so? how does it look?
Much Better, but you still have a couple of "unwanted guests". try the following and post a fresh log after that:
1. Have HJT fix the following entries: O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL (file missing)
(if you didn't purpously uninstall SpyBot, the above entriy might indicate that SpyBot got corrupted and needs to be reinstalled)
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\SYSTB.DLL
O2 - BHO: PynixObj Class - {00000000-DD60-0064-6EC2-6E0100000000} - C:\WINDOWS\PYNIX.DLL
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [czyuoyp] c:\windows\system\czyuoyp.exe
2. Reboot into safe mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up).
- Open Windows Explorer and navigate to the View menu->Folder Options->View tab.
- In the View options, click "Show all files", and uncheck "Hide file extentions for known file types.
- Click "OK" to close the optiond windows.
- Locate and delete the following 2 files (let us know if you are unable find/delete either of them):
C:\WINDOWS\SYSTB.DLL
C:\WINDOWS\PYNIX.DLL
c:\windows\system\czyuoyp.exe
- Empty your Recycle Bin.
3.Reboot normally, run HJT again, and post a fresh log. Also let us know what problems, if any, you're still experiencing.
4. !!! -> your log shows absolutely no indication of an installed anti-virus program. :eek:
If you don't currently own ant anti-virus software, please download and install the free AVG program from the following link ASAP:
http://free.grisoft.com/freeweb.php/doc/2/
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
http://websearch.drsnsrch.com/sidesearch.cgi?id= is this somthing you use I don't know if its a tool or spyware?
It's a hijack, or the leftovers of a hijack.
mookie5381,
1. Run HijackThis and have it fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: DLMaxObj Class - {00000000-59D4-4008-9058-080011001200} - C:\WINDOWS\DLMAX.DLL
2. It looks like SpyBot got damaged and/or removed somewhere in this process; you should download a fresh copy of the program and reinstall it.
While you're at it, download and install SpywareBlaster and SpywareGuard as well (links are in my sig below). The two programs will give you a good measure of protection against hijackers, etc. which exploit Active X and other security weaknesses in Internet Explorer and Windows.
3. Run HJT again and see if the "websearch" entries return. Let us know if they do.
DMR
Wombat At Large
7,229 posts since Dec 2003
Reputation Points: 221
Solved Threads: 370
