dlh6213 27 Posting Maven Team Colleague

I don't know if the popup is legit, but it wouldn't hurt do search your system for pxwma.dll and delete it if you find it --
http://castlecops.com/tk1907-pxwma_dll.html

dlh6213 27 Posting Maven Team Colleague

Hi Spikee, welcome to DanWeb :D

I appologize for the delay in responding to this; if you still need assistance, please follow the suggestions and instructions in the links below and then post a new HijackThis log.

dlh6213 27 Posting Maven Team Colleague

Hi Whit, welcome to DaniWeb :D

There are a few things to clean up there, but you first need to move HijackThis to its own permanent folder (you now have it in a Temp folder). See the last link in my signature below for some help with this.

After you do that, reboot into Safe Mode and do a full system scan with Ewido (Note: you will be posting this log with your next reply).

Now, reboot normally, close any open browser windows, scan with HijackThis, and post a new log along with your Ewido log.

dlh6213 27 Posting Maven Team Colleague

Hi Olivia, sorry for the delay in responding to this.

Are you saying you are unable to boot into Safe Mode?

Try the (free) online scans in the 'Cleanup' link below.

Uninstall Messenger Plus as it comes bundled with LOP. You can reinstall Messenger Plus without the sponsor (but you should probably wait until your computer is working proplerly before reinstalling it).

Scan with HijackThis and have it fix the following entries:

O2 - BHO: (no name) - {8E13DDE1-E013-47ec-9C4C-27C2F78BDD26} - C:\WINDOWS\system32\iiiig.dll
O20 - Winlogon Notify: iiiig - C:\WINDOWS\SYSTEM32\iiiig.dll

Close any open windows, other then HijackThis, before hitting Fix checked.

Go to C:\WINDOWS\SYSTEM32 and delete iiiig.dll

Empty your Recycle Bin.

Keep us updated on the scan results. If you still can't scan with Ewido, try CounterSpy (link to it in the 'Cleanup' link below).

dlh6213 27 Posting Maven Team Colleague

Sorry for the delay in responding to this.

Go to Add or Remove Programs in your Control Panel and remove (if present):

HbTools

Please right-click in an open area of your desktop and select New, Folder; give the new folder a name such as HJT or HijackThis, and then drag the hijackthis.exe icon that is on your desktop into this new folder.

Reboot into Safe Mode and do a complete system scan with Ewido allowing it to fix whatever it finds. Note: you will be posting this log with your next reply.

Now, still in Safe Mode, scan with HijackThis and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.ifiromvskazyzjkrybtzrect...tCsYoxO3Icj.php
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qozyzgduukqjsupvrvyu.com...YcF7WWAuXCg.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.zpecialoffer.com/results.asp?keyword=%s
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {34966F4A-8C59-99EF-8A41-8631924AB270} - C:\DOCUME~1\Paul\APPLIC~1\ANTIBO~1\base ooze.exe (file missing)
O2 - BHO: (no name) - {6F559AEC-1187-9DB7-DC78-9DD7569F2ABC} - C:\DOCUME~1\Paul\APPLIC~1\ANTIBO~1\base ooze.exe (file missing)
O2 - BHO: (no name) - {A42EFAF3-EA3F-AA26-A497-CBFB3599E295} - (no file)
O4 - HKLM\..\Run: [Drivesettingsmultibait] C:\Documents and Settings\All Users\Application Data\funk army drive settings\LIVE CAST.exe
O4 - HKLM\..\Run: [HbTools] C:\Program Files\HbTools\Bin\4.6.4.0\HbtOEAddOn.exe
O4 - HKLM\..\Run: [Messantibaitcamp] C:\Documents and Settings\All Users\Application Data\Dogbibmessanti\stupid meet.exe
O4 - HKCU\..\Run: [Each Clock] C:\DOCUME~1\Paul\APPLIC~1\JOYCOM~1\Does grey.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -

dlh6213 27 Posting Maven Team Colleague

Hi Magic, sorry for the delay in responding to this.

