Virus?

Question

When I log onto my computer this error appears: 'Windows cannot find 'C:\WINDOWS\system32\kernels32.exe. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then Search.'   What do I do to correct this?  My computer seems to run fine after I click ok, but I know something must be wrong for this to keep coming up.  On the software forum, he suggested I come and see if anyone knew anything about this.  He said it may be part of a virus.   Amanda

techguymitch · Answer

hello.
first are you absolutly sure its kernels32.exe that is says. make sure its not kernel32.exe notice the first one has an "s". post back and tell me weather the one you see has an "s" or it was just a typo. thanks

Message Edited by techguymitch on 01-03-2006 10:11 AM

arichardson · Answer

yes there is an s, it says   'C:\WINDOWS\System32\kernels32.exe'

techguymitch · Answer

hello,
ok please go here,
http://www.download.com/HijackThis/3000-8022_4-10379544.html?tag=lst-0-1
and download the latest version of HiJack This. just click download nere the top of the page. if it asks you then save it, not run it.

ok double click the icon that it makes on the desktop it may ask you to unzip it then just follow the prompts untill you can use it.
(or where ever you can run it from) and click "do system scan and save log file" now find the log file and copy/paste it here. and ill be able to help you further.

if this came out to confusing please tell me, sorry if it did. try your best

Message Edited by techguymitch on 01-02-2006 09:44 AM

techguymitch · Answer

also what opperating system do you have. (EXAMPLE WINDOWS XP)

arichardson · Answer

yes, I have windows xp.  I am going to try downloading Hijack this.  Thanks

arichardson · Answer

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Personal Firewall - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [tgcmd] 'C:\Program Files\Support.com\BellSouth\hcenter.exe' /starthidden /tgcmdwrapper O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124405951\ee\AOLHostManager.exe O4 - HKLM\..\Run: [MMTray] 'C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe' O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Norton SystemWorks] 'C:\Program Files\Norton SystemWorks\cfgwiz.exe' /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb029YYUS_ZSYYYYYYYYUS O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst4_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/download/bargain_buddy/cab/installer_MARKETING48.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v48/pool/pool.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10cc5aea299a3607e116/netzip/RdxIE601.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F126} (Sview Control) - https://www.svharbor.com/ereports/downloads/sview/svinstall_a_stat.cab O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - http://www.disney.go.com/games/downloads/gamemanager/DIGGameManager.cab O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup156.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

arichardson · Answer

I hope this is what you want!  I had to do it in different messages.  Too long. Logfile of HijackThis v1.99.1 Scan saved at 12:23:02 PM, on 1/2/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Personal Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\AIM\aim.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe C:\Program Files\Common Files\AOL\1124405951\ee\AOLHostManager.exe C:\Program Files\Common Files\AOL\1124405951\ee\AOLServiceHost.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\WINDOWS\System32\snmp.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Support.com\bin	gcmd.exe C:\Program Files\Common Files\AOL\1124405951\ee\AOLServiceHost.exe C:\WINDOWS\System32\wuauclt.exe C:\Documents and Settings\Amanda\Desktop\hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sp/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL R3 - URLSearchHook: ScriptInocUI Class -  - (no file) F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\System32\kernels32.exe O1 - Hosts: 205.238.40.2 www.winmx.com O1 - Hosts: 205.238.40.2 err.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1302.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3310.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3312.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3313.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3314.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3316.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3317.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3318.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3319.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1304.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1304.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1304.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1304.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1305.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1305.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1305.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1305.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1305.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1305.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1305.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1305.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1305.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1305.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1306.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1306.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1306.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1306.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1306.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1306.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1306.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1306.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1306.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1306.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3529.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1302.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3529.z1302.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1303.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1303.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1303.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1303.winmx.com O1 - Hosts: 212.227.64.159 c3529.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1304.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1304.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1304.winmx.com

techguymitch · Answer

thats perfect just give me a little while and we'll get you fixed right up

techguymitch · Answer

hi. make sure you follow all these instructions
sorry if my addresses dont become links... ive never used this forum
well it looks like youve got some serios problems.
first copy all these directions and print them (if possible) or copy/paste them to a notepad and save because you may not be able to use the internet during then fix

ok first go here http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10399602.html?tag=lst-0-1
and download Adaware SE personal. this is a great program that may solve some issues. open this program and press scan now and then full system scan. put a check mark next to all it finds (if theres too many right click on the box and select "check all" if there are more then 100 entries only delete them 100 at a time or it will cause adaware to freeze.)

