Internet Explorer can not open web page

Question

I've tried running Spybot, Malwarebytes, McAfee, but nothing seems to resolve this problem.  I can get to sites that have already been saved to favorites, but if I Google something and try to follow the link, I get 'Internet Explorer can not open web page' Is this another facet of the Google redirect? I'd appreciate any help!  Hijack this log attached Logfile of Trend Micro HijackThis v2.0.4Scan saved at 6:03:47 PM, on 8/29/2010Platform: Windows Vista SP2 (WinNT 6.00.1906)MSIE: Internet Explorer v8.00 (8.00.6001.18943)Boot mode: Normal Running processes:c:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Windows\system32\Dwm.exeC:\Windows\system32	askeng.exeC:\Windows\Explorer.EXEC:\Program Files\Dell Support Center\gs_agent\custom\dsca.exeC:\Program Files\Dell Support Center\bin\sprtcmd.exeC:\Windows\System32undll32.exeC:\Program Files\CyberLink\Power2Go\CLMLSvc.exeC:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exeC:\Windows\sttray.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Program Files\Trend Micro\HiJackThis\HiJackThis.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\Windows\system32\SearchFilterHost.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: (no name) - {01B199B0-1BAF-4FC4-9B2F-0972D4BC65F2} - C:\ProgramData\CertEnroll32.dllO2 - BHO: (no name) - {02167781-FF5B-4689-BCCA-73CC5CA440E3} - C:\ProgramData\CertEnroll32.dllO2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dllO2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [mcagent_exe] 'C:\Program Files\McAfee.com\Agent\mcagent.exe' /runkeyO4 - HKLM\..\Run: [dscactivate] 'C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe'O4 - HKLM\..\Run: [DellSupportCenter] 'C:\Program Files\Dell Support Center\bin\sprtcmd.exe' /P DellSupportCenterO4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStartO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [UpdateLBPShortCut] 'C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\LabelPrint' UpdateWithCreateOnce 'Software\CyberLink\LabelPrint\2.5'O4 - HKLM\..\Run: [CLMLServer] 'C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe'O4 - HKLM\..\Run: [UpdateP2GoShortCut] 'C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\Power2Go' UpdateWithCreateOnce 'SOFTWARE\CyberLink\Power2Go\6.0'O4 - HKLM\..\Run: [UpdatePPShortCut] 'C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\PowerProducer' UpdateWithCreateOnce 'Software\CyberLink\PowerProducer\5.0'O4 - HKLM\..\Run: [UCam_Menu] 'C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\YouCam' UpdateWithCreateOnce 'Software\CyberLink\YouCam\2.0'O4 - HKLM\..\Run: [UpdatePSTShortCut] 'C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\DVD Suite' UpdateWithCreateOnce 'Software\CyberLink\PowerStarter'O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exeO4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exeO4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenterO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-21-3322949673-2421086916-1686220281-1000\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (User 'jean')O4 - HKUS\S-1-5-21-3322949673-2421086916-1686220281-1000\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User 'jean')O4 - HKUS\S-1-5-21-3322949673-2421086916-1686220281-1000\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 Startup: LaunchU3.exe.lnk = ? (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 Startup: OneNote Table Of Contents.onetoc2 (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 Startup: PowerReg Scheduler V3.exe (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 User Startup: LaunchU3.exe.lnk = ? (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 User Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 User Startup: OneNote Table Of Contents.onetoc2 (User 'jean')O4 - S-1-5-21-3322949673-2421086916-1686220281-1000 User Startup: PowerReg Scheduler V3.exe (User 'jean')O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cabO18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dllO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exeO23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeO23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exeO23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exeO23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe --End of file - 11184 bytes

bamajim · Answer

jeanniereed

1. Make sure Spybot S&D is turned off during this fix

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
5) Restart your computer.

2. We need to be able to see hidden files and folders

Click Start (The Vista Icon)
Control Panel ->> Folder Options
After the new window appears select the View tab.
Put a checkmark in the checkbox labeled Display the contents of system folders.
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
Remove the checkmark from the checkbox labeled Hide protected operating system files.
Click Yes To confirm
Press the Apply button and then the OK button.

3. Rerun Hijackthis (scan only) and place checks beside the following entries

O2 - BHO: (no name) - {01B199B0-1BAF-4FC4-9B2F-0972D4BC65F2} - C:\ProgramData\CertEnroll32.dll
O2 - BHO: (no name) - {02167781-FF5B-4689-BCCA-73CC5CA440E3} - C:\ProgramData\CertEnroll32.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

Close all other open windows except Hijackthis and Select " Fix checked"

Close Hijackthis

4. Using Windows Explorer

Rt Click the Start Buttton (The Vista Icon) ->> Explore, and you will see the "tree' of file folders in the left side of the window.
Click on the ">" next to any folder name to expand its contents

Locate and Delete the following files

C:\ProgramData\CertEnroll32.dll

Close windows explorer ->> Reboot your PC ->> Rerun Hijackthis and post a fresh Hijackthis log.