You now have HijackThis in a safe place so we can begin fixing some things and if anything goes wrong, you will have the backups in your HijackThis folder :).

If you get any pop-ups regarding scanner services and such, right-click on them and select Close (or use Task Manager to End Task); don't use the 'X' to close them.

Go to Add or Remove Programs in your Control Panel and remove (if present):

MyWebSearch

Scan with HijackThis and have it fix the following entries:

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...//www.yahoo.com
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\2.bin\mwsoemon.exe
O4 - HKCU\..\Run: [ares] "C:\Documents and Settings\bobby\Desktop\Ares.exe" -h
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusear...?p=ZSXXXXXXXXUS
Have HijackThis fix this O15 entry only if you did not put it in your Trusted Zone yourself --
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/M...pDownloader.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab

Close any open windows, other then HijackThis, and hit Fix checked.

Go to the following locations and delete the highlighted file and folder:

C:\Documents and Settings\bobby\Desktop\Ares.exe

C:\Program Files\MyWebSearch

If anything can't be deleted, try …

dlh6213 27 Posting Maven Team Colleague

Hi rcpilot, welcome to DaniWeb :D

Please follow the advice in the links below and then post your HijackThis log in a new thread per forum rules -- http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules.

dlh6213 27 Posting Maven Team Colleague

Systr.dll is only one of the files related to this problem, there is also...
param32.dll
guninst.exe
popup_bl.dll
svrhost.exe

You may want to do a search for those and, if you have any of them, follow the instructions in the above post.

dlh6213 27 Posting Maven Team Colleague
dlh6213 27 Posting Maven Team Colleague

Not much in that log, just this one:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

See if this helps --
http://www.iamnotageek.com/a/393-p1.php

dlh6213 27 Posting Maven Team Colleague

Hi Mark, welcome to DaniWeb :D

Please follow the recommendations and instructions in the links below and then post a HijackThis log for analysis.

dlh6213 27 Posting Maven Team Colleague

Hi Jimfitzger, welcome to DaniWeb :D

Please follow the recommendations and instructions in the links below.

Then download Ewido -- http://www.download.com/Ewido-Security-Suite/3000-8022_4-10326287.html?tag=lst-0-1, but don't run it yet.

Reboot into Safe Mode.

Do a full system scan with Ewido, allowing it to fix whatever it finds (Note: you will be posting the log from this scan with your next reply).

Reboot normally, close any open browser windows, scan with HijackThis, and post a new log along with the Ewido log.

dlh6213 27 Posting Maven Team Colleague

Nothing too bad there. Scan with HijackThis and have it fix the following:

R3 - Default URLSearchHook is missing

These O15 entries only if you didn't put them in your Trusted Zone yourself --
O15 - Trusted Zone: http://ny.contentmatch.net (HKLM)

All the O16 entries just for general cleanup --
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/gam...ts/y/potc_x.cab
O16 - DPF: Yahoo! Towers 2.0 - http://download.games.yahoo.com/gam...ts/y/ywt0_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage) - http://go.microsoft.com/fwlink/?lin...467&clcid=0x409
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gm...staller_gmn.cab
O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/...all/xscan53.cab
O16 - DPF: {82F2D6B2-6C58-4404-A930-9DB0FD90D4B1} (Driver_Detective_v43_Non_Member.DD_v43) - http://www.drivershq.com/cab/prod/D..._Non_Member.CAB
O16 - DPF: {928626A3-6B98-11CF-90B4-00AA00A4011F} (SurroundVideoCtrl Object) - http://encarta.msn.com/encnet/external/MSSurVid.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuit.../ITDetector.cab
O16 - DPF: {DF6A0F17-0B1E-11D4-829D-00C04F6843FE} (Microsoft Office Tools on the Web Control) - http://dgl.microsoft.com/downloads/outc.cab

This O17 entry only if the IP address is not related to your ISP --
O17 - HKLM\System\CCS\Services\Tcpip\..\{4D8E4DE2-294F-459D-87F3-D9FEA3001E96}: NameServer = 205.171.3.65 205.171.2.65

Close any open windows, other then HijackThis, and hit Fix checked.

