My sisters PC is being hijacked...need help ASAP plz...

Joined
Oct 23, 2002
Messages
3,437
** I've already posted this at another forum but they are taking way too long...used to be real fast service but I guess they lost some helpers so I'll ask you guys...this is a copy/paste of my thread at the other forum **

Hey there...my sisters PC is totally messed up...I've gotten rid of MOST of the things but there's still some other things that won't go away...here's the HiJackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 9:18:26 PM, on 2/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\Sonysys\VAIO Recovery\reminder.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\javafs32.exe
C:\WINDOWS\system32\ipmj.exe
C:\Documents and Settings\neely rodgers\Desktop\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\cbafk.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {BB11A3A5-A6B5-F6CB-E5A2-F8C374F76E83} - C:\WINDOWS\system32\winns32.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [URLLSTCK.exe] C:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [CreateCD_Reminder] C:\WINDOWS\Sonysys\VAIO Recovery\reminder.exe
O4 - HKLM\..\Run: [winns32.exe] C:\WINDOWS\system32\winns32.exe
O4 - HKLM\..\RunOnce: [addez32.exe] C:\WINDOWS\system32\addez32.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1103515315765
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\System32\lxbtcoms.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\PACSPT~1.EXE
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Sony TV Tuner Controller - Sony Corporation - C:\Program Files\Sony\Giga Pocket\halsv.exe
O23 - Service: Sony TV Tuner Manager - Sony Corporation - C:\Program Files\Sony\Giga Pocket\RM_SV.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VAIO Entertainment Aggregation and Control Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzRs\VzRs.exe
O23 - Service: VAIO Entertainment File Import Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCdb\VzFw.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment\VCSW\VCSW.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Media Video Server (VAIOMediaPlatform-VideoServer-AppServer) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Video\GPVSvr.exe" /Service=VAIOMediaPlatform-VideoServer-AppServer /DisplayName="VAIO Media Video Server (file missing)
O23 - Service: VAIO Media Video Server (HTTP) (VAIOMediaPlatform-VideoServer-HTTP) - Unknown owner - C:\Program Files\Sony\vaio media integrated server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-VideoServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Applications\VideoServer\HTTP (file missing)
O23 - Service: VAIO Media Video Server (UPnP) (VAIOMediaPlatform-VideoServer-UPnP) - Sony Corporation - C:\Program Files\Sony\vaio media integrated server\Platform\UPnPFramework.exe
O23 - Service: Network Security Service (NSS) (?%AF夶À¨) - Unknown owner - C:\WINDOWS\system32\ipmj.exe
O23 - Service: Network Security Service (? 6QÔõ'ª´ÆÐ8) - Unknown owner - C:\WINDOWS\ieat32.exe (file missing)
I forgot to copy the log of the ones that I checked off and deleted...just tell me which ones should have been checked off and I'll compare them to the backed up list...

I also got an error message when removing a checked off thing...here's what it said:
Unexpected error occurred!
Error #52 (Bad file name or number) in Sub GetLongPath(?.exe).

Please send a report to [email protected], mentioning what you were doing, and what version of Windows you have.

This message has been copied to your clipboard.
My sister uses a Windows XP Home and I was getting rid of one of the checked off things above...

Plz ask for the ADS Spy report as it has some info that I also need to talk to u guys about (I read that you should wait until asked instead of posting it)...and while ur at i, ask for the startup list I got using StartUpList prog...

THANX
C'YA :cool:

P.S.: I've been told that AIM isn't working and I can't open up My Computer from the Quick Launch shortcut or the shortcut from the Desktop BUT I can "cheat" ;) and open up IE (which I have set up to open up a blank page) and type in My Computer and I can get to it that way...I can also access it from any Browse button and the Run thing and from the Start Menu and the My Computer list thing that lives on the taskbar...

But everytime I try to open it up from the other two places, it crashes or something and some Dr Watson prog opens up (I know from inspecting Task Manager) and freezes and crashes...I have to manually kill the process and then the screen blinks and taskbar goes away and comes back up and everything is running again...

P.P.S: I got rid of the Snby.exe thingy...damn that was a bitch...It wouldn't delete and I'd kill one of the two processes and it'd just come right back up instantly...damn, this new HijackThis prog is SO much better...I love it even more now...

P.P.P.S.: Yes I ran AdAware...I installed the newest version and I keep it updated...and she also has Norton AntiVirus which I keep updated...can't remember which version she has tho...I THINK it's the non-Pro NAV 2005 one...

P.P.P.P.S: Oh yeah, somehow on IE (yes I know they're not supposed to use it and they're learning Firefox and using it instead but there are a few instances where ya just gotta use IE like uncompatible Firefox websites or Windows Update and things like that) the Google Bar and the Links thing are switched...check the Links and the Google Bar thing pops up and check the Google Bar thing and the Links pops up...weird huh??? Anyway to fix that? It's just a small something that I wish to fix. I would guess that it's a registry thing.

