Sure...run HijackThis and post your log back here in this same thread. Bookmark the thread so you can refer back to the same thread with each post. Thanks!

With no antivirus scanner on board (or third party firewall)
there is nothing preventing the downloading and installation of malware.
Please select and install one of these free Firewall applications:
ZoneAlarm Free Version
Outpost Free
Kerio

When the installation completes successfully, reboot the computer.

Please select and install One of these free antivirus applications:
AVG Free for Windows
AntiVir Personal Edition Classic
Avast! 4 Home Edition
After successfull installation, please reboot the computer.

Please follow these steps to remove older version Java components

1. Close any open programs you may have running, especially your web
browser.

2. Click Start-->Control Panel-->Add or Remove Programs.
For those just reading this thread:
Depending on your OS, you may have to click Start-->Settings-->Control Panel-->Add or Remove Programs.

3. Click once on any item listing Java Runtime Environment in the name (to highlight it)
then click the "Remove" or "Change/Remove" button.
Not every version of Java will begin with "Java" so be sure
to read each entry in the list.
Repeat step 3 as many times as necessary to remove all versions of Java.
**If you are asked to reboot at any point during the uninstallations, please do so.
Then go back to Add/Remove and continue with the rest of the removals...when finished
uninstalling all of them, reboot the computer.

4. Navigate to and delete:

• C:\Program Files\ Java =this folder if found

5. Then go to this page.
Scroll down to where it says "The J2SE Runtime Environment (JRE)
allows end-users to run Java applications"and click the "Download" button to the right.

6. Check the box that says: "Accept License Agreement" the page will refresh
and click on the link to download Windows Offline Installation with or without Multi-language.
Save it to your desktop.
Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.

Please run HijackThis again and check the following:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=
wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD/YOx16Q+SeXj6 XKN0dkzr5Y9uD4angzbfSTrljcctmJBnLixBxCCyHRDmz6Bch9m8p4EgX2+
7kXW8Xn7Kk2ZWD9by7UeC R3PnLxR05y9XktwokLO4AgRihNZnPbO5YzbpB17nv9RkHM6l2ITTU8dssJ0Qm1U+BYZCfYLxeNDjgXC6
GSFM1jTQoizTyAc+tTqIbLxkHuuYAM=
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} -
http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstall er.exe
Close all windows except for HijackThis then click Fix Checked.

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select
Show hidden files and folders.
* Uncheck the Hide protected operating system files
(recommended) option.
* Click Yes to confirm.
* Click OK.

Next, "navigate to" this file path (don't do a search for) and delete the following file
indicated in Bold text:
C:\WINDOWS\ServicePackFiles\i386\ agentsvr.exe

Reboot and post a new HijackThis log. How is the computer running now?
Are you able to open Netscape?

Logfile of HijackThis v1.99.1
Scan saved at 8:21:00 AM, on 9/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\george\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=55245&clcid={SUB_CLCID}
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"); (C:\Documents and Settings\george\Application Data\Mozilla\Profiles\default\9u7s3nug.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"); (C:\Documents and Settings\george\Application Data\Mozilla\Profiles\default\9u7s3nug.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\RunServices: [Cleanup] C:\Program Files\Complete Cleanup\compind.bat
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstaller.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

I sent this early, but see no record, forgive me if this is a duplicate. No luck in getting Netscape to run, same quick flash of the logo when I attempt to enter.

Quite often, problems with software are remedied by uninstalling and reinstalling. The log is looking clean now. Try uninstalling your Netscape 7.2 and download a fresh copy.
Please post back your results. Thanks!

The new download of Netscape 7.2 did not correct the problem. Prior to seeking your help I uninstalled my Netscape 7.2, reinstalled a new copy with no success, even download Netscape 8 same problem in using the program. You state the the log looks clean, any further suggestions as to what is causing this problem by eding the registry? Thank you for your help.

Have you run the system without antivirus protection or a firewall since you've had it? Is that a normal practice for you?