Reboot.

dlh6213 27 Posting Maven Team Colleague

Is this a wireless network or a wired network? Do you have any routers, switches, hubs, etc.?

dlh6213 27 Posting Maven Team Colleague

hi there, i was told to post my hijack this log file here

Related thread -- http://www.daniweb.com/techtalkforums/thread31368.html

I don't see anything in that log that should be causing a problem, except for the fact that you are lacking any Windows Updates.

dlh6213 27 Posting Maven Team Colleague

Scan with HijackThis and have it fix the following entries:

O4 - HKLM\..\Run: [nsajauo] C:\WINDOWS\System32\gqokvbf.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)

Close any open windows, other then HijackThis, and hit Fix checked.

Go to C:\WINDOWS\System32 and delete gqokvbf.exe (if the file can't be deleted, try booting into Safe Mode first).

Empty your Recycle Bin and reboot normally.

If you still can't connect, you may get better responses posting your question in the Windows Software forum (without the HJT log).

dlh6213 27 Posting Maven Team Colleague

I'm glad you were able to restore everything, but you're still running HijackThis from a Temp folder
(C:\Documents and Settings\amy\Local Settings\Temp\HijackThis.exe).

Here are some examples of how it should look in your log when HijackThis is in a proper folder, please move it before attempting to fix anything with HijackThis:

C:\Documents and Settings\User\Desktop\HJT\HijackThis.exe
C:\Program Files\hijackthis\HijackThis.exe
E:\Utilities\HijackThis\HijackThis.exe
C:\HJT\HIJACKTHIS.EXE

Then, reboot into Safe Mode.

Do a full system scan with Ewido allowing it to fix whatever it finds. Note: you will be posting the log from this scan with your next reply.

Reboot normally.

Close any open browser windows, scan with HJT, and post a new log along with the Ewido log.

dlh6213 27 Posting Maven Team Colleague

Thanks Swatcat!

dlh6213 27 Posting Maven Team Colleague

Glad to hear things are running properly again :)

Reboot into Safe Mode and scan with Ewido again; post the log from this scan with your next reply.

Reboot normally, close any open browser windows, scan with HJT and post a new log along with the Ewido log.

Open Firefox and go to Tools, Options..., General (icon on left side), go down to the Default Browser box, put a check in the box, and then click OK.

Open Internet Explorer, go to Tools, Internet Options..., and click on the Programs tab. Near the bottom of the window you should see "Internet Explorer should check to see whether it is the default browser," make sure the box is NOT checked, and click OK.

Open Firefox again, go to Tools, Options..., General; in the Default Browser box, click the Check Now button on the right side, and then click OK.

dlh6213 27 Posting Maven Team Colleague

Can you boot into Safe Mode and access your Control Panel from there?

dlh6213 27 Posting Maven Team Colleague

I didn't really do much, but you're welcome. Glad to hear everything is working properly now.

dlh6213 27 Posting Maven Team Colleague

If it were a loose connection or bad wire, it wouldn't effect all the computers because they are not all connected to one cable.

But it does sound like you have some other problems that should be dealt with first. Check out the links below and then post a HijackThis log in the Virus forum (NOT in this thread).

dlh6213 27 Posting Maven Team Colleague

128 MB of memory isn't a lot these days. If you want to see a performance boost, upgrade to at least 512 MB. Like everyone said; disk cleanup and defrag will help speed up your computer's performance.

Check out this tip from Microsoft.

http://www.microsoft.com/AtWork/getstarted/speed.mspx/

Agreed; a Windows XP system will run a bit slow with only 128MB of RAM. 384MB should be adequate if you aren't running any resource-hungry applications.

dlh6213 27 Posting Maven Team Colleague

Try WinsockXPFix --WinsockXPFix

Run it, and click the Fix button; choose YES when asked if you want to proceed.