P.P.P.P.P.S: I have run eTrust AntiVirus Web Scanner and Panda ActiveScan but was unable to run TrendMicro HouseCall because Explorer is unstable and a popup pops up after going to a webpage...it seems to just do it the first time you open up a new window but it didn't do it when the online antivirus things popped up a popup...weird...ANYWAYS eTrust detected some things and deleted everything except 2 things and then explorer crashed so I don't have a log...As for TrendMicro, I can't get it to run...it won't use Firefox and IE is too unstable for whatever it's needing to download for the scan to work...the installation of the file crashes and crashes IE...I ran the Panda one and it comes up with 29 files infected and none suspicious and 2 disinfected...I accidentally closed the Outlook thing that popped up cause I thought it was a bad popup...my reflexes closed it right away but the image stayed in my head for a few seconds and I realized that it was an Outlook popup that the Panda thingwas trying to use to send my log to my email address or something...crap!!!! Shall I re-scan this???

P.P.P.P.P.P.S.: I am re-runnung HijackThis as I have done a few things that may have changed...the above is the new log...

P.P.P.P.P.P.P.S.: I am unable to use the selection tool that the mouse does, use shift-click, use ctrl-click or, ctrl-a things in a browse menu or in My Computer...this needs fixing...

This computer is about to be taken over...it needs help...I don't think it can wait 5 days so I can post a reminder for help...my sister uses this for her work and she needs it fixed...plz help...I'm overwhelmed this time...normally I can handle this type of thing but they've gotten hit by hijacks big time...

P.P.P.P.P.P.P.P.S.: When I'm looking at My Computer or a Browse thing, I see several questionable progs in the /Windows and /Windows/System32 folder...should I make a list of the files that are in these 2 folders??? How woulld I go about constructing this list???

P.P.P.P.P.P.P.P.P.S.: In the log, the R3, the last 2 O23's, and the crazywinnings.com things will not go away...I've tried to delete them but they always turn up in the next scan...

P.P.P.P.P.P.P.P.P.P.S.: I am getting 6 svchost.exe processes showing up in the Task Manager instead of the usuall 5...I notice that one of them takes up a lot of memory so my guess is that that svchost.exe bad one...I keep on closing it

P.P.P.P.P.P.P.P.P.P.P.S.: After the Panda scan thing disinfected 2 files, I got an ieek.exe thing open up...S&D said it was trying to mess with my registry and I told it to deny changes...just thought you'd need to know about the new ieek.exe file since it is new since the HijackThis scan...I'm also getting a new ipmj.exe but that might be the Panda thing...I dunno...

Plz someone help before more bad things happen resulting in more of these P.S.'s...I've used you guys before and got help real fast like Merjin's website stated...has this place lost some helpers??? :( That's sad if u did...this is a great place to go to get help but nowadays so many ppl are getting hijacked that there's not enuff helpers...damn evil hijackers and their stoopid bad progs!!! :mad:

P.P.P.P.P.P.P.P.P.P.P.P.S.: I am getting a new homepage loading up when IE is started up...it's SUPPOSED to be loading up about:blank (a blank page) and the weird thing is it IS loading up about:blank but it's been replaced or altered and a webpage shows up...an uninstall link is posted in the upper right corner...it links to this:
Code:
http://www.enjoywebsurf.com/uninstall/index.php?pin=10001
 
WOW! I see why they are taking so long. That's one Hell of a HijackThis log. First, kill all of those IE related searchbar entries. You really are going to have to get your sister to switch to using Firefox fulltime. I'll study the other stuff, but while I'm doing that, download Microsoft Antispyware Beta. It may help you out. Anyway, we will get it cleaned up for her.
 
Get rid of this, too. (It's the bad stuff.)

O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)


This isn't highjack stuff, but she doesn't need them...

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe

This one is suspicious, too..

C:\WINDOWS\system32\ipmj.exe
 
Change the computer's name. Your sister doesn't need her name on it...

C:\Documents and Settings\neely rodgers\Desktop\HijackThis.exe
 
I would get rid of every bit of this crap, too. Other than that, SONY and Symantec put a fantastic amount of crap on, but doing something that stuff would be up to you. She does need an AV, and I don't have a clue what the SONY junk is.

O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\EROProj.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
 
Then, start the rig up again. Run HijackThis, make another log, and let's see what shows up.
 
Why do you have Encarta and AIM and Google thingy shown??? Aren't they non-spyware??? They're legit aren't they??? They use AIM and Encarta so whould I delete those ones???

And why is my text black??? I can't make it white for some reason and if I try to edit my post, it says it's already too long...weird...
 
I suggested you turn off those two because they = just extra bloat on a machine that appears to be pretty much fuxorated already. Toolbars and phone home junk are things I can live without, but leave them if you like, and concentrate on the really bad guys.
 
