Posts by Rumbleman

well it was definatly my power supply so i bought a better one and it is up and running... but now my warcraft sub has run out lol thanks a lot for all the help.

My PS is a SPI Sparkle power international i dont know if thats a good brand and i dont have another ps to test with but i do have a dvm so ill try that. it seems to be worse during startup too. once i get it running it seems sorta stable but i have to try about 10 times or more to get it to finish booting. sometimes it helps to turn off the ps and wait a minute and then try again.

ok i did all that cleanedit up and unplugged everything and plugged it back in but no change its getting worse. when i first hit the power button the ps sounds like its making a clicking noise an it wont even start to boot up unless i unplug my ethernet cord???
also when i do get it to boot my keyboard and mouse randomly wont work, the light on my wireless keyboard reciever will flicker when it isnt wrking. i think it is either a mb or ps problem but i dont know which. i have hecked all my mb caps carefully and they all LOOK fine.

ok i did all that and i havent seen sign of any viruses but the not starting is still a apin and it turns off and resets occasionally but i think i have driver and maybe hardware issues. thanks alot for your help.

IT took me a while because my computer stopped booting and i had to rewrite the boot sector before it would start up again.

[04/10/2007, 17:28:57] - VirtumundoBeGone v1.5 ( "E:\Documents and Settings\Owner\Desktop\VirtumundoBeGone.exe" )
[04/10/2007, 17:29:02] - Detected System Information:
[04/10/2007, 17:29:02] - Windows Version: 5.1.2600, Service Pack 2
[04/10/2007, 17:29:02] - Current Username: Owner (Admin)
[04/10/2007, 17:29:02] - Windows is in NORMAL mode.
[04/10/2007, 17:29:02] - Searching for Browser Helper Objects:
[04/10/2007, 17:29:02] - BHO 1: {53707962-6F74-2D53-2644-206D7942484F} ()
[04/10/2007, 17:29:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/10/2007, 17:29:02] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[04/10/2007, 17:29:02] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[04/10/2007, 17:29:02] - Finished Searching Browser Helper Objects
[04/10/2007, 17:29:02] - Finishing up...
[04/10/2007, 17:29:02] - Nothing found! Exiting...

Logfile of HijackThis v1.99.1
Scan saved at 4:50:30 PM, on 09/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\WINDOWS\ATKKBService.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\WINDOWS\system32\Ati2evxx.exe
C:\xoblite_bb3_rc1\Blackbox.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Microsoft IntelliPoint\point32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\Program Files\Hijackthis\rumble.exe.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\Messenger\msmsgs.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\WINDOWS\system32\ZoneLabs\UpdClient.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [CoolSwitch] E:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [ATIPTA] E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [IntelliPoint] "E:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] E:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: …

You have used an invalid url to download ComboFix.exe. Please be advised that these are the correct links to use
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
first it said that so i changed the url and it ran and found 2 things: Qoologic and SurfSideKick but it just closed, didnt post a log. the log just said:
Start Time= 09/04/2007 16:17:42.35

i ran it from the second link and here is the log:
"Owner" - 07-04-09 16:25:30 Service Pack 2
ComboFix 07-04-05 - Running from: "e:\Program Files\Maxthon"

((((((((((((((((((((((((((((((( Files Created from 2007-03-09 to 2007-04-09 ))))))))))))))))))))))))))))))))))

