[Blender]

Looking at that file --- looks like autoplay for when you put DVD movies in your DVD Rom.

It don't look bad anyways.

Upload this file now:

c:\windows\system32\drivers\freedom.sys

Same place as you uploaded autoplay

Looks like the Freedom I was talking about .. but wanna make sure.

R3 Freedom (FREEDOM Miniport) - c:\windows\system32\drivers\freedom.sys <Not Verified; Zero-Knowledge Systems Inc.; Freedom>

Leme see your new uninstall list from Hijackthis.
Open Hijackthis> config> misc tools.
Open uininstall manager
Save list> post results.

Also new Hijackthis log please.

Thanks

[Advertisements]

 uninstall_list.txt   7.18KB   159 downloads

 hijackthis2.txt   7.64KB   145 downloads

and the freedom submited

Edited by harveybacon, 27 May 2008 - 10:00 PM.

[harveybacon]

 uninstall_list.txt   7.18KB   159 downloads

 hijackthis2.txt   7.64KB   145 downloads

and the freedom submited

Edited by harveybacon, 27 May 2008 - 10:00 PM.

[Blender]

Thanks

I see we finally got rid of that Earthlink

Click start> run> type cmd and hit enter.
Type sc delete freedom and hit enter.
Should get success message.

Reboot

Delete c:\windows\system32\drivers\freedom.sys

Wal-Mart Connect <-- can you uninstall this? If not --- what error you get trying?

Question...
I see Skype stuff in your Hijackthis log.
I don't see it in your add/remove list.
Still have that app or no?

Thanks

[harveybacon]

cannot unints wal-mart, file not found. No skype app/not used.

[Blender]

Open Hijackthis
Click config
misc tools
Open uninstall manager
Hilight Wal-Mart Connect
Copy/paste back here whatever is in the "uninstall command" box

Thanks

[harveybacon]

baaaaaddd.... freedom was necessary. I had to do a couple restore points to get back. Don't know, but I guess most of everything we've done today was reversed.


C:\Program Files\Common Files\wmshare\wmunins_us.exe

this is wal-mart connect

new hijack log:
 hijackthis3.txt   7.63KB   156 downloads

also not able to load irc chat. getting "X" image in irc frame

Edited by harveybacon, 27 May 2008 - 11:28 PM.

[harveybacon]

uninstall java and downloading it

works now.

Edited by harveybacon, 27 May 2008 - 11:52 PM.

[Blender]

Ouch!
Interesting about that freedom driver...

Good to hear you got it back up & running OK.
Not all that much to re-do.
ATF.exe to clear out temps and Java cache as indicated in this post:

http://www.geekstogo...26#entry1248326

Open Hijackthis
Click "config"
Click misc tools
Click "open uninstall manager"
Hilight Wal-Mart Connect and click "remove this entry".
OK the prompt.
Click the "back" button so back at main Hijackthis screen.

Fix these entries with Hijackthis:

O4 - .DEFAULT User Startup: Earthlink.lnk = ? (User 'Default user')
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

Or delete file "earthlink" file from here if Hijackthis won't fix it:

C:\Documents and Settings\Default User\Start Menu\Programs\Startup

No need to repeat the flush dns stuff --- I don't think that was the problem.

---------------------------------

I want to test something.
I wonder if your Hosts file is conflicting with McAfee firewall or something.
Go to this folder:

C:\Windows\system32\drivers\etc

Locate file called Hosts (no extension)
Right click it & choose "rename"
Call it Hosts.old

Now open Hijackthis
Click "config"
Click "misc tools"
Click "open hosts file manager"
Click Yes at the message regarding missing hosts file.
Exit Hijackthis.

Restart browser to take effect.

SNF ??

[harveybacon]

all that is done. When I reopened browser, immediately got SNF, refresh and back up.

[Blender]

Ok...

Put the Hosts file back.
Delete this file:

C:\windows\system32\drivers\etc\hosts <-- no extension.

Make sure you can see all file extensions..
Open "folder options" in control panel
Click "view"
Under "hidden files and folders" have UNchecked "hide file extensions for known file types.
Apply & OK settings if you had to change em.

Back to this folder:

C:\windows\system32\drivers\etc\

Right click hosts.old and hit "rename"
Call it Hosts (no extension)
File types: All files
Then OK.
The hosts file should look like the others there --- a generic icon that windows typically shows when it dunno what to do with file.

Spybot put a bunch of sites in restricted zone for IE so lets clear that out and see what happens.
We can always put em back later.

download http://www.mvps.org/.../DelDomains.inf and place it on desktop.
Close IE
right click the file and select install, that will reset the zone settings.

Let's do this too. Won't hurt:

Download: ResetProtocolDefaults.reg
http://www.mvps.org/...colDefaults.reg

Close IE

Locate "ResetProtocolDefaults.reg"
Right-click and select: Merge (Ok the prompt)
'
REboot & test.

SNF or ... ??

Still both FF & IE doing it?

Question:

Does your firewall have a list of sites it blocks? Typically advert sites...
I ask because in the last set of screeny's you provided showed one of google ad-sense URLs.
When you refreshed after doing the screeny -- you would have been on the site you were after (I think here)
If still getting SNF --- can you try to disable the advert blocking component in your firewall then reboot & test please.

I think all this trouble is some conflict between one or more of your protection apps.
I don't think its malware. If its malware its gotta be the stealthiest one ever!!
With all the logs I made you do -- i think we're pretty safe on that end.
Just not sure what one(s) are conflicting -- so its gunna take a bit of playing around to pin-point it.
Eventually we'll find it! LOL!

[harveybacon]

Okay. Neither of the links work, and I am not sure how to disable what you wanted (blocking). I only got this firewall (mcafee) and others since I've been on Geekstogo. I only had MS firewall before. I did not change anything when all this started. It was just a random occurrence near the end of my online school.

I did not have any real-time protection when this happened. I would have restored to a point before this all started, but I didn't think of it fast enough, and the restore point was gone.

Edited by harveybacon, 29 May 2008 - 01:22 PM.

[Blender]

Hi,

Links should work..
Right click> choose "save target as" > save em to the desktop.

Try those 2 files first before doing the McAfee thing.

[Blender]

Doing OK?

Still getting SNF errors?

[harveybacon]

yes I am still getting them. thanks for keeping up.

[harveybacon]

still have same prob. I have gotten my wisdom teeth out. Sorry I've been away. Let me know if you have any other ideas. Thanks!