• Announcements

    • Budfred

      IE 11 copy/paste problem

      It has come to our attention that people using Internet Explorer 11 (IE 11) are having trouble with copy/paste to the forum. If you encounter this problem, using a different browser like Firefox or Chrome seems to get around the problem. We do not know what the problem is, but it seems to be specific to IE 11 and we are hopeful that Microsoft will eventually fix it.
Sign in to follow this  
Followers 0
krizz

Spayware slows down IE6SP1

7 posts in this topic

Please, find my log. What can I do here to get clean again?

 

Logfile of HijackThis v1.97.7

Scan saved at 01:05:38, on 29.07.2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

D:\WINNT\System32\smss.exe

D:\WINNT\system32\winlogon.exe

D:\WINNT\system32\services.exe

D:\WINNT\system32\lsass.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\system32\spoolsv.exe

D:\WINNT\System32\svchost.exe

D:\WINNT\system32\regsvc.exe

D:\WINNT\system32\MSTask.exe

D:\WINNT\system32\stisvc.exe

D:\WINNT\System32\WBEM\WinMgmt.exe

D:\WINNT\system32\mspmspsv.exe

D:\WINNT\system32\svchost.exe

D:\Program Files\Common Files\Real\Update_OB\realsched.exe

D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

D:\WINNT\system32\wuauclt.exe

D:\WINNT\explorer.exe

D:\Program Files\Trillian\trillian.exe

D:\Program Files\Internet Explorer\IEXPLORE.EXE

D:\Program Files\Diet K\DietK.exe

D:\Program Files\Kazaa Lite K++\KazaaLite.kpp

D:\Documents and Settings\Administrator\My Documents\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startpage.iload.to/?m=abc&t=&u=http...80-69C47B07B66D

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [OrbitView] D:\Program Files\Orbit\view.exe

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "D:\WINNT\Downloaded Program Files\bridge.dll",Load

O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O8 - Extra context menu item: + Offline &Explorer: Download the link - file://D:\Program Files\Offline Explorer Enterprise\Add_UrlO.htm

O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://D:\Program Files\Offline Explorer Enterprise\Add_AllO.htm

O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/ger_nopop.exe

O16 - DPF: {00000000-5555-0704-0B53-2C8830E9FAEC} - http://install.questnet.de/soft/ieloader.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab

O16 - DPF: {7EDA76EC-C571-41E4-ACCF-666141E669AB} (EPLOCtl Class) - http://www.easyplanet.net/install/installe...veXEPLO.dll.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://active.macromedia.com/flash4/cabs/swflash.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{87E46E04-7386-444C-9715-A51F6E867D5C}: NameServer = 212.122.137.24 62.26.136.136

Share this post


Link to post
Share on other sites

Hi, krizz,

 

Yes, we know what to do, however we are doing it with hundreds of people and we are swamped.

 

Have you scanned with Ad-aware and Spybot while you were waiting for help? Updated HijackThis? As soon as you are ready with these preliminaries we can move faster.

 

For now, run HJT and tick to fix these:

O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "D:\WINNT\Downloaded Program Files\bridge.dll",Load

O16 - DPF: {00000000-0000-0000-0000-000020030000} - http://www.advnt01.com/dialer/ger_nopop.exe

O16 - DPF: {00000000-5555-0704-0B53-2C8830E9FAEC} - http://install.questnet.de/soft/ieloader.cab

 

Reboot into safemode and delete the bridge.dll file here:

D:\WINNT\Downloaded Program Files\bridge.dll",Load <-file

 

Clean the temps:

Please delete your temporary files by deleting all files and folders that are in those folders (Do not delete the temp folder itself.)

For example:

C:\WINDOWS\Temp\

C:\Temp\

C:\Documents and Settings\username\Local Settings\Temp\

Also delete your Temporary Internet Files, being sure to also select "Delete All Offline Content".

 

Your version of HJT is outdated. The 1.98 version will reveal more.

Please install that and post a new log.

 

Download HijackThis to its own permanent folder.

http://www.spywareinfo.com/~merijn/files/HijackThis.exe

If that link is not working, extract from http://www.downloads.subratam.org/hijackthis.zip

To create a folder:

Click My Computer, then C:\

In the menu bar, File->New->Folder.

That will create a folder named "New Folder", which you can rename to "HJT" or "HijackThis".

Now you have C:\HJT\ folder.

Make sure in HJT that this is checked: config, misc tools, check 'include minor sections'

Double-click on the .exe to scan.

Please post a HijackThis log.. After Scan, the Scan button changes to Save Log. Click that, save it somewhere. Do Ctrl-A to Select all, and then copy and paste it here.

