PROGRAM FILES\ADWAREALERT\ADWAREALERT.Exe -boot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Filtering options - res://C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL /242
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0522.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0522.DLL
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: (no name) - {521C05E8-D5C3-42c2-B4CB-72B959140E95} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra 'Tools' menuitem: AdPurger... - {521C05E8-D5C3-42c2-B4CB-72B959140E95} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra button: On/Off - {521C05E8-D5C3-42c2-B4CB-11B959140aaa} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .com/00/00/00/1-157: C:\PROGRA~1\INTERN~1\PLUGINS\nponflow.dll
O16 - DPF: Dialpad Java Applet - http://dialpad.com/applet/src/vscp.cab
O16 - DPF: {BF8AEBF6-0656-11d4-9EFF-00B0D011B1AE} (Communities.com TPV Support 01) - http://www.thepalace.com/TPV/CC_SUPPORT.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi.dll
O16 - DPF: {67085ECE-F45C-482A-B47B-30B5214EA18E} (AtlFlip Class) - http://www.flipviewer.com/exe/fvlite.cab
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio4_0_2_10a.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherAutoCAST0010.cab
O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install.exe
O16 - DPF: {10000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/TURB8108/turbo.cab
O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - http://www.spywarelabs.com/ads/1402030731/VBouncerOuter1402030731.exe
O16 - DPF: {A19A291A-9653-4498-93F6-5BA06CF699D8} (POP.Loader) - http://download.peopleonpage.com/pop/ads/ICM/ax/PopLoad.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = cybersol.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 148.77.1.33,148.77.1.34
skit2
17 Posts
0
November 1st, 2005 00:00
Thank you so much for your help. The scan disc finally worked ( i do scan disk in Safe Mode)...it looks like your fix removed the programs running in the background inhibiting the scan. I tried to Download the Macromedia url you suggested. When i clicked "install now" from the sitea new page comes up....but the only thing in the "picture window" on the page was a square checkerboard icon....there was no piture...so i think it did not accept the download. I could not find any files the confirmed the download.
skit2
ky331
3 Apprentice
•
15.6K Posts
0
November 1st, 2005 01:00
removing the 04-winfixer line... and getting your scandisk to run to completion.... is as far as i can handle your situation.
as indicated, i have forwarded your log information to other helpers, requesting they continue assisting you.
skit2
17 Posts
0
November 1st, 2005 01:00
continued....Norton antivirus 2004:
My norton is still not right. When i bring up the program...it says "norton antiviruew has encountered an internal program error ( 3002,20 )...uninstall and re-install norton antivirus". The norton screen hangs on "refreshing" ( system status box) and will not go to the normal norton screen where it normally would show the renewal date....last live update etc. The error screen pops up over the "refreshng" scren. However...if i click the "live update" in the upper left corner of the "system status" box ( with th error box on top...of the system status box)...it will run the update ( or so it appears).
ASll the above posts---are issues i still have---and i ma still not positive that weinfixer is finally gone LOLOL....but we are progressing -:)
Thank you again. I think these are my biggest issues at the moment......and they are totally killing me. Again ....thank you sooo much for trying to help. Just let me know what i need to do... to move foward here ??