2007-04-09 16:15 <DIR> d-------- E:\sUBs
2007-04-07 17:39 <DIR> d-------- E:\DOCUME~1\Owner\APPLIC~1\Ahead
2007-04-07 17:35 <DIR> d-------- E:\Program Files\Nero
2007-04-07 17:35 <DIR> d-------- E:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
2007-04-07 11:31 <DIR> d-------- E:\Program Files\Smart Projects
2007-04-06 09:27 4,096 --a------ E:\WINDOWS\d3dx.dat
2007-04-04 17:31 3,968 --a------ E:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-04-04 16:06 <DIR> d-------- E:\VundoFix Backups
2007-04-03 17:58 <DIR> d-------- E:\WINDOWS\system32\ActiveScan
2007-04-03 16:42 <DIR> d-------- E:\Program Files\ATI Technologies
2007-04-03 06:04 0 --a------ E:\WINDOWS\system32\atiicdxx.dat
2007-04-02 17:22 524,288 --ah----- E:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-03-31 10:50 <DIR> d-------- E:\Program Files\StuffPlug3
2007-03-31 10:31 8,988,704 --ahs---- E:\WINDOWS\system32\drivers\fidbox.dat
2007-03-31 10:31 266,272 --ahs---- E:\WINDOWS\system32\drivers\fidbox2.dat
2007-03-31 10:30 <DIR> d-------- E:\DOCUME~1\Owner\APPLIC~1\MailFrontier
2007-03-31 09:18 <DIR> d-------- E:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-03-30 12:54 75,512 --a------ E:\WINDOWS\zllsputility.exe
2007-03-30 12:54 11,264 --a------ E:\WINDOWS\system32\SpOrder.dll
2007-03-30 12:54 1,087,216 --a------ E:\WINDOWS\system32\zpeng24.dll
2007-03-28 22:34 <DIR> d-------- E:\DOCUME~1\Owner\APPLIC~1\Screenshot Sender
2007-03-28 22:33 <DIR> d-------- E:\Program Files\Messenger Plus! Live
2007-03-20 …

actually my computer worked fine for a day now its resetting itself constalntly and i dont know why but i think it might be a hardware issue i ran another virus scan and didnt find any viruses so thanks for helping me fix it.

Incident Status Location
Potentially unwanted tool:Application/PRScheduler Not disinfected E:\Documents and Settings\Owner\Start Menu\Programs\Startup (Disabled)\PowerReg Scheduler.exe
Potentially unwanted tool:Application/PRScheduler Not disinfected E:\Program Files\Hijackthis\backups\backup-20070404-164318-460-PowerReg Scheduler.exe
thast all there was on the pandascan
and the f-secure said nothing was found

i rarely use firefox so i didnt even think about it i mostly use maxthon. ya i thought that log was long and that would explain it. panda is running has been for over an hour i have too many files. so far my computer has been stable for 2 hours which is a record for the last week or so, probably thanks to you. i just checked my log and the first warning was on teh 27th of march it was pmnnl.dll and there has been a steady stream of trojan warnings since then. dont know if that helps. so far panda has found 2 rootkits and its halfway done i dont know if my computer will stay running until its over. if not ill try again tommorrow. thanks alot for your help!

i ran vundo and it came up clean
i reran atf and noticed that you hvae to set it for different browsers so i cleaned everything.
zonealarm virus scan found about 15 copies of not-a-virus:AdWare.Win32.Virtumonde.id.

and quarantined them all
ill run pandascan now and post the results

ok i finished the scan finally ill post then rerun vundo and stuff

E:\System Volume Information\_restore{534E2F2C-02F9-402C-9972-62860AD1A4EC}\RP269\A0119679.exe -> Adware.Searchcolor : Cleaned.
E:\VundoFix Backups\vwghinws.exe.bad -> Adware.Searchcolor : Cleaned.
:mozilla.390:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.391:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.335:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.336:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.337:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.338:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.339:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.340:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.448:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.449:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.531:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.560:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.644:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
E:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.899:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Abcsearch : Cleaned.
:mozilla.13:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.14:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.17:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.18:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.19:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.21:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.222:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.223:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.22:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.23:E:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\0gwcqxtt.default\cookies.txt -> TrackingCookie.Adbrite …

i have been tring to run the avg spyware scanner but my computer keeps resetting itself and i dont know why. and avg antivirus found another trojan horse Lop.bL

