IE7 opens/closes immediately, firefox crashes in 10 mins.

  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Hello all,

I am brand new to this site and have been reading how helpful everyone is one here and hope you can help me. I've read a previous post on this same problem and attempted to follow the instructions given there. However, upon running hijack this and creating a log, none of the files that post stated to check appeared in mine, leaving me lost once again. Upon opening Internet Explore 7, it immediately crashes. Firefox, which I normally use, has been crashing after ten or fifteen minutes of use. As the previous post stated, I ran TrendMicro Housecall through Firefox. I had to do this twice as the first time it stated that there were two malware programs on my computer but that it could not fix either of them. Firefox crashed before I could write the info down. One was located in C:\Documents and Settings\All Users\Application Data\Microsoft\ipdll.dll. The other was located in C:\WINDOWS.... and from there I lost it. Out of curiosity I deleted that ipdll.dll file from the listed location and I can run Explorer it seems now, but I'm unsure of exactly what I may have messed up deleting that file. Attached is my Hijack This log. I would greatly appreciate any help! Thanks!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:25:14 PM, on 1/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svch?st.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\hphmon03.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\HPHipm09.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\RTHDCPL.EXE
c:\windows\system\hpsysdrv.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 566828 helper - {220A105A-16EE-44C1-A4C8-AD76C709FC1D} - (no file)
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: D - {A308EDE0-CA12-3BFE-8B46-C8794F1B9462} - C:\WINDOWS\system32\xsl97935.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [HPHUPD08] "c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [svchost.exe] C:\WINDOWS\system32\svch?st.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1\Content.IE5\BRPHDDXE c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1\Content.IE5\812FCHI7 c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1\Content.SH! c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\APP_1_~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\DC_2_~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\DWB8C5~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\XUFS9YFN\DW_PAS~3.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\NO_CON~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\XUFS9YFN\DW_PAS~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\FJC1HTOM\INDEX_~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\W1AFH17H\313837~3.SH! c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1.SH!\Content.SH!\BRPHDDXE c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1.SH!\Content.SH!\812FCH
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by111fd.bay111.hotmail.msn.com/a ... Atchmt.ocx
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c95c9dfa95240e) (gupdate1c95c9dfa95240e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

--
End of file - 12209 bytes
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: D - {A308EDE0-CA12-3BFE-8B46-C8794F1B9462} - C:\WINDOWS\system32\xsl97935.dll

O4 - HKLM\..\Run: [svchost.exe] C:\WINDOWS\system32\svch?st.exe


Delete those 3 things and empty your temporary internet files.

I don't know what temp internet files would show as running processes. If they still show on the next scan, delete them using Hijack This.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

cool thanks a lot!
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

OK Don, did as you advised, upon trying to open up IE, I receive this message: Windows cannot find C:\Program Files\Internet Explorer\iexplore.exe. Going through windows explorer, that shortcut is listed at that location, but will not work. I tried reinstalling IE7, but receive that same error message. Also, while using Firefox, during typing this reply actually, McAfee pops up and gives me this message: About this Trojan
Detected: Exploit-MhtRedir.gen (Trojan)
Location: C:\Documents and Settings\HP_Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\1htzowkl.default\Cache\43AD3A6Cd01

This has been happening everytime I open Firefox since my troubles began. Any further advice??
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Click start, run, type iexplore.exe and press enter. That should start Internet Explorer. If it does, delete the current shortcut, search for iexplore and create a new shortcut.


If McAfee found a trojan, why can't it get rid of it? Open the C: drive, follow the path to the cache folder and delete it. The open Firefox, go to tools, options, privacy, clear private data and cookies.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

I'm curious as to why McAfee can't delete it either. I've never had any problem with it before. I hated Norton and decided to try McAfee, have been using it for over a year now with this being my first issue. It has been locating the trojan in Firefox, and deleting it every time Firefox opens. The problem is it kept reappearing. Let me go through your steps here and I'll keep you posted. I apologize for the delay, I'm working nights this month. Greatly appreciate your time!
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Crap, says windows cannot locate iexplore.exe.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

The night crew is the best crew. I worked nights (really evenings) for 23 years.