Skit2
Message Edited by skit2 on 10-31-2005 11:16 PM
skit2
17 Posts
0
November 1st, 2005 01:00
Again---i want to thank you for what you have done already---and for fowarding me to someone who might be as gracious as you in helping me.. About me and my computer?? I'm a songwriter and musician ( a small time "indie" artist )...and am in the middle of a CD project... and 5 other different musical projects which depend heavily on my computer...mainly to market---promote--and upload my original music to sites that can help me with exposure of my material ( i do not use a computer to compose and record my material...only to store and upload to sites...but again...if i can't see what i'm doin ( page flash)...well ..you probably get where i'm coming from. I need cetain things to work right with this computer---and my windows update---norton---scan disk etc. are crucial to keeping me "out of trouble" -:) ). I spend big time hours on music sites uploading my tunes and pics --info etc. and a lot of these sites use this flash stuff ( i am comfortable in my own little world...but take me out...like i am now ??---and it is truly destroying me. I don't even have the ability to SEE ( if its flash connected site) what i am uploading to see if it's even right !!. I don't use this momster as a toy ( believer me---it's basically music music music...........i don't even know how to load a play a video game---no time LOLOL----i need to be doing music. Anyhow----just wanted to thank you for a 10th time -:)...because without my computer---i might as well just hang it up for my music on the internet. This is "life threatening" for me. I don't ask--or want much from my computer...i just want to be able to function...in my own little musical world....with a proper running computer. Winfixer sure did fix me up reallll good...............and it only cost me $40..................and my future. arggghghh !! -:)
Skit2
dobhar
1.1K Posts
0
November 1st, 2005 07:00
My name is dobhar and I am following up on your log after the work you and ky331 did.
I have noticed that you do have items in the log that need to be cleaned out. I'm going to ask you to uninstall some software and run a couple programs.
________________________________________________________________________
- Recommend you uninstall AdwareAlert as it is listed as "dubious" in Spyware Warrior's Rogue/Suspect Anti-Spyware Products & Web Sites. Site can be found here
________________________________________________________________________
- Recommend that you uninstall Viewpoint. Viewpoint components are installed as a side effect of installing other software, most notably AOL and AOL Instant Messenger (AIM). Viewpoint Manager is responsible for managing and updating Viewpoint Media Player’s components. You can disable this using the Viewpoint Manager Control Panel found in the Windows Control Panel menu. By selecting "Disable auto‑updating for the Viewpoint Manager" ‑‑ the player will no longer attempt to check for updates. Anything that is installed without your consent is suspect. Read what Viewpoint says and make your own decision.
I recommend that you remove the Viewpoint products; however, decide for yourself.
________________________________________________________________________
- Recommend that you uninstall DAP. DAP is not technically malware, but it may include malware and allow it into your system. You can find Safe Alternatives here
________________________________________________________________________________
Please print out or copy these instructions\tutorials to Notepad as the internet will not be (while in Safe Mode) availble to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. If there's anything that you don't understand, ask your question(s) before moving on with the fixes.
________________________________________________________________________________
Step 1.
==========
Remove programs only if you decided to accept my recommendations. If not then skip Step 1 and continue on.
We need to uninstall some programs (if found in list) using " Add or Remove Programs" in the Control Panel:
- Get into Control Panel.
- Double-click " Add or Remove Programs".
- Look in the Currently installed programs box for each program listed below and if it is there:
- Click on it to select it.
- Click " Change/Remove" (or " Change") button.
- If you are prompted to confirm the removal of the program, click " Yes"
AdawareAlert
DAP
Viewpoint Manager
Step 2.
==========
Please download and install CCleaner from here
(Note: DO NOT run this program yet)
Step 3.
==========
- Download CWShredder by Trend Micro from here to your Desktop
- Extract\Unzip the Files to your Desktop
(Note: DO NOT run this program yet)
Step 4.
==========
If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup instructions => here
(Note: Please do NOT run it yet!)
Step 5.
==========
- Reboot computer into " Safe Mode" Using the F8 method:
- As soon as the BIOS is loaded begin tapping the F8 key until the Boot Menu appears
- Use the arrow keys to select the Safe Mode menu item
(Note: For additional help in booting into Safe Mode, see the following site - here)
Step 6.
==========
- Please make sure you can view all hidden files and folders by following the instructions for your Windows 98 here
Step 7.
==========
- Close all Windows and programs
- Run HijackThis...
- Select\check the following entries, Double-check to make sure that only these entries are checked...
