logfile Hijack new need help

Question

ok i was told to do this and this is what i have copied and pasted below. what happend Ok on april 1 my computer was connected to the internet and only the yahoo home page was up, around 5pm a little black sceen started to download something that i did not do. i tired to stop the download and it got to the point were i just unplugged my computer from the internet. Well something must have happend because heres my problem. I first started having tons of pop ups which i do have pop up blocker and it didnt work, then IM no longer able to get on AIM at all it says ' the instruction at '0x0150f70c' referenced memory at '0x0150f70c'. the memory could not be 'written'. then behind that message it has a crash report.  I have nortons and its updated almost every week and it has not caught any virus. I have also ran spybot and Ad-Aware and they come up with stuff all the time and i click fix the problem and it says they fix the problem but when i rescan there still there. i have also ran window defender there again it catchs stuff and fixes it but then its still there. Also my firewall is disabled aswell and i can not enable it and it says due to an unidentified problem. I have even went into safe mode to fix things but it doesnt help. also every time i restart windows my windows system folder pops up and i have went into the run program etc to turn it off but it still does it. I have Windows XP professional V. 2002 service pack 2 and Dell inspiron XPS_GEN2 intel(R) Pentium(R) M processor 2.00GHz 2.00 GHz,2.00 GB of RAM. I have tried alot of things and dont know what to do, if i have to clear everything off my computer and start over i will but i would like that to be my last resort. This is my laptop and my only computer. Please help if you can in anyway im up for anything at this point. thanks Ashley     Logfile of HijackThis v1.99.1 Scan saved at 3:02:05 PM, on 4/13/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\NavNT\defwatch.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\NavNTtvscan.exe C:\WINDOWS\system32
vsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\NavNT\vptray.exe C:\WINDOWS\system32\MsgSys.EXE C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Dell\Media Experience\PCMService.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Dell Support\DSAgnt.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Lexmark X125\LEX125SU.exe C:\Program Files\Support.com\bin	gcmd.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,isograv.exe O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file) O3 - Toolbar: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - (no file) O4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hide O4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exe O4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /r O4 - HKLM\..\Run: [tgcmd] 'C:\Program Files\Support.com\BellSouth\hcenter.exe' /starthidden /tgcmdwrapper O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [STOPzilla]  /autostart O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe' O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [mmtask] 'C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe' O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXE O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe' O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startup O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://click.getmirar.com (HKLM) O15 - Trusted Zone: http://click.mirarsearch.com (HKLM) O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM) O16 - DPF: {01118A01-3E00-11D2-8470-0060089874ED} (SupportSoft Script Runner Class) - https://password.bellsouth.net/sdccommon/download/tgctlsr.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144089406062 O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cab O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\ O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNTtvscan.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\SZServer.exe (file missing) O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe   Message Edited by abhurst1 on 04-13-200604:36 PM

RKinner · Answer

Get DelDomain.inf from:

http://www.mvps.org/winhelp2002/DelDomains.inf and then right click on it and
Install. Nothing obvious will happen.

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see
the PC maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in as your usual login or you won't find
the programs you put on the desktop
and some of the entries we want to remove will not appear in HijackTHis.

Run HijackThis and just do a Scan only. Check then Fix Checked the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/mywaybiz
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,isograv.exe
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - (no file)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O15 - Trusted Zone: http://click.getmirar.com (HKLM)
O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)
O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/en-us/wlscbase7617.cab
O20 - Winlogon Notify: Dynamic Directory - C:\WINDOWS\

Reboot into regular mode and make a new HJT log and post it as a reply.

Ron

abhurst1 · Answer

thanks ron, this is what the rescan found   Logfile of HijackThis v1.99.1Scan saved at 4:15:54 PM, on 4/14/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Windows Defender\MSASCui.exeC:\Program Files\NavNT\vptray.exeC:\Program Files\Common Files\Sonic\Update Manager\sgtray.exeC:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeC:\Program Files\Real\RealPlayer\RealPlay.exeC:\Program Files\Dell\Media Experience\PCMService.exeC:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXEC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\Program Files\Dell\QuickSet\quickset.exeC:\Program Files\Apoint\Apoint.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Dell Support\DSAgnt.exeC:\Program Files\Apoint\Apntex.exeC:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\Lexmark X125\LEX125SU.exeC:\Program Files\NavNT\defwatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exeC:\Program Files\NavNTtvscan.exeC:\WINDOWS\system32
vsvc32.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\MsgSys.EXEC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Support.com\bin	gcmd.exeC:\WINDOWS\system32\wuauclt.exeC:\Documents and Settings\WINXP\Desktop\hijackthis_sfx.exeC:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ebay.com/O4 - HKLM\..\Run: [Windows Defender] 'C:\Program Files\Windows Defender\MSASCui.exe' -hideO4 - HKLM\..\Run: [vptray] C:\Program Files\NavNT\vptray.exeO4 - HKLM\..\Run: [UpdateManager] 'C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe' /rO4 - HKLM\..\Run: [tgcmd] 'C:\Program Files\Support.com\BellSouth\hcenter.exe' /starthidden /tgcmdwrapperO4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exeO4 - HKLM\..\Run: [STOPzilla]  /autostartO4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYERO4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottimeO4 - HKLM\..\Run: [PCMService] 'C:\Program Files\Dell\Media Experience\PCMService.exe'O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquietO4 - HKLM\..\Run: [mmtask] 'C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe'O4 - HKLM\..\Run: [LMPDPSRV] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LMPDPSRV.EXEO4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [DVDLauncher] 'C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe'O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exeO4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exeO4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /autoO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [DellSupport] 'C:\Program Files\Dell Support\DSAgnt.exe' /startupO4 - Global Startup: Adobe Gamma Loader.lnk = ?O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exeO4 - Global Startup: Digital Line Detect.lnk = ?O4 - Global Startup: Lexmark X125 Settings Utility.lnk = C:\Program Files\Lexmark X125\LEX125SU.exeO4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exeO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dllO9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {01118A01-3E00-11D2-8470-0060089874ED} (SupportSoft Script Runner Class) - https://password.bellsouth.net/sdccommon/download/tgctlsr.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cabO16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cabO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1144089406062O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,23/mcgdmgr.cabO23 - Service: DefWatch - Symantec Corporation - C:\Program Files\NavNT\defwatch.exeO23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exeO23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNTtvscan.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exeO23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: STOPzilla Service (szserver) - Unknown owner - C:\Program Files\Common Files\STOPzilla!\SZServer.exe (file missing)O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe   Message Edited by abhurst1 on 04-14-200603:16 PM Message Edited by abhurst1 on 04-14-200603:16 PM