then go here http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10401314.html?tag=lst-0-1
and open this program and use it by (after opening) click check for updates. and download all the updates that are available. now go to the search and destroy icon and click check for problems. delete whatever it finds

now go to start -> control panel -> add/remove programs and look for mywebsearch click it and click add/remove and it will be deleted

Go into add/remove program and remove:(IF FOUND)

viewpoint/viewpoint manager

then go to start -> search -> for files and folders -> and search for C:\Program Files\Viewpoint\Viewpoint Manager if found delete it(make sure you searching under my computer or C: drive so that you can search the whole computer instead of the one folder your in)

ok now open hijackthis and click do "system scan only" now check each one of these entries you find (if there)

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\2.bin\MWSSRCAS.DLL

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\2.bin\MWSBAR.DLL

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb029YYUS_ZSYYYYYYYYUS

O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - http://download.bargain-buddy.net/download/bargain_buddy/cab/installer_MARKETING48.cab

O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab

make sure all other windows are closed this is very important (even the one your reading now)and press fix!

now exit out and restart your computer. now go to hijack this and post a brand new log file and we will see how it looks. dont worry if the prob is still there. we'll fix it. GOOD LUCK and post back soon

Message Edited by techguymitch on 01-02-2006 04:18 PM

arichardson · Answer

Okay, here it is!  Can I just delete all these links with winmx.com in them.  I thought I deleted winmx.com.  computer seems to be working better already.  Error is not showing anymore! Logfile of HijackThis v1.99.1 Scan saved at 12:17:04 PM, on 1/3/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Norton Personal Firewall\ISSVC.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\BroadJump\Client Foundation\CFD.exe C:\Program Files\Common Files\Real\Update_OBealsched.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\MUSICM~1\MUSICM~1\MMDiag.exe C:\Program Files\AIM\aim.exe C:\Program Files\Common Files\AOL\1124405951\ee\AOLHostManager.exe C:\Program Files\Common Files\AOL\1124405951\ee\AOLServiceHost.exe C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE C:\Program Files\Common Files\AOL\1124405951\ee\AOLServiceHost.exe C:\WINDOWS\System32\snmp.exe C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\iPod\bin\iPodService.exe C:\Documents and Settings\Amanda\Desktop\hijackthis\HijackThis.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Support.com\bin	gcmd.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ycomp_adbe/defaults/sp/*http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.bellsouth.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R3 - URLSearchHook: ScriptInocUI Class -  - (no file) O1 - Hosts: 205.238.40.2 www.winmx.com O1 - Hosts: 205.238.40.2 err.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1302.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3310.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3312.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3313.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3314.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3316.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3317.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3318.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3319.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1304.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1304.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1304.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1304.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1305.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1305.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1305.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1305.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1305.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1305.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1305.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1305.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1305.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1305.winmx.com O1 - Hosts: 205.238.40.2 c3310.z1306.winmx.com O1 - Hosts: 67.18.233.36 c3311.z1306.winmx.com O1 - Hosts: 82.43.224.20 c3312.z1306.winmx.com O1 - Hosts: 209.67.209.50 c3313.z1306.winmx.com O1 - Hosts: 212.227.64.159 c3314.z1306.winmx.com O1 - Hosts: 205.238.40.2 c3315.z1306.winmx.com O1 - Hosts: 67.18.233.36 c3316.z1306.winmx.com O1 - Hosts: 82.43.224.20 c3317.z1306.winmx.com O1 - Hosts: 209.67.209.50 c3318.z1306.winmx.com O1 - Hosts: 212.227.64.159 c3319.z1306.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1301.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1301.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1301.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1301.winmx.com O1 - Hosts: 212.227.64.159 c3529.z1301.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1302.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1302.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1302.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1302.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1302.winmx.com O1 - Hosts: 212.227.64.159 c3529.z1302.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1303.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1303.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1303.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1303.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1303.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1303.winmx.com O1 - Hosts: 212.227.64.159 c3529.z1303.winmx.com O1 - Hosts: 205.238.40.2 c3520.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3521.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3522.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3523.z1304.winmx.com O1 - Hosts: 212.227.64.159 c3524.z1304.winmx.com O1 - Hosts: 205.238.40.2 c3525.z1304.winmx.com O1 - Hosts: 67.18.233.36 c3526.z1304.winmx.com O1 - Hosts: 82.43.224.20 c3527.z1304.winmx.com O1 - Hosts: 209.67.209.50 c3528.z1304.winmx.com O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Personal Firewall - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe' O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe O4 - HKLM\..\Run: [tgcmd] 'C:\Program Files\Support.com\BellSouth\hcenter.exe' /starthidden /tgcmdwrapper O4 - HKLM\..\Run: [TkBellExe] 'C:\Program Files\Common Files\Real\Update_OBealsched.exe'  -osboot O4 - HKLM\..\Run: [QuickTime Task] 'C:\Program Files\QuickTime\qttask.exe' -atboottime O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [iTunesHelper] 'C:\Program Files\iTunes\iTunesHelper.exe' O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1124405951\ee\AOLHostManager.exe O4 - HKLM\..\Run: [MMTray] 'C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe' O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\Run: [AdaptecDirectCD] 'C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe' O4 - HKCU\..\Run: [MSMSGS] 'C:\Program Files\Messenger\msmsgs.exe' /background O4 - HKCU\..\Run: [Norton SystemWorks] 'C:\Program Files\Norton SystemWorks\cfgwiz.exe' /GUID {05858CFD-5CC4-4ceb-AAAF-CF00BF39736A} /MODE CfgWiz O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_01\bin
pjpi150_01.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab O16 - DPF: Yahoo! MahJong Solitaire - http://download.games.yahoo.com/games/clients/y/mjst4_x.cab O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinner.com/games/v48/pool/pool.cab O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/10cc5aea299a3607e116/netzip/RdxIE601.cab O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F126} (Sview Control) - https://www.svharbor.com/ereports/downloads/sview/svinstall_a_stat.cab O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - http://www.disney.go.com/games/downloads/gamemanager/DIGGameManager.cab O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup156.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ISSVC.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus
avapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\NPROTECT.EXE O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~1\SPEEDD~1\NOPDB.EXE O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