What happens if you use the search box to find IE?
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

I'm a police officer, we rotate monthly. Anything but day shift!!
I tried to search for it too. It showed up in a few different places, none of which produced any different result. I'm clueless now with the IE problem. Firefox is running fine and without that Trojan popping up. Perhaps McAfee finally did what it's supposed to. Any other suggestions for IE??
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Also, just FYI, here's the most recent Hijack This log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:36:01 PM, on 1/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svch?st.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\hphmon03.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\WINDOWS\system32\HPHipm09.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\WINDOWS\RTHDCPL.EXE
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: 566828 helper - {220A105A-16EE-44C1-A4C8-AD76C709FC1D} - (no file)
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [HPHUPD08] "c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe"
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DelayShred] c:\PROGRA~1\mcafee\mshr\ShrCL.EXE /P7 /q c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1\Content.IE5\BRPHDDXE c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1\Content.IE5\812FCHI7 c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1\Content.SH! c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\APP_1_~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\DC_2_~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\DWB8C5~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\XUFS9YFN\DW_PAS~3.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\IRC8SRAW\NO_CON~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\XUFS9YFN\DW_PAS~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\FJC1HTOM\INDEX_~1.SH! C:\DOCUME~1\HP_ADM~1\LOCALS~1\TEMPOR~1\Content.IE5\W1AFH17H\313837~3.SH! c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1.SH!\Content.SH!\BRPHDDXE c:\DOCUME~1\HP_ADM~1\LOCALS~1\temp\TEMPOR~1.SH!\Content.SH!\812FCH
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-21-1624798220-258453055-3296090724-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech SetPoint.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\9972322\Program\Updates from HP.exe
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by111fd.bay111.hotmail.msn.com/a ... Atchmt.ocx
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Update Service (gupdate1c95c9dfa95240e) (gupdate1c95c9dfa95240e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

--
End of file - 11883 bytes
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

That log looks ok, but let me make a suggestion. You have Google Toolbar. Do you really need Comcast Toolbar too? Toolbars are not secure.

IE maybe totally gone but since you have FF, go to http://www.malwarebytes.org Download, update and run, anti malware.

It will give you a report similar to Hijack. Fix the problems the same way. If IE still doesn't appear, try to download it again. Try version 7 first. I that doesn't work, try 6.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

You are the man, Thanks!
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

You're welcome.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

OK, ran anti-malware which fixed several issues. Here is the log, just for ya to look at to see what you think.

Malwarebytes' Anti-Malware 1.32
Database version: 1625
Windows 5.1.2600 Service Pack 3

1/7/2009 7:19:24 AM
mbam-log-2009-01-07 (07-19-15).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 182882
Time elapsed: 1 hour(s), 16 minute(s), 24 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 3
Registry Data Items Infected: 2
Folders Infected: 1
Files Infected: 10

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{220a105a-16ee-44c1-a4c8-ad76c709fc1d} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\searchmigrateddefaulturl (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://internetsearchservice.com/search?q=%s) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://internetsearchservice.com/search?q={searchTerms}) Good: (http://www.google.com/) -> No action taken.

Folders Infected:
C:\WINDOWS\system32\566828 (Trojan.BHO) -> No action taken.

Files Infected:
C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelNE.exe (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelQC.exe (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelqx.exe (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelSlnchr.exe (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\TheWeatherChannelUpdate.exe (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\WiseInstallUtility.dll (Adware.Hotbar) -> No action taken.
C:\Program Files\The Weather Channel FW\Framework\wxfw.dll (Adware.Hotbar) -> No action taken.
C:\System Volume Information\_restore{106CF321-99A3-4E3A-9103-1BD027606A99}\RP858\A0190381.exe (Rogue.Installer) -> No action taken.
C:\Program Files\Common Files\AvBAG11jkrx.exe (Trojan.FakeAlert) -> No action taken.


I haven't messed with retrying IE yet but I'll keep ya posted.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

I completely deleted the weather channel program, i hated it anyway. deleted it from the C:\Program Files location because the uninstall option was corrupted. Can I have anti-malware delete the remaining items without any problems? Right now it just has them quarantined, I haven't proceeded with deleting them until I know what would happen.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Deleting the weather channel program shouldn't cause any problems. I would try it.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

What are the remaining items in that log? Can I rid of them as well?
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Which remaining items?
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

These remaining files anti malware located on its sweep, the others were the weather channel files which I'd already deleted. I'm not quite sure what these files are and what I could screw up by ridding of them:
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{220a105a-16ee-44c1-a4c8-ad76c709fc1d} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Weather Services (Adware.Hotbar) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\searchmigrateddefaulturl (Trojan.Zlob) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\Cpls\wxfw.dll (Adware.Hotbar) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\w\ (Hijack.Search) -> Bad: (http://internetsearchservice.com/search?q=%s) Good: (http://www.google.com/) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Hijack.Search) -> Bad: (http://internetsearchservice.com/search?q={searchTerms}) Good: (http://www.google.com/) -> No action taken.

