please help me with my windows xp

Question

boogy 0 Light Poster

22 Years Ago

everytime i go to search i get a page back that says page cannot be displayed...
what can i do to fix it???

microsoft:windows-nt-2000-xp virus-malware

4 Contributors
30 Replies
589 Views
5 Days Discussion Span
Latest Post 22 Years Ago Latest Post by david@mex

Dani AI

Generated 10 Months Ago

Symptoms in this thread point to two related issues: intermittent "page cannot be displayed" errors when doing searches, and repeated alerts naming a Trojan found inside a System Restore snapshot. Advice already posted by (check for browser hijacks) and (be careful about infected restore points) is on target; the following supplements that guidance with practical, low-risk steps to remove stale detections and restore normal web access.

Immediate containment and restore-point cleanup

Isolate the machine from the network (disable the NIC or unplug the cable) and make a file-only backup of personal data to external media before making changes.
Remove old/tainted restore points without erasing the installation: run Disk Cleanup for the system drive (My Computer -> right-click C: -> Properties -> Disk Cleanup -> More Options) and use the System Restore cleanup to discard old snapshots. Alternatively, temporarily disable System Restore, reboot, then re-enable it so only clean restore points are kept. This clears infections trapped inside System Volume Information that on-demand scanners will repeatedly flag.

Malware and configuration checks

Run updated on-demand anti-malware and anti-virus scans while in Safe Mode (no networking if possible). Use multiple, reputable scanners to reduce the chance of a missed infection or a false positive. Remove any clearly unwanted download managers or toolbars that are not needed.
Check for persistent browser hijack indicators (proxy settings, host-file entries, and startup programs) before re-enabling normal operation.

Network and browser troubleshooting

Confirm there is no proxy set in the browser and that TCP/IP is using valid DNS servers. Common quick repairs:
```
ipconfig /flushdns
netsh winsock reset
```
(requires administrative prompt and a reboot). Also clear temporary Internet files and restore the browser's advanced settings to defaults if available.

Final notes
After the system is demonstrably clean, re-enable System Restore and create a fresh restore point. Keep AV/antimalware signatures current and apply OS/browser updates to reduce reinfection risk. A fresh diagnostic log (generated after the cleanup) will make further analysis straightforward if problems persist.

All 30 Replies

DMR 152 Wombat At Large

22 Years Ago

You could be infected by hijackware/spyware/etc., especially if you use Internet Exploder as your Web browser. If this only happens when you search, but not in normal browsing, this could very well be the case.

Do you get the error if you just type a URL into your location bar, click on a Favorites link, etc.?

DMR 152 Wombat At Large

22 Years Ago

Yeah, I'd give your system a look-over for "unwanted guests" before you do anything else.

Do the following so that we see if this really an issue of being infected:

Download HijackThis from here & unzip it into it's own permanent folder (not into a temporary/temp directory, and not directly into your C:\ directory or your desktop ). Creating a folder such as C:\hijackthis or C:\downloads\hijack this will be fine.

Start HJT & with all browser windows closed, press the scan button. When the scan is finished the scan button will change to save. Save the log to a text file, copy the entire contents of the text file & paste it into the body of your post. DO NOT FIX ANYTHING YET. Most of what is there is harmless & even necessary to the running of your system.

DMR 152 Wombat At Large

22 Years Ago

1. Download and run and SpyBot; let them fix whatever nasties they find.

2. Do the same with CWShredder. You can get CWShredder from the guy who makes HJT.

If they don't fix the problem, run HJT again and post a fresh log.

caperjack 875 I hate 20 Questions

22 Years Ago

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =

O4 - HKLM\..\Run: [btcnlrgo] C:\WINDOWS\System32\btcnlrgo.exe

O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1

Now reboot into safe mode and delete the following files and folders if found .
C:\WINDOWS\System32\btcnlrgo.exe... delete file

C:\PROGRA~1\AWS\WEATHE~1\Weather.exe ...delete file

to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

caperjack 875 I hate 20 Questions

22 Years Ago

OKIE DOKIE I did every virus scan I could do... No virus's.....
I still keep getting a box that says I have a virus called trojan horse downloader comet B... What could that be?????

If you followed my instruction ,the last part was to post a fresh hijacklog .!!please do so .thanks.
Also Trojans are not viruses so you need a trojan scanner to find them ,You can get a demo one here .

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

boogy 0 Light Poster · Answer 1 · 2004-05-27T01:27:27+00:00

it happens usally when i go to search up something...well earlier it did it on my favorites list also
any ideas on how to make it stop???
thank you sooooooooo much

boogy 0 Light Poster · Answer 2 · 2004-05-28T01:02:01+00:00

okie dokie I shall go do that in the next hour and I will reply with a post
thanks for your help
let me know after you read my HJT report...ok? thanks a lot for everything
Kristi

boogy 0 Light Poster · Answer 3 · 2004-05-28T01:07:17+00:00

Logfile of HijackThis v1.97.7
Scan saved at 2:11:10 PM, on 5/27/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\aim\aim.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\BigFix\BigFix.exe
C:\PROGRA~1\Grisoft\AVG6\AVGCC32.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\System32\btcnlrgo.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\kristi philpott\My Documents\Downloads\Programs\HijackThis_3.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [btcnlrgo] C:\WINDOWS\System32\btcnlrgo.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB827CF-AF60-416C-B2D2-9353C945DFBB}: NameServer =

boogy 0 Light Poster · Answer 4 · 2004-05-28T06:15:26+00:00

ok i put my HJR on here.... Its right before this message..
thanks

boogy 0 Light Poster · Answer 5 · 2004-05-30T18:46:03+00:00

OKIE DOKIE I did every virus scan I could do... No virus's.....
I still keep getting a box that says I have a virus called trojan horse downloader comet B... What could that be?????

boogy 0 Light Poster · Answer 6 · 2004-05-30T21:10:25+00:00

oops....I am so sorry I forgot to include it with my post...lol
hold on i will post it in 5 minutes...
again i am sorry

boogy 0 Light Poster · Answer 7 · 2004-05-30T21:17:31+00:00

heres my new HJT log...
thanks.....Logfile of HijackThis v1.97.7
Scan saved at 10:20:23 AM, on 5/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\btcnlrgo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\aim\aim.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\kristi philpott\My Documents\Downloads\Programs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [btcnlrgo] C:\WINDOWS\System32\btcnlrgo.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB827CF-AF60-416C-B2D2-9353C945DFBB}: NameServer =

boogy 0 Light Poster · Answer 8 · 2004-05-30T21:37:18+00:00

heres the new HJT log after I removed what it said in an earlier post....
Logfile of HijackThis v1.97.7
Scan saved at 10:30:50 AM, on 5/30/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\btcnlrgo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Yahoo!\Messenger\ypager.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\Program Files\aim\aim.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\America Online 9.0\aoltray.exe
C:\Program Files\BigFix\BigFix.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\kristi philpott\My Documents\Downloads\Programs\HijackThis.exe

O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_12_0.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\Run: [XoftSpy] C:\Program Files\XoftSpy\XoftSpy.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [AIM] C:\Program Files\aim\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM)
O9 - Extra button: ICQ (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O9 - Extra button: AOL Instant Messenger (SM) (HKLM)
O9 - Extra button: Real.com (HKLM)
O9 - Extra button: MoneySide (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Windows Messenger (HKLM)
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\idmmbc.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) -
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) -
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5DB827CF-AF60-416C-B2D2-9353C945DFBB}: NameServer =

boogy 0 Light Poster · Answer 9 · 2004-05-30T22:15:57+00:00

oh ps... heres the box that pops up atleast 20 times a day... I also ran the torjan finder thing and it says no trojans were found
but heres what the box says...
C:\SystemVolumeInformation\-restore{1DF014E9-2A7G4277-BD8A-14E12CE58FD5}\RP85\A0024173.dll
IT says... TROJAN HORSEDOWNLOADER Comet.B

boogy 0 Light Poster · Answer 10 · 2004-05-30T22:19:36+00:00

C:\SystemVolumeInformation\-restore{1DF014E9-2A7G4277-BD8A-14E12CE58FD5}\RP85\A0024173.dll
IT says... TROJAN HORSEDOWNLOADER Comet.B
this is what my box keeps saying.... :cry:

boogy 0 Light Poster · Answer 11 · 2004-05-31T00:06:15+00:00

what does it mean when I keep getting
PAGE CANNOT BE DISPLAYED???

caperjack 875 I hate 20 Questions Team Colleague · Answer 12 · 2004-05-31T01:39:06+00:00

I do believe that ,that shows it in you system restore, therefor you will need to disable system restore and then reboot and when you system is clean turn it back on .

caperjack 875 I hate 20 Questions Team Colleague · Answer 13 · 2004-05-31T01:40:40+00:00

what does it mean when I keep getting
PAGE CANNOT BE DISPLAYED???

When are you getting this message .Every page or certain ones

boogy 0 Light Poster · Answer 14 · 2004-05-31T01:56:04+00:00

it does it almost every time I go to search anything....and also if i turn off my system restore and then the next time my pc gets shut off i wont have a system restore point to go to.... right??? I wonder if I should do that?

boogy 0 Light Poster · Answer 15 · 2004-05-31T02:04:48+00:00

i did the cws shredder and it says my system is clean... I wonder how I can get rid of that darn box that pops up all the time saying i have a trojan horse downloader comet b...????
oh and thank you to all of you for all of the help youv'e given me

caperjack 875 I hate 20 Questions Team Colleague · Answer 16 · 2004-05-31T02:17:28+00:00

Leave system restore then,until we find out for sure that this means the file is in you system restore[C:\SystemVolumeInformation\-restore{1DF014E9-2A7G4277-BD8A-14E12CE58FD5}\RP85\A0024173.dll ] if that trojan is in you restore the next time you restore you computer to an earlier date you will infect your computer with the trojan ,if that is where its at!!

caperjack 875 I hate 20 Questions Team Colleague · Answer 17 · 2004-05-31T02:19:42+00:00

just found this topic on a simular problem .

caperjack 875 I hate 20 Questions Team Colleague · Answer 18 · 2004-05-31T02:24:48+00:00

What is you home page now!!I just noticed i errored in leaving this[R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
] in the list of things to fix .you could restore with hijackthis or maybe just reset you home page in tools/internet options in IE.!sorry .

boogy 0 Light Poster · Answer 19 · 2004-05-31T02:57:04+00:00

ok so do i go to my options and type in which home page???

caperjack 875 I hate 20 Questions Team Colleague · Answer 20 · 2004-05-31T06:57:11+00:00

Yes ,or you could run hijack this and click configure/backups and pick it from the list and restore it that way .

boogy 0 Light Poster · Answer 21 · 2004-05-31T23:17:35+00:00

boogy 0 Light Poster

22 Years Ago

any ideas on what to do???

boogy 0 Light Poster · Answer 22 · 2004-06-01T02:10:22+00:00

boogy 0 Light Poster

22 Years Ago

any ideas?????

caperjack 875 I hate 20 Questions Team Colleague · Answer 23 · 2004-06-01T05:23:07+00:00

Do you want to do smething different than what you wanted to do in the above post .are you still trying to make yahoo you home page .if so type in www.yahoo.com
go to tools /internet options /click use current in the homepage section !

boogy 0 Light Poster · Answer 24 · 2004-06-01T08:31:06+00:00

hi
no im still trying to figure out why my pc freezes after i have to restart it then when i system restore it its great again

please help me with my windows xp

Dani AI

Recommended Answers Collapse Answers

All 30 Replies

Recommended Answers