OK...well I'll do these Sunday...I'm at home now...I'll be back over there in about 12 hours (~noon)...I hope someone is here to help me out then when I'm sitting right in front of it...

There WAS a time where something disabled the internet...but I was advanced enuff to figure out what it was and get it deleted...I freed the internet...I may be good at getting rid of this stuff but I'm no expert...My sister is thinking of just starting over and reinstalling Windows XP...I'll install XP Pro instead of the Home that came with it and now that they're getting used to Firefox, MAYBE they'll be able to stay away from viruses and stuff for more than a month...:eek:
 
there is no reason to upgrade her to pro. unless she has dual procs or needs to join a domain. might as well use the legit version of xp that came with the machine.
 
heh...well guess what...she has dual procs...:p...first time I've ever seen dual procs too...I think it was meant to be used as a media center thingy...has DVD and came with some kind of DVD making software or something and one of those multiple card reader things and some kind of tv tuner...they don't even game on it...and it's like a 3.0GHz too...I gotta get inside that PC and find out if the mobo is worth trading...prolly not..it's a VAIO pc...
 
Just a quick word of advice. Next time, post in something that can be read without highlighting it. Black on dark grey is a lame idea to act 'tough'.

Secondly, stop using that annoying p.p.p.p.s crap, it just makes you sound like a stupid dumbass 11 year old on msn.

Thirdly, do what the others have said and remove all the out of place files in hijack this. Easy thing would be a complete reinstall of everything, would make sure it wasnt getting hijacked.

Finally, if shes doing media work as a job, tell her to get a mac. Far easier to use, run faster across the board, no spy-ware or viruses and no stupid microsoft crap.
 
I doubt she has dual processors, sounds like hyperthreading to me.

P.S throw the Sony in the garbage.
 
reinstall windows, install Sygate Personal Firewall (free) with strict permissions, install firefox.

problem fixed.
 
ScHpAnKy said:
reinstall windows, install Sygate Personal Firewall (free) with strict permissions, install firefox.

problem fixed.
Yep, Why waste Hours and hours trying to fix it! Re format and start over! I have friends that bring there PC to me to fix this, I tell them I will back up what I can and Wipe it clean.
 
I always start with the UBCD for Windows. That way, you are not even running from the C drive.

UBCD4Win has AdAware, Hijaack, and AVPersonal.

After running UBCD4Win, then boot from the hard drive and run SpyBot and such.

I have run across 5 or 6 trojans that you cannot remove while Windows is running. UBCD4Win avoids that issue.
 
Oh my...I forgot about this thread...I have solved all problems...I somehow got rid of everything...I ALMOST decided to just wipe everything and start clean...but I got it fixed...

ANYWAYS...I have 2 new problems and they can be found HERE...it has to dowith her computer...I dunno how to fix it so hop over there and check the new thread out plz...
 
Tazzman said:
Yep, Why waste Hours and hours trying to fix it! Re format and start over! I have friends that bring there PC to me to fix this, I tell them I will back up what I can and Wipe it clean.
:rolleyes: Why waste hours "days" trying to fix when you can start clean! Back up what you need thats not a program and wipe it out. You "she" will be much happier with a faster cleaner system to re f up!
 
FunkStar said:
Just a quick word of advice. Next time, post in something that can be read without highlighting it. Black on dark grey is a lame idea to act 'tough'.

Secondly, stop using that annoying p.p.p.p.s crap, it just makes you sound like a stupid dumbass 11 year old on msn.

Thirdly, do what the others have said and remove all the out of place files in hijack this. Easy thing would be a complete reinstall of everything, would make sure it wasnt getting hijacked.

Finally, if shes doing media work as a job, tell her to get a mac. Far easier to use, run faster across the board, no spy-ware or viruses and no stupid microsoft crap.

Not to start anything, but, uhh, didnt you read....he said he doesnt know why his post is in black and he cant change it for some reason....and how would that be trying to act tough, may I ask? And about that "dumbass 11 year old on MSN" thing....why such the odd number? Are you not much older than that? "Stupid dumbass"? C'mon, how old are you now? I checked your public profile, and I notice you dont put any birth year. Now why would you do that?
 
I think it's a glitch...at home (where I browse the [H] forum) I have it set to WYSIWYG mode...but when I was at my sisters house, it went to one of the other modes instead...so I dunno...my [H] account didn't like somethig about it being away from my computer...maybe it has something to do with cookies on my PC and settings saved on my [H] account...I dunno...

EDIT: Plus I tried to edit out the P.P.'s and replace it with a simpler Edit 1: etc.. but for some reason it says I can't edit it cause it's already too long...my post somehow went thruwith out even noticing that it was too long...so I can't change it...
 
Unless she has porn she cant live without I say save everyone a headache and do a clean install after swiping that drive clean. I wouldn't even want to use it even if I was able to clean it up after all that.
 
Back
Top