Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Stuck in disk cleanup step - oinadserver pre-post

Started by Bluesail20 , Dec 14 2006 06:03 PM

  • Please log in to reply

#1
Bluesail20
Posted 14 December 2006 - 06:03 PM

Bluesail20

    New Member

  • Member
  • Pip
  • 9 posts
I have the highly annoying oinadserver popups and wanted to post my hijackthis log. I'm new to this site and practicing due dligence, following the required steps before posting the log... now in the "Disk Cleanup" step, my computer has been "calculating how much space you will be able to free on C:" for over 2 hours. It has been showing 3 little green blips in the progress bar the whole time. How long should this take? Yes I do have a large disk , 80 Gig, with a lot of files including lots of photos and music. Properties of C drive shows 41 Gig used. But still, how long should "Disk Cleanup" take, and how does this differ from defrag? Thank you for your help.
  • 0

Advertisements

#2
MFDnSC
Posted 14 December 2006 - 06:46 PM

MFDnSC

    Banned

  • Banned
  • PipPipPipPip
  • 1,137 posts
1. Download this file :

http://download.blee...Bs/combofix.exe
http://www.techsuppo...ls/combofix.exe

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log and a HiJack log in your next reply

Note:
Do not mouseclick combofix's window while its running. That may cause it to stall
=====================
Forget disk cleanup


DownLoad EasyCleaner http://www.majorgeek...ownload414.html

Use the clear files and Unnecessary files buttons – I do not recommend
using the Duplicates files button as many dupes are there on purpose.

Not all files will delete – that is normal.

In the unnecessary button I check the top 4 entries
  • 0

#3
Bluesail20
Posted 15 December 2006 - 12:02 AM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
OK ran the EZCleaner per instructions. Here are the logs -- combofix then HJT:

Julie - 06-12-14 21:49:23.67 Service Pack 1
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\Julie\My Documents\Downloads\Spyware Stuff"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))



~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

Folders Quarantined:

C:\QooBox\Purity\Program Files\MANTEC~1
C:\QooBox\Purity\Program Files\MANTEC~1\m?hta.exe


((((((((((((((((((((((((((((((( Files Created from 2006-11-14 to 2006-12-14 ))))))))))))))))))))))))))))))))))


2006-12-14 17:36 <DIR> d-------- C:\Program Files\ToniArts
2006-12-14 11:06 <DIR> d-------- C:\HJT
2006-12-13 08:12 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-12-12 23:55 <DIR> dr-h----- C:\$VAULT$.AVG
2006-12-12 22:57 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-12-12 22:57 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-12-12 22:57 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2006-12-12 22:57 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-12-12 22:57 18,240 --a------ C:\WINDOWS\system32\drivers\avgmfx86.sys
2006-12-12 22:57 <DIR> d-------- C:\Program Files\Grisoft
2006-12-12 22:57 <DIR> d-------- C:\Documents and Settings\Julie\Application Data\AVG7
2006-12-12 22:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2006-12-12 22:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2006-12-12 12:54 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2006-12-12 12:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2006-12-12 08:05 <DIR> d-------- C:\Program Files\WinBudget
2006-12-10 10:20 0 -rahs---- C:\MSDOS.SYS
2006-12-10 10:20 0 -rahs---- C:\IO.SYS
2006-11-30 16:50 <DIR> d-------- C:\Documents and Settings\Julie\Application Data\Broderbund Software
2006-11-30 16:47 <DIR> d-------- C:\Program Files\Broderbund


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-14 18:11 -------- d-------- C:\Program Files\QuickTime
2006-12-14 17:36 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-12-14 11:47 -------- d-------- C:\Program Files\Common Files
2006-12-12 23:55 -------- d-------- C:\Program Files\dvd43
2006-12-12 16:03 -------- d-------- C:\Documents and Settings\Julie\Application Data\AdobeUM
2006-12-12 12:53 -------- d-------- C:\Program Files\HP
2006-12-12 12:10 -------- d-------- C:\Documents and Settings\Julie\Application Data\Adobe
2006-11-05 15:44 -------- d-------- C:\Documents and Settings\Julie\Application Data\Common Files
2006-11-05 15:34 -------- d-------- C:\Documents and Settings\Julie\Application Data\HP
2006-10-21 19:54 -------- d-------- C:\Program Files\Apoint2K


