Hi derekbka, welcome to DaniWeb :)
I've split your post (from http://www.daniweb.com/techtalkforums/thread22827.html ) into it's own thread so you can get individual attention and so the recommended fixes don't get confused.
Get the Pocket Killbox from here:
http://bleepingcomputer.com/files/spyware/KillBox.zip
Unzip the file to your desktop.
Go offline until this is completed.
Boot into Safe Mode and do a search for these files:
guninst.exe
popup_bl.dll
systr.dll
svrhost.exe
Delete any found, and then find param32.dll
Run Pocket Killbox and paste the full file path of param32.dll in the box and click on Delete on Reboot. Click on the button with the red circle and an X in the middle; you will get a message saying File will be deleted on next reboot, Process and Reboot now? Click Yes to reboot. (Note: the 'file path' will be something like C:\WINDOWS\System32\param32.dll)
Delete any unwanted icons from your desktop.
Empty your Recycle Bin.
Before you fix anything with HijackThis, you need to move it from the Temp folder it is in to it's own permanent folder (like c:\HJT\hijackthis.exe).
After you followed these steps, close any open browser windows, scan with hijackthis, and post a new log please.
dlh6213
Posting Maven
3,117 posts since Jul 2004
Reputation Points: 63
Solved Threads: 214
Any reason you have 3 anti virus's running? There is every chance that they are conflicting with each other, causing problems with your PC. You need to have one as an on access monitor and the others as on demand. In other words, just have one starting up at startup.
===============
Run HiJackThis and click "Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.xdsgbjgovigyo.uk/Ko_mKly.../P8g0BfnLE.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch.com/ie.aspx?tb_id=50162
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = res://C:\ARQUIV~1\Toolbar\toolbar.dll/sa
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
R3 - Default URLSearchHook is missing
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
Now, with all windows closed except HiJackThis, click "Fix checked".
===============
Locate and delete the following item(s), if present. Make sure your able to " view system and hidden files/ folders: "
folders...
C:\ARQUIV~1\Toolbar
files...
C:\WINDOWS\SYSTEM32\drct16.dll
-
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in " Safe Mode ".
-
Reboot.
===============
After rebooting your PC, post back a new log and let me know how everything goes.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Try uninstalling Norton in normal mode. You may have to use the instal CD if you have it.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
