Member Avatar for upfronth

I recently had Skybot installed but now it has stopped working. I have tried to reload again but i get the message "A connection with the server could not be established".

I am not a computer genius but i would really love to have Skybot back as i keep getting pop ups. Also, i am unable to download from microsoft!!

Thanking someone in advance.....

I have included my Hijack this file:-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:28:36, on 08/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) -
O17 - HKLM\System\CCS\Services\Tcpip\..\{88A96362-9C28-4080-8170-98B69E6B370C}: NameServer = ,
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = ,
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = ,
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = ,
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

--
End of file - 6033 bytes

Also, i unable to do a system restore and unable to set up a new restore date!!

  • 2 Contributors
  • 1 Reply
  • 333 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by jholland1964

Dani AI

Generated

Short expert summary and next steps (building on )

The symptoms described plus the HijackThis output point to a network-redirect/spyware infection that is blocking legitimate downloads, disabling restore functionality and installing unwanted browser hooks. Running two realtime AV products at once can complicate detection and removal; removing the unnecessary/expired product first reduces conflicts and makes scans more reliable.

Practical cleanup workflow (in order)

  • Isolate the PC from the Internet (unplug or disable networking) to stop further redirection and data leakage.
  • From a known-clean computer, download up-to-date removal tools onto removable media (Malwarebytes Anti-Malware, an on-demand scanner such as ESET Online Scanner, and a reputable rootkit/bootkit tool). Transfer them and run them on the affected machine in Safe Mode (Safe Mode without networking if the machine must be isolated).
  • Uninstall the redundant antivirus product using Add/Remove Programs (or the vendor removal tool) before running full malware scans. Avoid running two realtime engines at the same time.

Network and system repairs to run after cleaning

  • Check and restore DNS and proxy settings (set TCP/IP to obtain DNS automatically or use a known-good DNS). Verify IE -> Internet Options -> Connections -> LAN Settings that no unwanted proxy is set. Inspect the hosts file for suspicious entries.
  • Reset the network stack and clear DNS cache with these commands from an elevated command prompt, then reboot:
netsh winsock reset
ipconfig /flushdns

Restore points and final steps

  • Many infections corrupt restore points; after removing malware, re-enable System Restore and create a fresh manual restore point. If System Restore remains unusable or the system still behaves badly, back up personal data and consider a clean OS reinstall.
  • A new HijackThis log plus scan reports from Malwarebytes/ESET are normally used by helpers to confirm cleanup and recommend any targeted removals. Avoid powerful automated tools (ComboFix, etc.) unless advised by an experienced responder.
Member Avatar for jholland1964

First of all when you say Skybot I hope I am safe to assume that you mean SPYBOT Though if you actually mean SKYBOT my browser and firewall would not allow connection to the links given for the one link I found. The other references gave me links to information for a Skype Chat Box, though no links for a download.
So I am not certain which program you are talking about.
You HJT log shows you are running TWO anti-virus programs AVG 7 and Avast. AVG 7 would be expired for sure so it should be totally UNINSTALLED.
I am not certain either where you are located but the TCPIP listings in your HJT log point to the Ukraine. Is that where you are?
I would recommend you begin with the steps given HERE, paying close attention to the notation about Deckard Scanner which is no longer available so when you get to that final step make it a NEW Full System scan with HiJackThis.
Post back here with the MBA-M log, the ESET Scanner log and the new HJT log.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.