O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [delete surf rect mapi] C:\Documents and Settings\All Users\Application Data\Blehholddeletesurf\Internet Joy.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\IEExtension.dll
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
ok remember to make system restore points before deleting things with hijackthis.
you might also want to boot into safe mode and delet this file manually:
C:\PROGRA~1\AWS\WEATHE~1\Weather.EXE
mikeandike22
Nearly a Posting Virtuoso
1,496 posts since May 2004
Reputation Points: 33
Solved Threads: 19
AbSat. Please start your own thread after doing the following:
Download & instal Adaware SE from here
& update it before scanning.
In settings under 'scanning,' have it set to
'scan within archives,'
'scan active processes,'
'scan registry,'
'deepscan registry'
'scan my IE Favourites for banned URL's,'
'scan my host's file.'
In 'tweaks' under 'scanning engine' set it to 'unload recognised processes during scanning.'
Also in 'tweaks' under 'cleaning engine' set it to 'Always try to unload Modules before deletion' & 'let Windows remove files in use at next reboot.'
Select 'activate in-depth scan' before starting scan.
When the scan is finished select 'next.'
Remove what it finds by placing a check in the box to the left of the object. Reboot
Download & instal Spybot S&D 1.3 from here. Update it before scanning.
After the scan is complete, have spybot fix everything marked RED.
On the page that first opens when you start Spybot there is an option to immunise, you should do this. In the immunise section there is also a link to download Spywareblaster. This program will prevent the install of bad activex controls that it has knowledge of. Download that & you can keep it updated by selecting the same link that you use to download it. Reboot
Ashwin. Please post another hijackthis log after doing the following:
First of all could you click Start>Settings>Control Panel>Add or Remove Programs and uninstall 'Window Search', 'Window Searching', 'Lop.com', 'LOP SEARCH', 'Browser Enhancer', or 'Ultimate Browser Enhancer' if listed. You may be given a code to insert, do so and reboot when done. If not listed there, run this uninstaller:
http://members.rogers.com/rjmac/new_uninstall.exe
LOP toolbar uninstaller http://members.rogers.com/rjmac/toolbar_uninstall.exe
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
im not seeing anything try closing internet explorer before scanning.
mikeandike22
Nearly a Posting Virtuoso
1,496 posts since May 2004
Reputation Points: 33
Solved Threads: 19
then close the ie process.
mikeandike22
Nearly a Posting Virtuoso
1,496 posts since May 2004
Reputation Points: 33
Solved Threads: 19
I did close ie :( This is with no browser windows open. Like I said, even when i close ie, this ie process remains running
Open Window's Task Manager, select any/all instances of iexplore.exe, and click the "End Task" option for each. If the iexplore references seem to close and then automagically reappear shortly after, let us know; that would indicate something fishy.
Also uninstall WeatherBug if it's the free verision that you're using; it displays ads and installs MySearch/MyWay toolbars which you do not need.
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {ADB22D5B-D9A9-A6B9-EFB1-B3FD099CB71D} - C:\PROGRA~1\CDROMD~1\ooze does.exe
Reboot into safe mode following the instructions here & navigate to & delete the following:
C:\PROGRA~1\CDROMD~1-folder
Reboot normally after doing the above, rescan with hijackthis making certain that all instances of Internet Explorer are closed, then post that log here please.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Whoops- thanks for the catch crunchie, I missed that one... :o
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
Just a bit of housecleaning now :).
Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':
O2 - BHO: F1 Organizer Class - {00000EF1-0786-4633-87C6-1AA7A44296DA} - (no file)
O2 - BHO: brdg Class - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - (no file)
O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - (no file)
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Are the toolbars gone now?
From what I could find, those exact toolbars appear to part of the ad-sponsored component of the Messenger Plus! 3 application. The sponsor component is optional, but you'll have to uninstall Messenger completely and then reinstall it and choose not to include the sponsor component when you do so.
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
Hey, don't feel bad about the N00b bit at all; you actually gave us what we needed to get to the bottom of it.
I never use ad-ons like Messenger Plus or the like, so I actually had to Google around for a solution using some of the category names in the toolbars image you gave us ("make money", "casino", "music", etc.), and that's what led me to the answer.
:)
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