Thanks.

Share this post


Link to post
Share on other sites

Thanks for your answer. Yes, I scanned everything with ad-aware. Also I followed your instructions. But my IE6 still goofs around with pop-ups of http://www.p-2-p.biz and open a window minimized and titled as 'about blank'.

 

I made more logfiles for you. Please, take a look:

 

 

 

Logfile of HijackThis v1.98.0

Scan saved at 17:53:11, on 29.07.2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

D:\WINNT\System32\smss.exe

D:\WINNT\system32\winlogon.exe

D:\WINNT\system32\services.exe

D:\WINNT\system32\lsass.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\system32\spoolsv.exe

D:\WINNT\System32\svchost.exe

D:\WINNT\system32\regsvc.exe

D:\WINNT\system32\MSTask.exe

D:\WINNT\system32\stisvc.exe

D:\WINNT\System32\WBEM\WinMgmt.exe

D:\WINNT\system32\mspmspsv.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\Explorer.EXE

D:\Program Files\Common Files\Real\Update_OB\realsched.exe

D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

D:\WINNT\system32\wuauclt.exe

D:\Program Files\Internet Explorer\IEXPLORE.EXE

D:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startpage.iload.to/?m=abc&t=&u=http...80-69C47B07B66D

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O8 - Extra context menu item: + Offline &Explorer: Download the link - file://D:\Program Files\Offline Explorer Enterprise\Add_UrlO.htm

O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://D:\Program Files\Offline Explorer Enterprise\Add_AllO.htm

O16 - DPF: {7EDA76EC-C571-41E4-ACCF-666141E669AB} (EPLOCtl Class) - http://www.easyplanet.net/install/installe...veXEPLO.dll.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{87E46E04-7386-444C-9715-A51F6E867D5C}: NameServer = 212.122.137.24 62.26.136.136

 

 

 

 

 

StartupList report, 29.07.2004, 17:28:07

StartupList version: 1.52.2

Started from : D:\HJT\HijackThis.EXE

Detected: Windows 2000 SP4 (WinNT 5.00.2195)

Detected: Internet Explorer v6.00 SP1 (6.00.2800.1106)

* Using default options

* Showing rarely important sections

==================================================

 

Running processes:

 

D:\WINNT\System32\smss.exe

D:\WINNT\system32\winlogon.exe

D:\WINNT\system32\services.exe

D:\WINNT\system32\lsass.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\system32\spoolsv.exe

D:\WINNT\System32\svchost.exe

D:\WINNT\system32\regsvc.exe

D:\WINNT\system32\MSTask.exe

D:\WINNT\system32\stisvc.exe

D:\WINNT\System32\WBEM\WinMgmt.exe

D:\WINNT\system32\mspmspsv.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\Explorer.EXE

D:\Program Files\Common Files\Real\Update_OB\realsched.exe

D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

D:\WINNT\system32\wuauclt.exe

D:\Program Files\Diet K\DietK.exe

D:\Program Files\Kazaa Lite K++\KazaaLite.kpp

D:\Program Files\Internet Explorer\IEXPLORE.EXE

D:\HJT\HijackThis.exe

 

--------------------------------------------------

 

Listing of startup folders:

 

Shell folders Common Startup:

[D:\Documents and Settings\All Users\Start Menu\Programs\Startup]

Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

 

--------------------------------------------------

 

Checking Windows NT UserInit:

 

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]

UserInit = D:\WINNT\system32\userinit.exe,

 

--------------------------------------------------

 

Autorun entries from Registry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

 

Synchronization Manager = mobsync.exe /logon

TkBellExe = "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

QuickTime Task = "D:\Program Files\QuickTime\qttask.exe" -atboottime

 

--------------------------------------------------

 

Autorun entries from Registry:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

 

MsnMsgr = "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

Yahoo! Pager = D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

 

--------------------------------------------------

 

Enumerating Active Setup stub paths:

HKLM\Software\Microsoft\Active Setup\Installed Components

(* = disabled by HKCU twin)

 

[>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]

StubPath = D:\WINNT\inf\unregmp2.exe /ShowWMP

 

[>{26923b43-4d38-484f-9b9e-de460746276c}] *

StubPath = "D:\WINNT\System32\shmgrate.exe" OCInstallUserConfigIE

 

[>{881dd1c5-3dcf-431b-b061-f3f88e8be88a}] *

StubPath = "D:\WINNT\System32\shmgrate.exe" OCInstallUserConfigOE

 

[{44BBA840-CC51-11CF-AAFA-00AA00B6015C}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install

 