If it still doesn't work, try IEFix -- http://windowsxp.mvps.org/IEFIX.htm

Follow the instructions in the last link below for putting HijackThis into its own permanent folder and then post a new log.

dlh6213 27 Posting Maven Team Colleague

Please follow the recommendations and instructions in the links below and then post a HijackThis log as explained.

dlh6213 27 Posting Maven Team Colleague

See if this helps:
http://www.spywaredb.com/remove-surfsidekick/

Then follow the suggestions and instructions in the links below and post a HijackThis log.

dlh6213 27 Posting Maven Team Colleague

(This fix obtained from http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=42143)

Boot/reboot into Safe Mode

Go to Add/Remove Programs in the Control Panel and remove:
MyWay (or MyWaySA)

If you get a window to "Remove Share Component", click "Yes to All"

If you get a window to "Remove Share File", click "Yes to All"

Do NOT restart the computer when asked

Go to Start, Find (or Search), Files or Folders; Look In should say Local Hard Drives
Type MyWay (or MyWaySA) and hit Enter -- delete any instances found.

Go to Start, Run, and type in (or copy and paste) MsiExec.exe /X{78d944d7-a97b-4004-ab0a-b5ad06839940}

Click OK and follow the prompts to remove MyWay

Go to Start, Run, type in regedit, and hit Enter

Highlight My Computer

Click Edit, Find, type in MyWay, and hit Enter. Delete anything found, press F3 to continue searching, deleting any/all found until the search is complete.

Close all windows when finished and reboot normally.

dlh6213 27 Posting Maven Team Colleague

No appologies necessary, sorry you lost some of your data :(

Follow the suggestions in the links below to help protect your computer and keep it clean.

dlh6213 27 Posting Maven Team Colleague

This isn't exactly my area of expertise and I wouldn't want to give you bum steer; I'll try to find you some better help :)

Did the graphic card updates help at all?

dlh6213 27 Posting Maven Team Colleague

It is possible you have something more serious wrong with your computer, you should make sure you have all of your important data backed up in case things take a turn for the worse. (Always a good idea to do regular backups anyway.)

Run ScanDisk and then Defragmentor to see if it helps with the freezing at all.

Open Firefox and go to Tools, Options, and then click on Privacy (padlock icon on the left); click on the Clear All button (you should do this on a regular basis).

Your logs are clean; if you continue having problems with your system freezing, you should post a new thread in the Windows XP forum.

dlh6213 27 Posting Maven Team Colleague

Most of the entries shown in a HIjackThis log are legitimate and should not be 'fixed. I hope you (or he) moved HijackThis to another folder before this happened; HijackThis comes with a backup and restoration procedure in case you remove an entry that is actually legitimate. If you still had HijackThis running from a temporary directory, then the procedure may not work. Do NOT empty any Temporary folders at this time.

HijackThis will make a backup of any entries that you fix in a directory called Backups that resides in the same location as Hijackthis.exe.

Open HijackThis and click on Config..., and then the Backup button. A window will come up that will list all the items that you had fixed previously and give you the option of restoring them. Once you restore an item that is listed in this screen, upon scanning again with HijackThis, the entries will show up again. In your case, you should restore everything that was fixed and start over.

Please read the last link in my signature block below (including the Warning) before doing anything else with HijackThis, and then post a new log.

dlh6213 27 Posting Maven Team Colleague

Are all of these computers on the same network?

It's possible it could be some type of virus that so far has only effected some of your systems, but it seems more likely to me that there is a loose connection or bad wire somewhere; perhaps even a router or switch going bad.

dlh6213 27 Posting Maven Team Colleague

Hey Swatcat, I have a couple of questions you can hopefully answer.

1.) What would have happened to cause this problem in the first place?