Folders Infected:
C:\WINDOWS\system32\566828 (Trojan.BHO) -> No action taken.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Yes, they have to go too.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

OK cool. I greatly appreciate all your help, you have no idea!
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Don, if you won't shoot me for asking another question, I've been having problems deleting old, unused shortcuts from my programs list in the start menu. The programs have been removed but the shortcuts remain. And I cannot click and drag the shortcuts to place them in order any more either. Any idea on that one??
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

You can ask all the questions you want. Try Unlocker. It's a free program. What error message are you getting?
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

No error messages, just the inability to remove or relocate shortcuts in the program menu.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

What antivirus protection do you recommend? I was doing fine with Mc until this mess. And I won't even get into Norton...
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

I don't recommend any Anti Virus. I think they are worthless. There is too much of a time lag between the day a virus is released into the wild and the day AV companies add it to their dat files. During that time, thousands of PCs are infected.

I prefer to lock my registry with MJ Registry Watcher.
http://www.jacobsm.com/mjsoft.htm
If you click on an attachment, which you should never do unless you requested it, the changes in the registry will be rejected, stopping the install.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Cool, I'll try that and see how it works for me.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

LOL, wow Don, the more cool programs you give me to play with, the more questions I have! Installed unlocker and was playing with it a little. It's not helping me in removing unwanted/unused shortcuts in the programs menu, but when I right click the start button and click unlock, it brings up three processes: 2 Explorer.EXE's and my Reg Watcher. Why 2 Explorers? That is what keeps windows open correct? But I can't figure out two of them? It says the path locked for one is C:\Documents and Settings\HP_Administrator\Start Menu\Programs for the first and C:\Documents and Settings\HP_Administrator\Start Menu for the second. But both process paths are C:\WINDOWS\Explorer.EXE. I'm lost once again? Could this be and IE problem?? I didn't hit unlock or any other option due to being unsure of the results.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

First of all, you can't uninstall programs or make changes that involve the registry if Reg Watcher is set on reject. Set it to accept, then try it. If you still can't get delete certain things and it's bringing up explorer, it could be that it's running and has to be stopped first. I don't see why that would happen with a shortcut but who knows? Click start, run, type msconfig, press enter and go to the startup tab. Most of that stuff doesn't need to load at boot time and can be unchecked. Uncheck what you don't need to load, click apply and reboot. Click ok on the dialog box and try to delete those things again. If you still can't get rid of them, you might have to do it from the administrator's account.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

OK, I've made some changes to the startup tab, which I'd done before, but needed to redo again. I still can't alter Programs in the Start Menu. How do I do it from the admin account?
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Hey Don, I found the issue with moving shortcuts and why I didn't receive anything on right click while in the Programs menu. Somehow, the Enable Drap and Drop option was deselected in the Customize Start Menu\Advanced tab. Changed that back and I can do as I please with my start menu. Now if Internet Explorer could be fixed as easily...
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Well, out of curiosity, I tried reverting back to IE 6. Upon attempting to install, it said a newer version (7) already exists and cannot continue. So, downloaded and tried intalling the IE 8 Beta version just to see if it'd work. No such luck damn it. Still getting the same message. In looking through windows explorer in C:\WINDOWS, there are folders for both ie7 and ie8. I tried both explorer.exe shortcuts there, both with no success and the same error message that it can't locate them. What would it do if I completely deleted the C:\Program Files\Internet Explorer, C:\WINDOWS\ie7 and ie8 altogether? Would that mess up anything with the overall performance of the computer, with shared files and all?? And, if that worked, completely reinstall IE from scratch?
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

If you delete all traces of IE, you can start over. You should be able to install IE6.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Well, it allowed me to delete the ie7 and ie8 folders under WINDOWS, but it won't allow me to delete the Internet Explorer folder in Programs. It says something is using it.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

annoyed...
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

What about Unlocker? Did you forget you had it already? Otherwise, search for and delete IE in the registry.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

But what programs will it harm in removing it completely before the reinstall? Will it interfere with Windows at all?
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

I don't think it will harm any programs.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

I tried deleting Internet Explorer from the Program Files directory and it said that programs were using it, to close those programs and try again. That automatically opened Unlocker. The Unlocker window says that winlogon.exe is using files C:\Program Files\Internet Explorer and C:\Program Files\Internet Explorer\Connection Wizard. Upon closing both of those, Windows immediately shuts down and the computer restarts. Any other ideas we could try?
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Yes, start run, type regedit, press enter, click edit and find. Do a few searches. One for ieplore.exe After it finds an entry, delete it and press F3. Keep doing that until it finds all entries.