techguymitch · Answer

ok well your looking pretty clean.! lets talk about preventing this from happening again.
-first did you pay for any antivirus because i see you have norten. now there are programs that are so much better then norten. such as adaware se and spybot search and destroy. i want you to use these programs often and keep them updated so that you can beat this spyware yourself :)

ill be back in a few hours and ill finish you up, you may not even read this till then but just answer that. also go to ccleaner.com (with 2 c's) and download the ccleaner program. install and use it. it will get rid of excess stuff your computer doesnt need. but it will log you out of your websites you may be in. and youll have to retype your name/password to do things over. so its optional. it just cleans up info you dont truely need. well your looking good and i have a few more programs to keep you clean but ill givem too ya in a few hours... dont just run away yet
,thanks

arichardson · Answer

Okay, I went and downloaded ccleaner. I ran it. Yes, I did buy Norton AntiVirus and a personal firewall. So much for all that! What about deleting winmx links in the log that was created?
Thanks so much for all your help.

techguymitch · Answer

hmmm. about the winmx. well im not the best with these host files. if you know you dont need them then ok. i would do it with caution. there is no such site as winmx.com so that makes me uncertain. maybe do a few at first and if nothing it changed then a few more and then all. but they dont seem to be making a problem, that i know of. ok well aside from that.

please go here: http://majorgeeks.com/ZoneAlarm_Free_d388.html and download ZoneAlarm. this would be your best bet, using adaware and spybot which i gave you earlier and using the zonealarm firewall (a very high rated and FREE firewall) will keep you pc clean. also i would disable or uninstall norten because im my oppinion is a waste of money. and also can interact with adaware. causing it to have fake results (but dont worry about this its rare)

-i would also reccomend downloading this. http://majorgeeks.com/download2859.html
its a program called spyware blaster. it does not let spyware come onto your pc. it will ask to change you browser settings (likely) and will keep you safe. download this before ZoneAlarm unless its too late.haha.

ok well i believe your all cleaned up. grab that zonealarm and spyware blaster and use the adaware and spybot regularly.
well good luck staying clean and your all set!!
(if something happens when you delete the hosts file just write back here)

all clean
-mitchman-

arichardson · Answer

okay, I think I have everything I need.  Thank you so much for all your help!!!!!  If I ever have anymore problems I am coming back to you.  You have been great.

techguymitch · Answer

your very welcome :) so what was the result of deleting those host files? just curious. i think your browser will make new ones but not that many, so what happened -mitchman-

Virus & Spyware

Was this post helpful?