[{6A5110B5-E14B-4268-A065-EF89FF33C325}] *

StubPath = regsvr32.exe /s /n /i:"S 2 true 3 true 4 true 5 true 6 true 7 true" initpki.dll

 

[{7790769C-0471-11d2-AF11-00C04FA35D02}] *

StubPath = "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install

 

[{89820200-ECBD-11cf-8B85-00AA005B4340}] *

StubPath = regsvr32.exe /s /n /i:U shell32.dll

 

[{89820200-ECBD-11cf-8B85-00AA005B4383}] *

StubPath = %SystemRoot%\system32\ie4uinit.exe

 

[{89B4C1CD-B018-4511-B0A1-5476DBF70820}] *

StubPath = D:\WINNT\system32\Rundll32.exe D:\WINNT\system32\mscories.dll,Install

 

[{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}] *

StubPath = %SystemRoot%\system32\updcrl.exe -e -u %SystemRoot%\system32\verisignpub1.crl

 

--------------------------------------------------

 

Shell & screensaver key from D:\WINNT\SYSTEM.INI:

 

Shell=*INI section not found*

SCRNSAVE.EXE=*INI section not found*

drivers=*INI section not found*

 

Shell & screensaver key from Registry:

 

Shell=Explorer.exe

SCRNSAVE.EXE=*Registry value not found*

drivers=*Registry value not found*

 

Policies Shell key:

 

HKCU\..\Policies: Shell=*Registry key not found*

HKLM\..\Policies: Shell=*Registry value not found*

 

--------------------------------------------------

 

Checking for EXPLORER.EXE instances:

 

D:\WINNT\Explorer.exe: PRESENT!

 

C:\Explorer.exe: not present

D:\WINNT\Explorer\Explorer.exe: not present

D:\WINNT\System\Explorer.exe: not present

D:\WINNT\System32\Explorer.exe: not present

D:\WINNT\Command\Explorer.exe: not present

D:\WINNT\Fonts\Explorer.exe: not present

 

--------------------------------------------------

 

Checking for superhidden extensions:

 

.lnk: HIDDEN! (arrow overlay: yes)

.pif: HIDDEN! (arrow overlay: yes)

.exe: not hidden

.com: not hidden

.bat: not hidden

.hta: not hidden

.scr: not hidden

.shs: HIDDEN!

.shb: HIDDEN!

.vbs: not hidden

.vbe: not hidden

.wsh: not hidden

.scf: HIDDEN! (arrow overlay: NO!)

.url: HIDDEN! (arrow overlay: yes)

.js: not hidden

.jse: not hidden

 

--------------------------------------------------

 

Enumerating Browser Helper Objects:

 

(no name) - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

(no name) - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll - {53707962-6F74-2D53-2644-206D7942484F}

(no name) - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll - {AE7CD045-E861-484f-8273-0445EE161910}

(no name) - (no file) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13}

 

--------------------------------------------------

 

Enumerating Download Program Files:

 

[{00000000-5555-0704-0B53-2C8830E9FAEC}]

InProcServer32 = D:\WINNT\Downloaded Program Files\ieloader.dll

CODEBASE = http://install.questnet.de/soft/ieloader.cab

 

[EPLOCtl Class]

InProcServer32 = D:\WINNT\Downloaded Program Files\ActiveXEPLO.dll

CODEBASE = http://www.easyplanet.net/install/installe...veXEPLO.dll.cab

 

[shockwave Flash Object]

InProcServer32 = D:\WINNT\system32\macromed\flash\Flash.ocx

CODEBASE = http://active.macromedia.com/flash4/cabs/swflash.cab

 

--------------------------------------------------

 

Enumerating Windows NT/2000/XP services

 

AFD Networking Support Environment: \SystemRoot\System32\drivers\afd.sys (autostart)

Computer Browser: %SystemRoot%\System32\services.exe (autostart)

DHCP Client: %SystemRoot%\System32\services.exe (autostart)

Logical Disk Manager: %SystemRoot%\System32\services.exe (autostart)

DNS Client: %SystemRoot%\System32\services.exe (autostart)

Event Log: %SystemRoot%\system32\services.exe (autostart)

Microsoft HID Class Driver: System32\DRIVERS\hidusb.sys (autostart)

Server: %SystemRoot%\System32\services.exe (autostart)

Workstation: %SystemRoot%\System32\services.exe (autostart)

TCP/IP NetBIOS Helper Service: %SystemRoot%\System32\services.exe (autostart)

Messenger: %SystemRoot%\System32\services.exe (autostart)

MLPTDR_C: \??\D:\WINNT\system32\MLPTDR_C.SYS (autostart)