RKinner · Answer

Log looks good.  Do you still have problems?   Ron

abhurst1 · Answer

yea i still cant get on Aim to instant message, and still have spyware on my computer. i dont know. would it just be better to start all over like clean everything off and reload everything back on?

RKinner · Answer

How do you know you have spyware on your computer?

If you have a fast link you can get mwav.exe from:

http://www.spywareinfo.dk/download/mwav.exe
and install it and check for updates then
Download the Killbox.
http://www.downloads.subratam.org/KillBox.exe
http://www.bleepingcomputer.com/files/spyware/KillBox.zip
Save it to the desktop

reboot into Safe Mode (F8) and run the escan(mwav) program. Select all options and let it run for a few hours. It will eventually create a log file. It will remove anything it finds that it considers a virus or try to. Adware it just flags in the log. You have to go through the log for entries like:
Fri Jul 29 10:25:26 2005 => File C:\WINDOWS\System32\06wu29rd.exe tagged as not-a-virus:AdWare.F1Organizer.g. No Action Taken.

(hint use Notepad's Edit, Find to search for: not-a-virus)

then use killbox to clean the adware manually. Double-click Killbox.exe to run it.
Select "Delete on Reboot".
Place the full path in the "Full Path of File to Delete" box in Killbox:
example: C:\WINDOWS\System32\06wu29rd.exe
Press the red button, agree you want to delete the file but do not let it reboot yet. Repeat for every not-a-virus entry then let it reboot after the last one.

I see no sign of AIM on your computer. I would uninstall it if it is still there: Start, Control Panel, Add/Remove Programs then go download it and reinstall it.

http://www.aim.com/download.adp?aolp=

(The = sign is part of the address but the forum doesn't think so. You may have to manually add it)

You might try a System Restore to a time before the problem before you redo the whole thing.

http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/systemrestore.mspx

Remember if you wipe it and start over that the original load is missing a lot of patches so make sure you have the firewall turned on then go directly to windowsupdate.microsoft.com and get all your patches. Do not go to any other site until you have your patches! Also dump the old version of Java and get the newest version.

Get the latest version of
Java:
http://www.java.com/en/download/windows_automatic.jsp

Ron

abhurst1 · Answer

thanks ron! will do

abhurst1 · Answer

Hey Ron, ok my firewall still wont allow me to turn it on, these are what spybot found Avenue A. Inc and Windows security.antivirusOverride. Ad-aware found MRU list and Tracking Cookies. these always come up everytime i run this two programs. they wont seem to go away. Have any idea whats keeping my firewall off? also i can download any updates from microsoft, it wont allow me to do that either. i also did a system restore and it would not restore, i did several dates and same response. Help

thanks

Ashley

Message Edited by abhurst1 on 04-17-200603:41 PM

RKinner · Answer

Avenue A. Inc is just a tracking cookie.  When you visit a site that shows ads you get a tracking cookie so that next time you will see a different ad.  Nothing to worry about.   Windows security.antivirusOverride I think refers to the Security Center.  There is an option on it to not monitor your Antivirus (to make sure it is running/uptodate)  and I think that's what it is complaining about.  If you open the security center you should see the option to check or uncheck.  (I'm on a Win2K box and don't have it or I'd be more specific.)    Ad-aware found MRU list.  MRU list is just Most recently Used list.  A list of sites or programs or searches.  Windows keep track of several different lists and I suppose Ad_Aware wants to clean them so no one can see where you have been or what programs you have run.  Sort of a privacy issue for paranoids.   Again nothing to worry about.   Start, Run, services.msc, OK then Look for  Application Layer Gateway (ALG) Service  and doubleclick on it.  Change the Startup type to Automatic, Apply then attempt to Start the service.  Does it Start?   If you get ALG to start then try starting the Firewall.   Ron

abhurst1 · Answer

hey ron i did the things you told me, and my firewall still wont come on, also i tried to do a system restore and nothin would restore and i tried a few different dates. Whats next on my list to do?

thanks

Ashley

RKinner · Answer

Start, Run, cmd, OK to bring up a new black cmd screen. Type (with an Enter after each bold line)

netsh firewall start

If it tells you there is no such service then it's gone from the registry and we either uninstall and reinstall sp2 or we get the registry entries from a friend's computer or we download a better firewall.

I vote for the last option. Zone Alarm's free firewall is better than XPs anyway since it works in both directions.

http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads

decline any free trials.

If you insist on trying to restore the XP firewall I may have time this weekend to get the registry entries off my home PC. Office PC is win2k and doesn't have them.

Ron

abhurst1 · Answer

thanks ron i will do this!

Virus & Spyware

logfile Hijack new need help

Was this post helpful?