[MommaJ]

Last week during the running of adaware, spyware, etc.. I got many pop-ups saying a change had been detected to my registry. I blocked them all but when I rebooted my computer, my desktop icons were all followed by ".lnk" after each file name and they would not open. I did a virus scan with my Trend Micro Internet Security and came up clean. I noticed on my tool bar on the desktop which usually shows all the programs are enabled that nothing was there now. I'm guess something has taken over...just not sure what.
I use Mozilla, Trend Micro, Ad-aware plus, spyware s & d, blaster and guard.
This is my todays hijack this: (it seems alot shorter than before...maybe thats normal)
Thanks so much for your help.

Logfile of HijackThis v1.98.2
Scan saved at 1:40:30 PM, on 11/4/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Trend Micro\Internet Security\Tmntsrv.exe
C:\Program Files\Trend Micro\Internet Security\tmproxy.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Trend Micro\Internet Security\PccPfw.exe
C:\WINDOWS\System32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Julie Jensen\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SpywareGuardDLBLOCK.CBrowserHelper - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_5_0.dll
O3 - Toolbar: Dogpile Toolbar - {5E92F538-B50B-46C5-9C5F-C6EECED3F6C6} - C:\Program Files\DogpileToolbar\ultrabar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Dogpile Cursor Search - C:\Documents and Settings\All Users\Application Data\Infospace\DogpileToolbar\contextsearch.htm
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.c...nst20040510.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab

[Advertisements]

Last week during the running of adaware, spyware, etc.. I got many pop-ups saying a change had been detected to my registry.

I'd recommend a system restore to a date before the problem began.

http://www.microsoft...ew_03may19.mspx

[admin]

Last week during the running of adaware, spyware, etc.. I got many pop-ups saying a change had been detected to my registry.

I'd recommend a system restore to a date before the problem began.

http://www.microsoft...ew_03may19.mspx

[MommaJ]

Can you determine anything from the hijack this log?
How can I prevent the problem from happening again?
Thanks for the help.
MJ

[admin]

I really don't see anything in your log, but would recommend you install antivirus software. We recommend the free version of AVG: http://free.grisoft....2/lng/us/tpl/v5

[MommaJ]

I've been running antivirus software....Trend Micro. When I did a scan it came up clean. Does that mean it missed something and I have a virus??
Thanks

[admin]

Oops! It's late, I missed that in your log. It's really hard to guess now what may have caused the problem, but it was likely some malware that was removed by Adaware -- maybe not without leaving behind some damage.

[MommaJ]

Okay, I finally got to do a system restore back to a date before I had any problems. Seemed to be working fine, so I was running all my spyware stuff. Then the same thing happened. All my files have ".lnk" after them. So, I tried it again. Same thing happened? I haven't been able to do a hijack this either. Any other suggestions?

[admin]

Please run a free online virus scan here (tick the "Auto Clean" checkbox):
http://housecall.antivirus.com/

And a free trojan scan here:
http://www.moosoft.com/

If anything is found, stop here and reply with the results. If nothing is found, then proceed with the following instructions.

.lnk is a normal extension for shortcuts, however you're not supposed to see it. This could be from registry corruption. You should be able to use the follwing code to repair it.

Make a file from the lines below called Link.reg and doubleclick it.
You can use Notepad to create it from this message. Don't retype it as
an error might occur. Copy it.
Ensure that REGEDIT4 is the first line that the last line is blank.
Backup your registry before begining.

REGEDIT4

[HKEY_CLASSES_ROOT\.lnk]
@="lnkfile"

[HKEY_CLASSES_ROOT\.lnk\ShellNew]
"Command"="C:\\WINDOWS\\rundll32.exe AppWiz.Cpl,NewLinkHere %2"

[HKEY_CLASSES_ROOT\lnkfile]
@="Shortcut"
"EditFlags"=hex:01,00,00,00
"IsShortcut"=""
"NeverShowExt"=""

[HKEY_CLASSES_ROOT\lnkfile\CLSID]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\lnkfile\shellex]

[HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler]
@="{00021401-0000-0000-C000-000000000046}"

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers]

[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}]
@=""