Removable Storage: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Plug and Play: %SystemRoot%\system32\services.exe (autostart)

IPSEC Policy Agent: %SystemRoot%\System32\lsass.exe (autostart)

Protected Storage: %SystemRoot%\system32\services.exe (autostart)

Remote Registry Service: %SystemRoot%\system32\regsvc.exe (autostart)

Remote Procedure Call (RPC): %SystemRoot%\system32\svchost -k rpcss (autostart)

Security Accounts Manager: %SystemRoot%\system32\lsass.exe (autostart)

Task Scheduler: %SystemRoot%\system32\MSTask.exe (autostart)

RunAs Service: %SystemRoot%\system32\services.exe (autostart)

System Event Notification: %SystemRoot%\system32\svchost.exe -k netsvcs (autostart)

Internet Connection Sharing: %SystemRoot%\System32\svchost.exe -k netsvcs (autostart)

Print Spooler: %SystemRoot%\system32\spoolsv.exe (autostart)

Still Image Service: %systemroot%\system32\stisvc.exe (autostart)

Distributed Link Tracking Client: %SystemRoot%\system32\services.exe (autostart)

Vcs support: \??\D:\WINNT\system32\Drivers\Vcs.sys (autostart)

Windows Management Instrumentation: %SystemRoot%\System32\WBEM\WinMgmt.exe (autostart)

WMDM PMSP Service: D:\WINNT\system32\mspmspsv.exe (autostart)

Automatic Updates: %systemroot%\system32\svchost.exe -k wugroup (autostart)

 

 

--------------------------------------------------

 

Enumerating ShellServiceObjectDelayLoad items:

 

Network.ConnectionTray: D:\WINNT\system32\NETSHELL.dll

SysTray: stobject.dll

WebCheck: D:\WINNT\system32\webcheck.dll

 

--------------------------------------------------

End of report, 9.107 bytes

Report generated in 0,156 seconds

 

Command line options:

/verbose - to add additional info on each section

/complete - to include empty sections and unsuspicious data

/full - to include several rarely-important sections

/force9x - to include Win9x-only startups even if running on WinNT

/forcent - to include WinNT-only startups even if running on Win9x

/forceall - to include all Win9x and WinNT startups, regardless of platform

/history - to list version history only

Share this post


Link to post
Share on other sites

Deleted all cookies now, and works better. I don't know about the popups. Maybe got fixed too or they might just have a rest...

 

Logfile of HijackThis v1.98.0

Scan saved at 18:20:45, on 29.07.2004

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

 

Running processes:

D:\WINNT\System32\smss.exe

D:\WINNT\system32\winlogon.exe

D:\WINNT\system32\services.exe

D:\WINNT\system32\lsass.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\system32\spoolsv.exe

D:\WINNT\System32\svchost.exe

D:\WINNT\system32\regsvc.exe

D:\WINNT\system32\MSTask.exe

D:\WINNT\system32\stisvc.exe

D:\WINNT\System32\WBEM\WinMgmt.exe

D:\WINNT\system32\mspmspsv.exe

D:\WINNT\system32\svchost.exe

D:\WINNT\Explorer.EXE

D:\Program Files\Common Files\Real\Update_OB\realsched.exe

D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

D:\WINNT\system32\wuauclt.exe

D:\Program Files\Trillian\trillian.exe

D:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] D:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - Global Startup: Acrobat Assistant.lnk = D:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O8 - Extra context menu item: + Offline &Explorer: Download the link - file://D:\Program Files\Offline Explorer Enterprise\Add_UrlO.htm

O8 - Extra context menu item: + Offline E&xplorer: Download the current page - file://D:\Program Files\Offline Explorer Enterprise\Add_AllO.htm

O16 - DPF: {7EDA76EC-C571-41E4-ACCF-666141E669AB} (EPLOCtl Class) - http://www.easyplanet.net/install/installe...veXEPLO.dll.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{87E46E04-7386-444C-9715-A51F6E867D5C}: NameServer = 212.122.137.24 62.26.136.136

Share this post


Link to post
Share on other sites

That is why I suggested cleaning the temps before you posted a new log.

 

Run HJT again with all other windows/browser closed and tick to fix these:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank

O2 - BHO: (no name) - {D848A3CA-0BFB-4DE0-BA9E-A57F0CCA1C13} - (no file)

 

Reboot.

Clean the temps again. Empty recycle bin.

Reboot.

Problem gone?

Share this post


Link to post
Share on other sites

If you need this topic reopened, please request this by sending the moderating team an email with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.
Sign in to follow this  
Followers 0