R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.spidersearch.com/frame_results.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.couldnotfind.com/search_page.html?&account_id=50108
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr/defaults/sb/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.couldnotfind.com/search_page.html?&account_id=50108
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {029CA12C-89C1-46a7-A3C7-82F2F98635CB} - (no file)
O2 - BHO: (no name) - {4BCF322B-9621-4e90-9678-F1424EB7584E} - (no file)
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe =>>> Only if you decided to uninstall
O4 - HKLM\..\Run: [AdwareAlert] C:\PROGRAM FILES\ADWAREALERT\ADWAREALERT.Exe -boot =>>> Only if you decided to uninstall
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm =>>> Only if you decided to uninstall
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {FC327B3F-377B-4CB7-8B61-27CD69816BC3} - http://www.getweathercast.com/WeatherAutoCAST0010.cab
O16 - DPF: {13197ACE-6851-45C3-A7FF-C281324D5489} - http://www.2nd-thought.com/files/install.exe
O16 - DPF: {10000273-8230-4DD4-BE4F-6889D1E74167} - http://download.abetterinternet.com/download/cabs/TURB8108/turbo.cab
O16 - DPF: {D9EC0A76-03BF-11D4-A509-0090270F86E3} - http://www.spywarelabs.com/ads/1402030731/VBouncerOuter1402030731.exe
O16 - DPF: {A19A291A-9653-4498-93F6-5BA06CF699D8} (POP.Loader) - http://download.peopleonpage.com/pop/ads/ICM/ax/PopLoad.cab
- Click the " Fix checked" button...
- Close HijackThis
Step 8.
==========
Delete the following Folder(s) in BOLD only. (Note: Don't be concern if can't find but advise if not found)
Folder(s)...
C:\Program Files\ AdwareAlert = Delete This Folder =>>> Only if you decided to uninstall
C:\Program Files\ DAP = Delete This Folder =>>> Only if you decided to uninstall
C:\Program Files\ Viewpoint = Delete This Folder =>>> Only if you decided to uninstall
Step 9.
==========
We now need to cleanup all the Temp, Temorary Internet Files, Recycle Bin, etc...
- Start the CCleaner program
- Get into " Options" => Select " Advanced" => Deselect\uncheck " Only delete files in Windows Temp folders older than 48 hours"
- We are only going to work with the "Cleaner" section. (Note: Do not use the "Issues" section)
- click on the Run Cleaner button in the lower right-hand corner
- After complete close program
- Make sure the recycle Bin is empty
Step 10.
==========
- Navigate to your Desktop and double-click on CWShredder.exe to run it
- Make sure all Internet Explorer and computer windows are closed, then click on the Fix-> button
- Advise if anything found
Step 11.
==========
- Start Ad-aware SE 1.06 and do a full scan
- Remove all it finds
Step 12.
==========
- Reboot your PC into "Normal Mode"
- Run Panda's online virus scan from here and perform a full system scan.
- Once you are on the Panda site click the " Scan your PC" button
- A new window will open...click the big " Check Now" button
- Enter your Country
- Enter your State/Province
- Enter your Valid E-mail
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on " Local Disks" to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
- Post Panda scan results in your next reply
Step 13.
==========
- Reboot back into "Normal Mode"
- Post back a fresh new HijackThis log
- Post back Panda ActiveScan log
Message Edited by dobhar on 11-01-2005 03:20 AM
skit2
17 Posts
0
November 2nd, 2005 04:00
Hello dobhar,
Thank you for excepting to help me -:) I wanted you to know i am still working on the 13 steps you sent above. Steps 1 through 11 are cpmpleted....but for step 12....i cannot run Pand's online antivirus. It says: " error on on downloading Panda Active Scan". Also said possible cause might be: 1) not allowing the applications ActiveX control to be downloaded. 2) problems with the internet. 3) error could be due to a download error or an installation error due to lack of disk space, privileges etc."
I do not believe # 2 above is an issue...and i should have plenty of disk space. Anyhow---that's where i am at...step 12. I wont go further until i hear from you ( like i would really know what to do to go further ?? hehe). Also----i noticed for your step 10 ( shredder)...did find something...and removed it. It was: CWS.QTTASKS.