jeanniereed · Answer

Bamajim, Thanks so much! My version of Spybot only had 'Resident' under the tools, no 'Resident Teatimer' so I went with that. My Control Panel didn't have 'Display Contents of System folder' but I did check 'show hidden files' and 'hide extention'  as instructed. After running HTL I was only able to locate O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file) .  Nor could I find the 'CertEnroll32.dll' file in the tree. Here's the new HJT log: Logfile of Trend Micro HijackThis v2.0.4Scan saved at 6:30:36 PM, on 8/30/2010Platform: Windows Vista SP2 (WinNT 6.00.1906)MSIE: Internet Explorer v8.00 (8.00.6001.18943)Boot mode: Normal Running processes:C:\Windows\system32	askeng.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Windows\System32\mobsync.exec:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\Program Files\Dell Support Center\bin\sprtcmd.exeC:\Program Files\CyberLink\Power2Go\CLMLSvc.exeC:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exeC:\Windows\sttray.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Microsoft Office\Office\OSA.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\System32undll32.exeC:\Program Files\Trend Micro\HiJackThis\HiJackThis.exeC:\Windows\system32\SearchFilterHost.exeC:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by DellR0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhostO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dllO2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dllO4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hideO4 - HKLM\..\Run: [mcagent_exe] 'C:\Program Files\McAfee.com\Agent\mcagent.exe' /runkeyO4 - HKLM\..\Run: [dscactivate] 'C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe'O4 - HKLM\..\Run: [DellSupportCenter] 'C:\Program Files\Dell Support Center\bin\sprtcmd.exe' /P DellSupportCenterO4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStartO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe'O4 - HKLM\..\Run: [UpdateLBPShortCut] 'C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\LabelPrint' UpdateWithCreateOnce 'Software\CyberLink\LabelPrint\2.5'O4 - HKLM\..\Run: [CLMLServer] 'C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe'O4 - HKLM\..\Run: [UpdateP2GoShortCut] 'C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\Power2Go' UpdateWithCreateOnce 'SOFTWARE\CyberLink\Power2Go\6.0'O4 - HKLM\..\Run: [UpdatePPShortCut] 'C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\PowerProducer' UpdateWithCreateOnce 'Software\CyberLink\PowerProducer\5.0'O4 - HKLM\..\Run: [UCam_Menu] 'C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\YouCam' UpdateWithCreateOnce 'Software\CyberLink\YouCam\2.0'O4 - HKLM\..\Run: [UpdatePSTShortCut] 'C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe' 'C:\Program Files\CyberLink\DVD Suite' UpdateWithCreateOnce 'Software\CyberLink\PowerStarter'O4 - HKLM\..\Run: [ContentTransferWMDetector.exe] C:\Program Files\Sony\Content Transfer\ContentTransferWMDetector.exeO4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exeO4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenterO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\DellSupport\DSAgnt.exe' /startupO4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exeO4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXEO4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXEO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin
pjpi160.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dllO9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cabO18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dllO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dllO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exeO23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exeO23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exeO23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exeO23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exeO23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exeO23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exeO23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe --End of file - 9627 bytes Jeannie

bamajim · Answer

You are welcome. Are you still being re-directed?

jeanniereed · Answer

I know this will sound strange, but last night after following your instructions, I had no problems. Then this morning I had an issue with two sites. Tonight I am ok again.

Can you tell me:

Is this a virus/malware or is it just IE issues? Can I do something to prevent it from happening again? Would you download Firefox and would it have the same problems?

Also where did the CertEnroll files disappear to if I didn't delete them?

I truly wish I had a better understanding of what goes on.

I am very, very grateful for your expertise and willingness to help.

Jeannie

bamajim · Answer

I don't see any other signs of infection. Let's look at one more thing

Please perform a BitDefender Online Virus and Malware Scan here:

* Click Start Scanner.
* Click I Agree… and Start Here.
* An ActiveX warning box will appear; click Install.
* Options displayed are Folders to Scan and Cleaning Options; click Folders to Scan (in most cases it will be C:\).
* Select folders to be scanned by clicking check boxes; click OK.
* Click Start Scan.
* After the scan has completed, click Click here to export the scan report.
* Save the report to your Desktop.
* In your next reply, please include the BitDefender log.

jeanniereed · Answer

Here's the BitDefender scan: BitDefender Online Scanner     Scan report generated at: Wed, Sep 08, 2010 - 21:35:50       Scan path: C:\backup;C:\DELL;C:\doctemp;C:\Drivers;C:\hegames;C:\hotfix;C:\INET;C:\KA;C:\mamlTemp;C:\PerfLogs;C:\PLAYSKL;C:\Program Files;C:\QT$INST$.TMP;C:\sandbox;C:\Temp;C:\Users;C:\Windows;           Statistics Time 02:41:24 Files 312714 Folders 27182 Boot Sectors 0 Archives 6520 Packed Files 16811     Results Identified Viruses 0 Infected Files 0 Suspect Files 0 Warnings 0 Disinfected 0 Deleted Files 0     Engines Info Virus Definitions 6344660 Engine build AVCORE v2.1 Windows/i386 11.0.0.33 (Jun 18 2010) Scan plugins 18 Archive plugins 44 Unpack plugins 10 E-mail plugins 6 System plugins 4     Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions   Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes       Scanned File  Status No virus found.            Was this a virus/or malware?  How can I protect myself from it happening again?  A different browser? Many thanks for your time and help!!! Jean

Virus & Spyware

Was this post helpful?