Without antivirus real time protection there is nothing preventing the installation of malware. A third party software firewall as well has also been recommended.

Although your log looks clean, given your circumstances, I went back over the entries and found two that could cause problems for a novice user. Although I doubt they could be directly responsible for your current issues, if you can restore any items that those programs removed and reboot we might discover some connection. If not, we can always perform another cleanup that is tried and true.

If you are finished with using the trial version of the Cleanup program please use the add/remove programs function and uninstall it.

The ErrorNuker on line product that you vist can also create problems if the user is not sure of the registry entries being presented for removal.

Do you have your original Windows XP installation CD handy?

Please run HijackThis again and check the following:
O4 - HKLM\..\RunServices: C:\Program Files\Complete Cleanup\compind.bat
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstall er.exe

Close all windows except for HijackThis and click "Fix Checked".

Reboot to properly record the changes to the disk. Post back and let me know if you have your installation CD. Thanks!

The rapid flash from Netscape yet remains




Logfile of HijackThis v1.99.1
Scan saved at 8:21:00 AM, on 9/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0006)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\george\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.netscape.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=54729
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/
fwlink/?LinkId=55245&clcid={SUB_CLCID}
N3 - Netscape 7: user_pref("browser.startup.homepage", "http://home.netscape.com/"; (C:\Documents and Settings\george\Application Data\Mozilla\Profiles\default\9u7s3nug.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com/"; (C:\Documents and Settings\george\Application Data\Mozilla\Profiles\default\9u7s3nug.slt\prefs.js)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\RunServices: [Cleanup] C:\Program Files\Complete Cleanup\compind.bat
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\npjpi150_08.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstaller.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
09-07-2006 07:23 AM


This reply was somehow sent incorrectly to you; it ended up on page one under netscape












Reply
Re: netscape [ NEW ]

Quote:
Have you run the system without antivirus protection or a firewall since you've had it? Is that a normal practice for you?

Without antivirus real time protection there is nothing preventing the installation of malware. A third party software firewall as well has also been recommended.

Although your log looks clean, given your circumstances, I went back over the entries and found two that could cause problems for a novice user. Although I doubt they could be directly responsible for your current issues, if you can restore any items that those programs removed and reboot we might discover some connection. If not, we can always perform another cleanup that is tried and true.

If you are finished with using the trial version of the Cleanup program please use the add/remove programs function and uninstall it.

The ErrorNuker on line product that you vist can also create problems if the user is not sure of the registry entries being presented for removal.

Do you have your original Windows XP installation CD handy?

Please run HijackThis again and check the following:
O4 - HKLM\..\RunServices: C:\Program Files\Complete Cleanup\compind.bat
O16 - DPF: {15589FA1-C456-11CE-BF01-000000000000} - http://www.errornuker.com/products/errn2004/installers/default/ErrorNukerInstall er.exe

Close all windows except for HijackThis and click "Fix Checked".

Reboot to properly record the changes to the disk. Post back and let me know if you have your installation CD. Thanks!


When you posted last, you created a new thread...please bookmark this thread and post all your responses here.

You missed my last post and as of yet have still not addressed any of my questions. There is no need to post any other logs until you install one of the free antivirus scanners and firewall. Without such protection there is absolutely nothing preventing the download and installation of new malware. So, you see, even if we were to find something and attempt to remove it, by the time you post a new log back here without any protection, you may well have more malware in THAT log. It would be equal to taking one step forward and two steps back.

Please reply to the questions I posted last. Thanks!

Yes I have the original Windows XP installation disk
I thought I addressed your questions. I installed both Kerio and Avast and ran both
I checked 04 and 016 and fixed both
I uninstalled the trial version of Cleanup, yet when i go to add/remove in control panel and hit remove trial versin of Cleanup, get the message cannot be removed, does not exist.
I was not aware that I was creating a new thread, like the past communications I entered reply to your questions. How do I preven the creation of a new thread and how do I bookmoare this thread? Thanks