Thank you dobhar
Skit2
dobhar
1.1K Posts
0
November 2nd, 2005 05:00
Let's skip Step 12. Go ahead and post back a fresh new HijackThis log...let's see what it looks like.
skit2
17 Posts
0
November 2nd, 2005 06:00
Scan saved at 3:08:33 AM, on 11/2/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\CREATIVE\SBAUDIGY LS\SURROUND MIXER\CTSYSVOL.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\OUTLOOK EXPRESS\MSIMN.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\WINAMP\WINAMP.EXE
C:\MY DOCUMENTS\RONS-HIJACK\HIJACKTHIS.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://home.starband.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by StarBand
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9877
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r5.attbi.com;
R3 - Default URLSearchHook is missing
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O2 - BHO: AdPurger - {56796C51-A689-4360-B813-18A47C9D05C2} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [IPA] C:\Program Files\StarBand\\Internet Page Accelerator\AS_Agent.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: Filtering options - res://C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL /242
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0522.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0522.DLL
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: (no name) - {521C05E8-D5C3-42c2-B4CB-72B959140E95} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra 'Tools' menuitem: AdPurger... - {521C05E8-D5C3-42c2-B4CB-72B959140E95} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra button: On/Off - {521C05E8-D5C3-42c2-B4CB-11B959140aaa} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .com/00/00/00/1-157: C:\PROGRA~1\INTERN~1\PLUGINS\nponflow.dll
O16 - DPF: Dialpad Java Applet - http://dialpad.com/applet/src/vscp.cab
O16 - DPF: {BF8AEBF6-0656-11d4-9EFF-00B0D011B1AE} (Communities.com TPV Support 01) - http://www.thepalace.com/TPV/CC_SUPPORT.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi.dll
O16 - DPF: {67085ECE-F45C-482A-B47B-30B5214EA18E} (AtlFlip Class) - http://www.flipviewer.com/exe/fvlite.cab
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio4_0_2_10a.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = cybersol.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 148.77.1.33,148.77.1.34
dobhar
1.1K Posts
0
November 3rd, 2005 15:00
Sorry for the dealy...I am "under the weather"...
We have a couple items to clean up still and I have another recommendation but it is your decision. Please read the following 2 articles on Incredimail then make your own decision whether you would like to keep this software. If you decide to remove it use "Add or Remove Programs".
The articles can be found here
_______________________________________________________
Step 1.
==========
- Close all Windows and programs
- Run HijackThis...
- Select\check the following entries, Double-check to make sure that only these entries are checked...
R3 - Default URLSearchHook is missing
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm =>>> Only if you decided to uninstall the program
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IMDownloader Class) - http://www2.incredimail.com/contents/setup/downloader/imloader.cab =>>> Only if you decided to uninstall the program
- Click the " Fix checked" button...
- Close HijackThis
Step 2.
==========
We now need to cleanup all the Temp, Temorary Internet Files, Recycle Bin, etc...
- Start the CCleaner program
- Get into " Options" => Select " Advanced" => Deselect\uncheck " Only delete files in Windows Temp folders older than 48 hours"
- We are only going to work with the "Cleaner" section. (Note: Do not use the "Issues" section)
- click on the Run Cleaner button in the lower right-hand corner
- After complete close program
- Make sure the recycle Bin is empty
Step 3.
==========
- Start Ad-aware SE 1.06 and do a full scan
- Remove all it finds
Step 4.
==========
- Post back a fresh new HijackThis log
skit2
17 Posts
0
November 4th, 2005 00:00
Thank you dobhar......here is my log result.
