Are you insured? :evil:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Joe\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Joe\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Joe\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {2115755F-B349-4D06-A549-E49EBF0FB5FA} - c:\windows\system32\ajb.dll (file missing)
--------------------------------------------------------------------------
Download and install APM from: http://www.diamondcs.com.au/index.php?page=apm
Close all windows except HijackThis and fix the lines above.
In the upper window of APM select explorer.exe
In the lower window find and rightclick the BHO from the HijackThis log
Select Unload DLL and click OK on the prompts that follow.
Reboot and scan with AdAware to remove the txt and html protocol association.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Try looking for the dll in APM by selecting *iexplore.exe* instead
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
That is a possibility as the 02 entries are generally removed by HJT. The dll we are after though when fixed, usually respawns itself once HJT fixes it.
Can you post a new log after your next reboot.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Please download this tool called About Buster from:
http://www.atribune.org/downloads/AboutBuster.zip
Created by RubberDucky
Unzip it to your desktop but don't run it yet.
Now start Hijackthis and tick the boxes next to these items:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {95BBD8C1-7FCA-4CBF-8DBF-7DF46C2F2CE8} - C:\WINDOWS\System32\nhbla.dll (file missing)
Now close ALL Internet Explorer windows and hit fix checked.
Do not open internet explorer to come back here until after running the tool.
Double click Aboutbuster.exe, click OK, click Start, then click OK. This will scan your computer for the bad files and delete them.
Once the tool is done scanning, copy the log and paste it into your thread.
with a new Hijack this log.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
No problems. If you update CWShredder & run it, it should now take care of this hijack. Nothing like a one button fix :cheesy:
When done, Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = file://C:\DOCUME~1\Joe\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://C:\DOCUME~1\Joe\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = file://C:\DOCUME~1\Joe\LOCALS~1\Temp\sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O4 - HKLM\..\Run: [PCDRealtime] C:\WINDOWS\realtime.exe
Reboot into safe mode following the instructions here & navigate to & delete the following if found:
C:\WINDOWS\realtime.exe< file
Reboot normally after doing the above then post a fresh log please.
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
Looks like it worked. How is the comp??
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
crunchie
Most Valuable Poster
20,095 posts since Feb 2004
Reputation Points: 1,142
Solved Threads: 985
caperjack
I hate 20 Questions
13,069 posts since Aug 2003
Reputation Points: 1,064
Solved Threads: 812