VundoFix V6.3.19
Checking Java version...
Java version is 1.5.0.8
Old versions of java are exploitable and should be removed.
Scan started at 4:06:58 PM 04/04/2007
Listing files found while scanning....
E:\WINDOWS\system32\dgjlm.bak1
E:\WINDOWS\system32\dgjlm.bak2
E:\WINDOWS\system32\dgjlm.ini
E:\WINDOWS\system32\mljgd.dll
E:\WINDOWS\System32\pmnnl.dll
E:\WINDOWS\system32\rqrropq.dll
E:\WINDOWS\system32\vwghinws.exe
Beginning removal...
Attempting to delete E:\WINDOWS\system32\dgjlm.bak1
E:\WINDOWS\system32\dgjlm.bak1 Has been deleted!
Attempting to delete E:\WINDOWS\system32\dgjlm.bak2
E:\WINDOWS\system32\dgjlm.bak2 Has been deleted!
Attempting to delete E:\WINDOWS\system32\dgjlm.ini
E:\WINDOWS\system32\dgjlm.ini Has been deleted!
Attempting to delete E:\WINDOWS\system32\vwghinws.exe
E:\WINDOWS\system32\vwghinws.exe Has been deleted!
Performing Repairs to the registry.
Done!

Logfile of HijackThis v1.99.1
Scan saved at 5:26:16 PM, on 04/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\system32\Ati2evxx.exe
C:\xoblite_bb3_rc1\Blackbox.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\WINDOWS\ATKKBService.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Microsoft IntelliPoint\point32.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Maxthon\Maxthon.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\Messenger\msmsgs.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\WINDOWS\system32\taskmgr.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

someof my viruses are as follows:
packed.win32.cryptexe
trojan-downloader.vbs.small.az
trojan-downloader.Bat.ftp.c
trojan-downloader.win32.lstbar.ja
trojan-downloader.win32.softomate.u
trojan-downloader.bat.ftp.ab

my problemss astarted by the advanced view folder tools dissapearing and then avg started spouting virus warnings at me mostly trojans and ones that claimed they were "not-a-virus:adware.win32.virtumonde.id" . Now my computer wint even stay running and its slow when it does run.
my HJT file is as follows and if i can make my computer runlong enough to get a virus scan file ill post it after.

Logfile of HijackThis v1.99.1
Scan saved at 5:13:03 PM, on 03/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\WINDOWS\system32\Ati2evxx.exe
C:\xoblite_bb3_rc1\Blackbox.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\WINDOWS\ATKKBService.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Microsoft IntelliPoint\point32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\wscntfy.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\WINDOWS\system32\ctfmon.exe
E:\Program Files\Maxthon\Maxthon.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgvv.exe
E:\Program Files\Hijackthis\HijackThis.exe
E:\WINDOWS\system32\ZoneLabs\UpdClient.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.shaw.ca/start/enca/addons/search/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page …

ok i will after work thanks

i have th e same problem specifically the advaced options under Tools/folder options/view/advanced options the window that you scroll to find showhidden files is completely blank! i have tried the registry edits that have been posted under several threads with no success whatsoever. any other ideas would be appreciated! Also as a side note when i try to search in windows explorer i get a tiny google search bar in the side bar instead of search. and it searches the web not my computer...???
thansk -cam
edit:
this is my hjt results
Logfile of HijackThis v1.99.1
Scan saved at 11:44:52 PM, on 31/03/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\Ati2evxx.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\ZoneLabs\vsmon.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\ATKKBService.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
E:\WINDOWS\system32\Ati2evxx.exe
C:\xoblite_bb3_rc1\Blackbox.exe
E:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
E:\WINDOWS\system32\taskswitch.exe
E:\Program Files\QuickTime\qttask.exe
E:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
E:\Program Files\Microsoft IntelliPoint\point32.exe
E:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
E:\WINDOWS\system32\tbctray.exe
E:\WINDOWS\system32\ctfmon.exe
E:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\Program Files\Yahoo!\Yahoo! Widget Engine\YahooWidgetEngine.exe
E:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Messenger\msmsgs.exe
E:\Program Files\Hijackthis\HijackThis.exe
E:\Program Files\Maxthon\Maxthon.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.shaw.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - …