Thank you!!! :)

OK Here are both logs they look good to me and nothing came up suspious on them. Let me know what you think.

Thanks!! Heidi

[COLOR="Red"][B]Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:48:38 AM, on 2/1/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://yahoo.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Presario&pf=desktop[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Presario&pf=desktop[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM..\Run: [RtHDVCpl] ...

[B]Hi can someone take a look at this and tell me if there is anything there. Every couple days I keep getting mywebsearch in my spyware search I deleted it and keeps coming back . Any help would be great[/B][COLOR="Red"][/COLOR]

[COLOR="Green"]Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:18:56 AM, on 1/31/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\RtHDVCpl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Yahoo!\Common\YMailAdvisor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10a.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://yahoo.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Presario&pf=desktop[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Presario&pf=desktop[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - ...

[QUOTE=Michael_Knight;523681]OEM is Original Equipment Manufacturer.[/QUOTE]

Bless your heart!! Thank you so much for your help!!! This forum is the best to get help with.

Have a great day !!

Heidi

[QUOTE=bobbyraw;523659]maybe the cd will cost you about 30 bucks plus shipping or free with shipping. but so you know the cd will not restore any thing but your operating system ( windows) and maybe some oem programs[/QUOTE]

[COLOR="red"]I guess thats ok because everything I have (software) I purchased . I know I sound stupid but what are oem's?? Thank you for your advice I really appreciate it

Heidi[/COLOR]

[QUOTE=Michael_Knight;523647]You can try and restore your PC when Vista starts.

From the desktop, press the [B]Start Orb[/B] > select [B]Run[/B] > then type [B]rstrui [/B]> then click[B] OK[/B].

When the [B]System Restore[/B] window comes up, [U]don't[/U] select the [B]Recommended Restore[/B] - Select [B]Choose a different restore point[/B] and click [B]Next[/B].

Look at the dates and go back as far as you can. Selec the oldest date and click [B]Next [/B]then [B]Finish[/B]. The PC will now reboot and try to restore the PC all the way back to the date you selected.

When it's complete, the PC will reboot back in-to Windows, and hopefully, everything will be ok.

If it works, PM me and I will help you create an [B]Image [/B]of your system to prevent anything going wrong again.

[B]bobbyraw [/B]is also correct - contact the manufacturer of your PC, they should send you a free restore disk.

Good Luck.[/QUOTE]

Thanks for the info but it only gives me dates from yesterday?? If I get the cd and do it from the boot and click repair computer instead of installing will that work?? Just trying to see if it is at all possible to just get the cd as I am no genius on here....lol.

Thanks,
Heidi

Yes it is starting but taking 4ever!!! I have got some major issues on here and just want it back the way it was. How much is the cd??? Will it fix all the issues now that I'm having by installing it new again?

Thank you
Heidi

[B]Hi,

I purchased a computer with vista home basic already installed. Well the system recovery got DELETED and now I am screwed!! Can anyone tell me if I purchase the home basic cd and install it will it bring my computer back?? or do I upgrade to premium?? I'm really trying to avoid taking it to a shop at all cost (no pun intended) I have gotten so many errors on this thing that trying to put them all on here would be impossible. I just want to put my computer back to when I first got it. Nothing is backed up or no system recovery!!! any help would be appreciated as always on here!!

Thanks,
Heidi[/B]

Hi,

I have Windows ME and was wondering if adding more memory would somewhat speed up the system? I am not looking for a DSL or cable type of loading but my system takes forever to open a page. Someone told me that if I add memory it would speed it up somewhat. Any help would be appreciated.

Thanks,
Heidi :cheesy:

I was having a hard time removing PS Guard from my computer, I used AD-Aware and Spybot and also did the Smithrem and Panda scan but Ad-Aware keeps picking it up can you look at this and tell me what to get rid of or what to do next?.........Thanks

Logfile of HijackThis v1.99.1
Scan saved at 2:10:36 PM, on 11/8/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\WINMODEM.101\wmexe.exe
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\N32RMD.EXE
C:\PROGRAM FILES\MSWORKS\CALENDAR\WKCALREM.EXE
C:\PROGRAM FILES\PEOPLEPC\ISP6230\BROWSER\BARTSHEL.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\PEOPLEPC\ISP6230\BROWSER\PPSHARED.EXE
C:\MY DOCUMENTS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.yahoo.com/[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = [url]http://www.yahoo.com[/url]
O2 - BHO: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: PeoplePal Toolbar - {A8FB8EB3-183B-4598-924D-86F0E5E37085} - C:\Program Files\PeoplePC\Toolbar\PPCToolbar.dll
O4 - HKLM..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM..\Run: [SystemTray] SysTray.Exe
O4 - HKLM..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..\Run: [Norton AntiVirus Reminder] C:\PROGRA~1\NORTON~1\N32RMD.EXE /RES
O4 - HKLM..\Run: [Bart Station] C:\Program Files\PeoplePC\ISP6230\BIN\PPCOLink.exe -STATION
O4 - HKLM..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM..\RunServices: [winmodem] WINMODEM.101\wmexe.exe
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Startup: EPSON Status Monitor 3 Environment Check.lnk = C:\WINDOWS\SYSTEM\E_SRCV03.EXE
O16 - DPF: {192F9A01-8030-48CE-9BC6-B03DE3E613C6} (PeoplePC Web Installer) - [url]https://www.peoplepc.com/ppcos/ISP60/Download/ppcwebi.cab[/url]
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - [url]http://housecall60.trendmicro.com/housecall/xscan60.cab[/url]
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - [url]http://acs.pandasoftware.com/activescan/as5free/asinst.cab[/url]

Also here ...

Ok I did the steps you siad and then scanned with Panda and this it what it said.........

[B]Incident Status Location

Spyware:spyware/smitfraud No disinfected C:\WINDOWS\SYSTEM\OLEEXT.DLL
Virus:W32/Smitfraud.D Disinfected Operating system
Spyware:spyware/smitfraud No disinfected C:\WINDOWS\SYSTEM\oleext.dll
Adware:adware/psguard No disinfected Windows Registry
Virus:W32/Smitfraud.D Disinfected C:\WINDOWS\SYSTEM\WININET.DLL [/B]
Is there a way to get rid of the stuff it did not disinfect?........

Thanks

Can anyone tell me how to remove this from computer? Ad-Aware finds it and removes it but once computer is re-booted or shut down it shows up again...any help would be great

Thanks
Heidi

I'm sorry it is {dual fifo} not info on those, my apologies!!

Heidi

[QUOTE=kc0arf]Hello,

She is not trying to boot from the CD-ROM, so that is not the issue.

I hope you tried multiple CD's, and this is not just one failing... in other words, you tried 5 CD-ROMS, some made at the store, and determined a failure...

Heidi, first thing you will need to do is reboot your system. Depending on your BIOS settings, you may or may not see the system configuration printed out. This will appear as white text on a black screen. You may see memory counting up as the system checks your memory.

Now, if you have a newer computer that has the damn company logo "Dell, Compaq, Intel" on it instead, you will need to go into your BIOS and inspect it. WIthout knowing your exact machine details, I cannot say too much more here.

What are you looking for?

You need to see if the BIOS detects your CD-ROM drive first. It will either show up as some IDE device, or unlikely, yet possibly, a SCSI device. You need to ensure that the BIOS sees something else besides the hard drive.

If the BIOS detects a CD-ROM, then the next thing to do is load Windows. Look in the Device Manager and see if the CD-ROM driver has a problem.

Also, listen to the CD-ROM drive. Does it sound any differently than when you used it before?

Christian[/QUOTE]

Under device manager it shows yellow exclamation marks on:

standard floppy disk controller
primary IDE controller {dual info} ...

[QUOTE=Thong_Ispector]Some older systems cannot boot from the CD-Rom.

Check this by going into your BIOS/CMOS setup and see if it will let you select the CDRom as the first boot device.

If not...

You can boot from a floppy with the cd rom drivers that will get you going.[/QUOTE]

I have no idea how to do either of these, can you expain how??....I'm somewhat computer lit but not a master.....lol. Thanks for your help!!!

Heidi

For some reason my cd rom will not work, it opens up but when I put a disk in it doesn't load it. I looked in "my computer" and it does not even show the "D" drive on there and when I run D:/setup it says that it's not there?? Does anyone know how I can fix this as I can't put the disk in it to load it.....

Thanks,
Heidi

If this is the wrong forum for posting this I am sorry. Everytime I open IE the window is very small sized?? Is there anyway to change the actual window size because some sites I go to do not allow you to maximize?? any help would be appreciated!!

Thanks,
Heidi

Just wanted to keep all my stuff updated and I could not download the newest version of HJT so I came on here because I know someone would have it!!...This site is awesome!!

Thank you again for your help!!

Heidi :p

Figured it out, here ya go!!!..........

Logfile of HijackThis v1.99.1
Scan saved at , on 3/31/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\TOPSPEED\2.0\AOLTSMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\TOPSPEED\2.0\AOLTPSPD.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ptsnoop.exe
C:\PROGRAM FILES\COMMON FILES\AOL\AOL SPYWARE PROTECTION\AOLSP SCHEDULER.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\1105880297\EE\AOLHOSTMANAGER.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\1105880297\EE\AOLSERVICEHOST.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0\WAOL.EXE
C:\PROGRAM FILES\AMERICA ONLINE 9.0\SHELLMON.EXE
C:\WINDOWS\SLRUNDLL.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = [url]http://www.yahoo.com[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.yahoo.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://www.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://www.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://www.yahoo.com[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.yahoo.com[/url]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM..\Run: [SystemTray] SysTray.Exe
O4 - HKLM..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1105880297\EE\AOLHostManager.exe
O4 - HKLM..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM..\Run: [VirusScan Online] "C:\PROGRA~1\MCAFEE.COM\VSO\mcvsshld.exe"
O4 - HKLM..\Run: [MCAgentExe] C:\PROGRA~1\MCAFEE.COM\AGENT\mcagent.exe
O4 - HKLM..\Run: [MCUpdateExe] C:\PROGRA~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
O4 - HKLM..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM..\RunServices: [AOL TopSpeedMonitor] C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O4 - HKLM..\RunServices: [McVsRte] C:\PROGRA~1\MCAFEE.COM\VSO\mcvsrte.exe /embedding
O4 - ...

How do I open it with notepad? I think that's all I forgot. Thank You!!!!

No I don't need to post a log but I am feeling a little blonde right now.....LOL :rolleyes: can you tell me how to save the log file after I run HJT? It's been awhile since I had to save a log and can't remember for the life of me how to do it.

Thanks again!!

Heidi

[QUOTE=DMR]Linkage to the current HJT .exe:

[url]http://www.stevewolfonline.com/Downloads/DMR/DMRCA/Malware%20Utilities/[/url][/QUOTE]

THANK YOU!!!!! :cheesy: :cheesy:

Anyone have the exe file for this? I can't open it with the zip file and I downloaded the older version that someone put on here, the direct download. Any help would be appreciated!!

Heidi

Ok thanks !! I also changed my settings recently for internet and local internat to medium on both, one was running medium-low so maybe that's why. The page displays correctly so maybe it is a banner thing.

Thanks again,
Heidi

I keep getting a message "your current security settings prohibit active x from displaying this message correctly" My settings are set at medium and I ran Adaware and also HJT and saw no issues. I just noticed this today, is there something else I can do? Also the site it popped up on is a site I always visit and it never popped up before.

Thanks
Heidi :lol:

[QUOTE=caperjack]Hi ,i think i just figured out why you are confused ,it is not a program, so its not installing a program for you to use ,it just editing you registry so all you need to do is right click and hit install and that it ,run hijack again and post a fresh log .to see if the 015s are gone

Edit : you just posted a new log and it looks good ![/QUOTE]

OK Great so that delp domain did get rid of it.....YEAH!!......Is that something I can keep on my desktop and install it as needed for things like that??

HEidi

OH WOW!!..check out my new HJT log, I ran it yesterday a couple times (scan only) and checked the 2 O-15 I couldn't get rid of and today they are gone.....so I guess I don't need to stress you out anymore having to explain how to open this deldomains thing...LOL....here is my new log

Logfile of HijackThis v1.99.0
Scan saved at , on 1/31/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\TOPSPEED\2.0\AOLTSMON.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSRTE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\COMMON FILES\AOL\TOPSPEED\2.0\AOLTPSPD.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\ptsnoop.exe
C:\PROGRAM FILES\COMMON FILES\AOL\AOL SPYWARE PROTECTION\AOLSP SCHEDULER.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHLD.EXE
C:\PROGRAM FILES\MCAFEE.COM\AGENT\MCAGENT.EXE
C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSESCN.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGMAIN.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\1105880297\EE\AOLHOSTMANAGER.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\1105880297\EE\AOLSERVICEHOST.EXE
C:\PROGRAM FILES\SPYWAREGUARD\SGBHP.EXE
C:\PROGRAM FILES\COMMON FILES\AOL\ACS\AOLACSD.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\EXPLORER.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = [url]http://www.yahoo.com[/url]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.yahoo.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://www.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://www.yahoo.com[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://www.yahoo.com[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.yahoo.com[/url]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\PROGRAM FILES\MCAFEE.COM\VSO\MCVSSHL.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM..\Run: [SystemTray] SysTray.Exe
O4 - HKLM..\Run: [PTSNOOP] ptsnoop.exe
O4 - HKLM..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM..\Run: [HostManager] C:\Program Files\Common Files\AOL\1105880297\EE\AOLHostManager.exe
O4 - HKLM..\Run: [VSOCheckTask] "C:\PROGRA~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
O4 - HKLM..\Run: [VirusScan Online] ...

[QUOTE=caperjack]Thats it ,now take you mouse and right click on the file ,and second from the top of the list you should see install click on that[/QUOTE]

I did that but I don't know how to open it or where it installed to......do I just click on the icon on the desktop, sorry to ask so many questions, just don't want to screw this thing up again.....LOL

Heidi :)

Ok I got that but where did it download to?? On my desktop now it has the icon with a yellow wheel thingy to the right of it....is that right? I'm not sure of the next step so I'll wait for your reply

THANKS
Heidi ;)

[QUOTE=crunchie]Click on the link to download it to your PC. Save it to your desktop. Right click on it and choose rename. Change the file extension only (top line) to deldomains.inf instead of deldomains.txt.
Once done right click on the file again and choose install. That should do it.[/QUOTE]

I saved it to desktop and right-clicked to rename but the file stayed the same(notepad) what do you mean by top line?? sorry to be so clueless....lol, thanks for your help

Heidi :D