2.) If this is related to the Internet Options applet, why would it cause problems with non-internet folders?

dlh6213 27 Posting Maven Team Colleague

Please close any open browser windows, scan with HijackThis, and post a new log; AND post the results from your Ewido scan :)

dlh6213 27 Posting Maven Team Colleague

Your log still shows that you don't have the current updates. Your log shows this:
Logfile of HijackThis v1.99.1
Scan saved at 4:34:55 PM, on 8/29/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Whereas an updated system should look more like this:
Logfile of HijackThis v1.99.1
Scan saved at 1:45:37 PM, on 8/28/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Did you complete this scan after you got the updates?

Please post your Ewido log so we can see what else is remaining.

dlh6213 27 Posting Maven Team Colleague

Hi T_Hart, welcome to DaniWeb :D

First of all, you need to get the Windows Updates for XP and IE (just up to SP1a for now, don't get SP2 yet). See the links below for more tips on protecting and cleaning up your system.

Follow the instructions in post #4 of this thread -- http://www.daniweb.com/techtalkforums/thread28196.html

When you've finished that, close any open browser windows, scan with HJT, and post a new log please.

dlh6213 27 Posting Maven Team Colleague

Download and run the PurityScan uninstaller:

http://www.purityscan.com/uninstall.html

Go to Add/Remove Programs in your Control Panel and remove (if present):

rdso
SurfSideKick

Scan with HijackThis and have it fix the following entries:

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\klpds4.exe reg_run
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
If you didn't put this in your Trusted Zone yourself, have HJT fix this O15 entry as well --
O15 - Trusted Zone: http://www.gsp.ro
O20 - AppInit_DLLs: repairs.dll
O20 - Winlogon Notify: RunOnceEx - C:\WINDOWS\system32\fascom.dll

Close any open windows, other then HijackThis, and hit Fix checked.

Go to the following locations and delete the highlighted files and folders:

C:\WINDOWS\system32\klpds4.exe
C:\WINDOWS\system32\fascom.dll
C:\WINDOWS\system32\iaslan.exe

C:\Program Files\SurfSideKick 3
C:\Program Files\rdso

Do a search for repairs.dll and delete any instances found.

If any of these files cannot be deleted, try booting into Safe Mode first.

Go to C:\WINDOWS\SYSTEM32\W?nSxS and right-click on notepad.exe, go to Properties, and give us whatever info you can on the file (Company, version, etc.)

Empty your Recycle Bin and reboot.

Close any open browser windows, scan with HJT, and post a new log please. Let us know if you're still having problems.

dlh6213 27 Posting Maven Team Colleague

Try these two; if you're able to scan with Ewido, post the log here after you run it.

CounterSpy -- http://www.download.com/CounterSpy/3000-8022_4-10375153.html?tag=lst-0-1

Ewido -- http://www.download.com/Ewido-Security-Suite/3000-8022_4-10326287.html?tag=lst-0-1


Sorry to hear about your Xbox :cry:

dlh6213 27 Posting Maven Team Colleague

Hi again MagicTwists,

I've merged your prior threads with this one so anyone viewing this will know what's been going on. Please post all replies regarding this in this thread.

You should first get the latest version of HijackThis, and then you need to put it into its own permanent folder (right now you have it in a Temp folder). See the last link in my signature block below for instructions on doing this.

After you get the latest version and put it in a safe folder, close any open browser windows, 'Scan and save log' and post the log here for review.

dlh6213 27 Posting Maven Team Colleague
dlh6213 27 Posting Maven Team Colleague

Make sure you have all the latest drivers for your hardware, especially the motherboard and graphics card.

Make sure you have the latest Windows Updates as well.

dlh6213 27 Posting Maven Team Colleague

You may have problems other then LimeWire; I suggest you review the last link in my signature block below for some info on HijackThis, and then post a HijackThis log here for analysis.

You can also try running regedit from Safe Mode and see if it will work from there.

dlh6213 27 Posting Maven Team Colleague

Try these suggestions:

IEFix -- http://windowsxp.mvps.org/IEFIX.htm

Winsockfix -- http://www.softpedia.com/get/Tweak/Network-Tweak/WinSockFix.shtml

Why aren't you using Firefox? You can get it from here:
http://www.mozilla.org/products/firefox/

dlh6213 27 Posting Maven Team Colleague

Try deleting the stubborn file from Safe Mode; if it still can't be deleted please give us more info on it (complete name, location, etc.).

