hijack file please hlep

Download the Hoster from:

http://www.funkytoad.com/

Unpack to your desktop and run it.  If you have green print at the top then just press Restore Original Hosts then OK. 
IF you have red print then press make Hosts Writeable first.
 

Get DelDomain.inf from:
 
http://www.mvps.org/winhelp2002/DelDomains.inf  and then right click on it and Install. 

Also download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet. 

Shutdown and restart and
Boot into Safe Mode by tapping the F8 key when you see the PC maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.

Run HijackThis and check the box in front of each

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.teenisex.com/pop/ps.html
O2 - BHO: HomepageBHO - {893fad3a-931e-4e53-b515-b1426d63799b} - C:\WINDOWS\System32\hp4E64.tmp
O4 - HKCU\..\Run: [Compaq Service Drivers] msnsvc.exe
O4 - HKCU\..\RunServices: [Compaq Service Drivers] msnsvc.exe

Press Fix Checked and ignore any warnings.

Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.

Reboot into regular mode

Run HijackThis and make a new log and post it as a Reply.

Ron

The first one was killed by smitrem but it left the registry entry.  You can check it and then fix checked.

O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp3B91.tmp (file missing)

This one takes some special registry work:

O4 - HKCU\..\Run: [Compaq Service Drivers] msnsvc.exe

Get Regseeker from:

http://www.hoverdesk.net/freeware.htm

Install it but don't run it yet.

Get killbox and save it to your desktop

http://www.bleepingcomputer.com/files/killbox.php

Boot into Safe Mode

run regseeker and select Find in Registry.  Check all of the HKEY boxes then search for:

Compaq Service Drivers

When done, Select All then right click on the selection and Delete Selected Items.

Repeat for

Msnsvc.exe

mssearchnet.exe

Run the hoster again as before.

Pull up Microsoft Antispy and under Scan Options make sure all three options are checked then let it do a full scan.  Delete anything it finds.

Message Edited by RKinner on 10-06-2005 09:48 PM

Making progress.  Try smitrem again and see if it will do us the favor of removing

O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp9395.tmp

Ron

Ron, again thanks for all of your help.  I have a couple of questions?  One, I have been trying to make my internet home page to default to a designated page.  I go and try to change it in internet options, but it keeps going back to a blank page.  I tried to go to microsoft spyware program and select bowsere options, and I check to go back to the original page, but again, when I open internet, there is still a blank page.

The other question I have is that my printer has uninstalled.  I can't install it bec it says that something is missing.  I have even gone to Lexmark solution page and tried to download their software but again, it wouldn't install it.  It's like the whole thing has been removed from the computer.

Check this one and your log should be clean.

O2 - BHO: HomepageBHO - {3bf1f86f-b1a8-489b-8d8b-43781d51411f} - C:\WINDOWS\System32\hp9395.tmp (file missing)

As far as the home page is concerned you have two other programs that might not want the home page to change.  Spyware Doctor and TPT Registry_Cleaner.  Stop them both from running and then try again to change the page. 

In Microsoft AntiSpy what does it say for Current Setting and Restore Setting To for Start Page?

If you stop Microsoft Antispy from running too can you change your start page from IE Tools/ Internet Options?

Can you then download the Lex printer file and Save it to your desktop?

Ron

C:\Windows\system32\spoolsv.exe is the printer spooler service file.  You will need it in order to print.

Start, Run, cmd, OK and in the black cmd screen type:

cd \

(cd SPACE \)

dir /s spoolsv.exe

(dir SPACE /s SPACE spoolsv.exe)

IF it finds it in a folder for example C:\i386 then

cd \i386

copy spoolsv.exe \windows\system32\spoolsv.exe

If you do not see have a copy on your PC see if you can get a copy on a floppy or a CD from a friend.  If all else fails I can send you one.  email me directly at rkinner AT att DOT net with subject DELL rbescout and remind me that you need the spoolsv.exe file.

Start, Run, service.msc, OK to bring up the Services screen.

Scroll down until you find Print Spooler and double click on it.  Set Startup Type to Automatic and then Apply then Start the service.  IFyou don't find it then we will have to jump through some more hoops to get it to work.

Ron

I did what you told me and in the cmd it did show that i have the folder for the spoolsv.exe.  It showed the serial numbers and files for it.  I'm assuming that means I have it right?  Doing the services, I did the startup authomatic and start, but still nothing happend.

I also have noticed that everytime I restart my computer, the internet home page defaults back to saying I download ps guard.  I go back to hijack this and scan and that one file that says 02 bho hompagebho keeps coming back.  I check it and click fixed, and the internet page goes back to blank.  If I turn off the computer and restart it and run hijack, the file is back again.  I even tried to delete it on safe mode, but it still comes back.  Thanks again.