Skit2
Logfile of HijackThis v1.99.1
Scan saved at 9:46:19 PM, on 11/3/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\LOGITECH\MOUSEWARE\SYSTEM\EM_EXEC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\CREATIVE\SBAUDIGY LS\SURROUND MIXER\CTSYSVOL.EXE
C:\PROGRAM FILES\COMMON FILES\REAL\UPDATE_OB\REALSCHED.EXE
C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\MY DOCUMENTS\RONS-HIJACK\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://home.starband.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by StarBand
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:9877
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.r5.attbi.com;
O2 - BHO: Yahoo! Companion BHO - {13F537F0-AF09-11d6-9029-0002B31F9E59} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O2 - BHO: AdPurger - {56796C51-A689-4360-B813-18A47C9D05C2} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\YCOMP5_0_2_4.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [StillImageMonitor] C:\WINDOWS\SYSTEM\STIMON.EXE
O4 - HKLM\..\Run: [EM_EXEC] C:\PROGRA~1\LOGITECH\MOUSEW~1\SYSTEM\EM_EXEC.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMON.EXE /Consumer
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] C:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy LS\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [IPA] C:\Program Files\StarBand\\Internet Page Accelerator\AS_Agent.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER FREE EDITION\PSFREE.EXE"
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE10\EXCEL.EXE/3000
O8 - Extra context menu item: Filtering options - res://C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL /242
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0522.DLL
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRAM FILES\YAHOO!\MESSENGER\YHEXBMES0522.DLL
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: (no name) - {521C05E8-D5C3-42c2-B4CB-72B959140E95} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra 'Tools' menuitem: AdPurger... - {521C05E8-D5C3-42c2-B4CB-72B959140E95} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra button: On/Off - {521C05E8-D5C3-42c2-B4CB-11B959140aaa} - C:\PROGRAM FILES\ADPURGER\2.51\ADPURGER.DLL
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\SYSTEM\MSJAVA.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRAM FILES\AIM\AIM.EXE
O12 - Plugin for .com/00/00/00/1-157: C:\PROGRA~1\INTERN~1\PLUGINS\nponflow.dll
O16 - DPF: Dialpad Java Applet - http://dialpad.com/applet/src/vscp.cab
O16 - DPF: {BF8AEBF6-0656-11d4-9EFF-00B0D011B1AE} (Communities.com TPV Support 01) - http://www.thepalace.com/TPV/CC_SUPPORT.cab
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) - http://fdl.msn.com/zone/Z4/heartbeat.cab
O16 - DPF: Dialpad US Java Applet - http://www.dialpad.com/applet/src/vscp.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {D702FBF4-EE60-11D0-BD5B-00A0C91F4635} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/essentials/ymmapi.dll
O16 - DPF: {67085ECE-F45C-482A-B47B-30B5214EA18E} (AtlFlip Class) - http://www.flipviewer.com/exe/fvlite.cab
O16 - DPF: {072D3F2E-5FB6-11D3-B461-00C04FA35A21} (CFForm Runtime) - http://www.soundclick.com/CFIDE/classes/CFJava.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/ym/yiebio4_0_2_10a.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://apple.speedera.net/qtinstall.info.apple.com/borris/us/win/QuickTimeInstaller.exe
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.com/players/play365.cab
O16 - DPF: {E855A2D4-987E-4F3B-A51C-64D10A7E2479} (EPSImageControl Class) - http://tools.ebayimg.com/eps/activex/EPSControl_v1-0-3-0.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-9.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = cybersol.com
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 148.77.1.33,148.77.1.34
skit2
17 Posts
0
November 4th, 2005 01:00
dobhar,
I did your recommendation ...select/check....to remove incredimail......i hope my log reflects that ? I followed the directions in step 1....and i thought i got rid of incredimail that way....however...i can still access incredimail...............nothing there has changed. Did i do something wrong ?? I didn't go to the icons... to "uninstall incredimail" that way.......i followed your instructions and did just what was recommended. Hope this info helps some ?
Thank you
Skit2
skit2
17 Posts
0
November 4th, 2005 01:00
Oh man.....i just messed this all up. I never went to add/remove...for incredimail. That's why i still have it.....dang-----i'm sorry. I put the check mark in for that in step 1---but never removed the program before i got started.....so the immediate hijack log above---is probably uselss. I'll try to do this all again tonght .....or as soona s i can. Again...sorry.
Skit2