Hi Mr Rich

I would be glad to help you with your computer problems. HijackThis logs take awhile to research. Please be patient with me. I know that you want your problems solved quicky, and I will work hard to help you. Please observe these rules while we work:

1. If you don't know, stop and ask! Don't keep going on. 2. Please reply to this thread. Do not start a new topic. If you can do those two things, everything should go smoothly

In Training at Malware Removal

University , So could you

Hi MrRich

NOTE : You may want to print out these instructions or save them as a text file with Notepad to your desktop because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Read this instructions carefully and feel free to ask if you're unsure about something.

The first thing you need to download the Latest Hijack This from http://www.merijn.org/files/hijackthis.zip

We'll need to move HiJackThis.exe out of a temporary directory and into a directory of its own, preferably C:\HJT (creating the folder if necessary). The reason behind this is that HJT creates backups of every "fix" we do in the folder it's running in. If we happen to "fix" something and need it later on, there is a very good chance that, by that time, that TEMP directory could be purged and our backups would be lost. If you need a detailed tutorial or just a better explanation as to why, please http://russelltexas.com/malware/createhjtfolder.htm.

Also you need to update your windows XP with the latest Service packs and critical updates from Microsoft here http://windowsupdate.microsoft.com/.

The next thing you need to do as follows:

• Goto Start, Then Run
• Type MSCONFIG, press Enter
• Select the Startup tab. Then check all the Unchecked items.
• Press Apply, then Ok
• Restart windows

When Windows restarts a message will appear press Ok

Please can you post a new log.

Hi Mr Rich

You may want to print out these instructions or save them as a text file with Notepad to your desktop because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Read this instructions carefully and feel free to ask if you're unsure about something

1. Restart your computer. As your computer restarts, repeatedly press the F8 key on your keyboard until the Windows Advanced Options menu appears.
2. Use the arrow key to select Safe Mode, and then press ENTER.
3. Use an arrow key to select an operating system and press ENTER.
4. When prompted whether you want your Windows to run in safe mode, click Yes.

Next please run HijackThis, click Scan, and check the following:

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe
O2 - BHO: (no name) - {3D8A06ED-FF1B-41AF-8744-E7EF29D95D24} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {4887CE34-8A91-44E9-A61B-34F1254E784B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {7B9F24CF-BDDE-4675-B894-9C8D4C6FBE7E} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {7EA2ECDA-590E-4F75-9C72-E0D80A66BEBB} - C:\Program Files\CSBB\CSBB.dll (file missing)

O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O2 - BHO: (no name) - {A1C0A78F-A833-45CE-BCC9-92AD02FB6ED9} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {B171FEC8-4E36-47B4-B2F1-EE7ABDE6D0FA} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {B9156E9D-3F9B-431C-B32C-FBA7A2E5B461} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {C67D2CF8-00C7-49D9-A223-D7BEA56F330C} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {DA51AB3F-2978-4994-AA36-914E19C4BB8B} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {F6D7C63A-C30A-4E4E-A6D8-56BBDF21EF25} - C:\Program Files\CSBB\CSBB.dll (file missing)
O2 - BHO: (no name) - {F952BE02-0FD8-4F90-9F40-42A3EDA47A04} - C:\Program Files\CSBB\CSBB.dll (file missing)
O4 - HKLM\..\Run: [System] C:\WINDOWS\System32\kernels32.exe

O4 - HKCU\..\Run: [winrnr] C:\WINDOWS\System32\winrnr.exe
O4 - HKCU\..\Run: [ltimg11n] C:\WINDOWS\System32\ltimg11n.exe
O4 - HKCU\..\Run: [ir41_qcx] C:\WINDOWS\System32\ir41_qcx.exe
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {0335A685-ED24-4F7B-A08E-3BD15D84E668} - http://dl.filekicker.com/send/file/128985-NZIL/PhPSetup.cab

O20 - AppInit_DLLs: mad.dll



Press Fix Checked, HJT will prompt you to confirm if you would like to remove those items, select Yes.

Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

Please delete these folders using Windows Explorer(if present):

C:\Program Files\CSBB

Please delete these files using Windows Explorer(if present):

C:\WINDOWS\System32\ir41_qcx.exe
C:\WINDOWS\System32\ltimg11n.exe
C:\WINDOWS\System32\winrnr.exe
C:\WINDOWS\System32\kernels32.exe

Next restart windows back into normal mode and post another HJT log back into this thread, thanks :smileyhappy:

Mat2

In Training at Malware Removal
University , You too could train to help others

Threads will be considered closed 7 days after the last posting.

In Training at Malware Removal
University , You too could train to help others

Threads will be considered closed 7 days after the last posting.