Then search for internet and do the same thing. Don't get confused and delete explorer.exe because explorer and internet explorer are not the same thing.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

OK, went through all those. sometimes it brought up stuff that had no hint of internet, ie, iexplore.exe, etc in the file names. I didn't delete those. Should I?
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Only delete what's related to IE.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Similar to iexplore.exe in Program Files, some of the items recreate themselves and I find myself deleting them over and over from the same place. I knew I hated IE for some reason...
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

If you delete something from the registry, I don't see how it reappears.
  • grinch2171
  • Moderator
  • Genius
  • User avatar
  • Posts: 6819
  • Loc: Martinsburg, WV

Post 3+ Months Ago

You cannot completely uninstall Internet Explorer. IE is embedded in the OS.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

He wants to get rid of enough of it so he can install IE6.
  • grinch2171
  • Moderator
  • Genius
  • User avatar
  • Posts: 6819
  • Loc: Martinsburg, WV

Post 3+ Months Ago

That is all fine and dandy but you cannot remove IE. It just isn't possible without some kind of third party app that I would be leery of using. It is possible to rid yourself of IE during install using a program called nlite (XP) or vlite (Vista) to create a custom install disk.

It appears at one time Microsoft had a KB on how to remove IE6 but it seems to have disappeared. I did find this though:
Quote:
Open C:\Program files\Internet Explorer.
Right click the folder Uninstall information.
Click Properties
Uncheck the hidden mode and press OK.
Go to C:\Program files\Internet Explorer\Setup.
Run setup.exe


I have no idea if it will work or not.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Do you know the password for the administrator account? If not, reset it.
start run compmgmt.msc, local users and groups, users, highlight administrator, action, set password.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

OK, thanks guys, let me mess with it a little more. Grinch, you're in Martinsburg??
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Grinch, I don't have that uninstall folder in Program Files\Internet Explorer. Don, I know my password for the Admin account.
  • Don2007
  • Web Master
  • Web Master
  • Don2007
  • Posts: 4923
  • Loc: NY

Post 3+ Months Ago

Login as admin if your account is restricting you.
  • Bogey
  • Genius
  • Genius
  • Bogey
  • Posts: 8488
  • Loc: USA

Post 3+ Months Ago

I don't know if this would be helpful but there's XPLITE that is created to remove IE from an already installed OS... so you wouldn't have to reinstall.

Also, can't you go to Control Panel and Add/Remove Programs and remove IE7 from there?

You'll still have the IE, but you'll be able to install any other version that you like over it.
  • grinch2171
  • Moderator
  • Genius
  • User avatar
  • Posts: 6819
  • Loc: Martinsburg, WV

Post 3+ Months Ago

tad2lo wrote:
OK, thanks guys, let me mess with it a little more. Grinch, you're in Martinsburg??


No, I just like putting random cities in my profile. :wink:

I live a stones throw away from the Wal-Mart by the mall.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

Bogey wrote:
I don't know if this would be helpful but there's XPLITE that is created to remove IE from an already installed OS... so you wouldn't have to reinstall.

Also, can't you go to Control Panel and Add/Remove Programs and remove IE7 from there?

You'll still have the IE, but you'll be able to install any other version that you like over it.



It won't let me uninstall it from there. It just appears in the list.
  • tad2lo
  • Novice
  • Novice
  • tad2lo
  • Posts: 31
  • Loc: Martinsburg, WV

Post 3+ Months Ago

No, I just like putting random cities in my profile. :wink:

I live a stones throw away from the Wal-Mart by the mall.[/quote]

Lol, ok ok... I asked for that! I've downloaded the xplite thing, now what exactly should I do with it?

Post Information

  • Total Posts in this topic: 55 posts
  • Users browsing this forum: No registered users and 24 guests
  • You cannot post new topics in this forum
  • You cannot reply to topics in this forum
  • You cannot edit your posts in this forum
  • You cannot delete your posts in this forum
  • You cannot post attachments in this forum
 
 

© 1998-2016. Ozzu® is a registered trademark of Unmelted, LLC.