Your HijackThis log looks okay :). But a copy of your Ewido log will help determine if anything else should be done.

dlh6213 27 Posting Maven Team Colleague

Just changing the outlet won't do it because the outlet will still need to be connected to the earth. I suggest you hire an electrician to do the job; I know they're expensive, but it's best to have the job done right.

dlh6213 27 Posting Maven Team Colleague

You're welcome, glad to hear your computer is working better :)

Have a look through the links below to help keep it that way!

dlh6213 27 Posting Maven Team Colleague

First, you need to be sure your system is set to 'Show hidden files and folders.' Open Windows Explorer, go to Tools, and then Folder Options; when the Folder Options window opens, click on the View tab. You should find these entries in the list under Advanced settings:
Select Show hidden files and folders
Deselect (uncheck) Hide protected operating system files.

If you're getting any popup messages, don't click on them, not even the 'X' to close them; either right-click and select Close, or use Task Manager (Ctrl-Alt-Del) and End Task.

Download CleanUp from here:
http://www.stevengould.org/downloads/cleanup/CleanUp40.exe

Install it, but don't run it yet.

Download LQfix.exe from one of the following locations:
http://www.downloads.subratam.org/LQfix.exe
http://miekiemoes.geekstogo.com/tools/LQfix.exe

Install it, but do NOT run it yet (you will need to boot into Safe Mode first).
Installation and running notes --

  • To install, double-click LQfix.exe and click Next, then Next, and then Install.
    When you run it:
  • Leave the default settings, if you change them, the fix will Fail!
  • You will need an active internet connection, so make sure your you're not blocking any connection now.
  • Make sure the "Launch LQfix" box is checked.
  • Click the Finish button to start the fix.
  • Follow the on-screen prompts.
  • Your system will reboot afterwards.
  • Please be patient after the reboot, there is a script running in the background that needs to complete.

Reboot into Safe Mode and run LQfix.bat.

When it's finished …

dlh6213 27 Posting Maven Team Colleague

Okay, I can help you with this now :)

First, you need to be sure your system is set to 'Show hidden files and folders.' Open Windows Explorer, go to Tools, and then Folder Options; when the Folder Options window opens, click on the View tab. You should find these entries in the list under Advanced settings:
Select Show hidden files and folders
Deselect (uncheck) Hide protected operating system files.

If you're getting any popup messages, don't click on them, not even the 'X' to close them; either right-click and select Close, or use Task Manager (Ctrl-Alt-Del) and End Task.

Reboot into Safe Mode, scan with HijackThis, and have it fix the following entries:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\uk.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://dnaads.com/servlet/ajrotator...L?zone=enternet
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliterdj32.exe
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0803] "C:\WINDOWS\Downloaded Program Files\CONFLICT.4\UWFX5LP_0001_0803NetInstaller.exe"
O4 - HKLM\..\Run: [System service63] C:\WINDOWS\etb\pokapoka63.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/DownloadAccess/ie/bridge-c9.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108fd.bay108.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1123761054546
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {CDCBE0F1-D13A-4F86-A963-3A272D3ABA7E} (VacPro.internazionale_ver15) - http://advnt01.com/dialer/internazionale_ver15.CAB

dlh6213 27 Posting Maven Team Colleague

Having a two-prong adapter won't effect the power to your system, but it will certainly effect the grounding of it. I don't know if this would cause your freezing problem, but it can lead to serious damage to your system. You should get your computer connected to a properly grounded (earth) connection as soon as possible, even if you need to use an extension cord to do so.

dlh6213 27 Posting Maven Team Colleague

Hi ninja_pirate, welcome to DaniWeb :D

I don't have time to go through your log at the moment, but this thread should help you get started:
http://www.daniweb.com/techtalkforums/showthread.php?t=30034&highlight=yupsearch