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"RecordNow!"=""
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Apoint"="C:\\Program Files\\Apoint2K\\Apoint.exe"
"AGRSMMSG"="AGRSMMSG.exe"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"nwiz"="nwiz.exe /install"
"iRiver Updater"="\\Updater.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"NoChange"="1"
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,e0,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-12-14 21:53:18.51
C:\ComboFix.txt ... 06-12-14 21:53
C:\ComboFix2.txt ... 06-12-14 16:56
C:\ComboFix3.txt ... 06-12-14 11:48


Logfile of HijackThis v1.99.1
Scan saved at 9:57:07 PM, on 12/14/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\WINDOWS\System32\cleanmgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\HJT\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...n&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.h...a...n&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
R3 - URLSearchHook: (no name) - {85A728E2-C454-BFD3-2454-9F5B532165E4} - C:\WINDOWS\System32\zrarbwt.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {85A728E2-C454-BFD3-2454-9F5B532165E4} - C:\WINDOWS\System32\zrarbwt.dll (file missing)
O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
O16 - DPF: {0D859AF0-C75E-11D4-B760-00E0B81077E8} (FileCruiser Class) - http://mfr.mlxchange...FileCruiser.cab
O16 - DPF: {16FD824B-8E7B-11D2-9855-00802962956C} (Specfile Control) - http://mfr.mlxchange...ol/Specfile.cab
O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://mfr.mlxchange...ontrol/SISC.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.web...wsaxcontrol.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp...ads/sysinfo.cab
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mfr.mlxchange...ectComboBox.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mfr.mlxchange...ClientUtils.cab
O16 - DPF: {78523E50-56EB-11D3-B739-CAA1986A452F} (LiteGridCtl Class) - http://mfr.mlxchange...ol/LiteGrid.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mfr.mlxchange...ol/IRCSharc.cab
O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} (Gif89 Lite Class) - http://192.168.1.240/xplugLiteAL.cab
O16 - DPF: {F060A272-A18A-11D3-B75B-00E0B81077E8} (DropList Class) - http://mfr.mlxchange...CustomCtrls.cab
O20 - AppInit_DLLs:
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


Thanks very much.
  • 0

#4
MFDnSC
Posted 15 December 2006 - 09:48 AM

MFDnSC

    Banned

  • Banned
  • PipPipPipPip
  • 1,137 posts
Please click here http://www.majorgeek...ment_d4648.html to download the latest version of JAVA Install the application, then go to the Add/Remove Programs options in the Control Panel and Remove ALL previous versions of JAVA.

=========================
Fix these with HiJackThis – mark them, close IE, click fix checked

R3 - URLSearchHook: (no name) - {8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

R3 - URLSearchHook: (no name) - {85A728E2-C454-BFD3-2454-9F5B532165E4} - C:\WINDOWS\System32\zrarbwt.dll (file missing)

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

O2 - BHO: (no name) - {85A728E2-C454-BFD3-2454-9F5B532165E4} - C:\WINDOWS\System32\zrarbwt.dll (file missing)

O2 - BHO: (no name) - {C004DEC2-2623-438e-9CA2-C9043AB28508} - (no file)

START – RUN – type in %temp% - OK - Edit – Select all – File – Delete

Delete everything in the C:\Windows\Temp folder or C:\WINNT\temp

Not all temp files will delete and that is normal
Empty the recycle bin
Boot and post a new log from normal NOT safe mode

Please give feedback on what worked/didn’t work and the current status of your system
  • 0

#5
Bluesail20
Posted 15 December 2006 - 12:28 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Here is the HJT log. Not sure if you wanted to see a combofix log too. I was able to do everything you instructed with no problems. Should I empty (delete contents of\\) the C:|QooBox folder from the previous run?

Logfile of HijackThis v1.99.1
Scan saved at 10:23:08 AM, on 12/15/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\AGRSMMSG.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HJT\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.h...a...n&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.h...a...n&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iRiver Updater] \Updater.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0\bin\jusched.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
O16 - DPF: {0D859AF0-C75E-11D4-B760-00E0B81077E8} (FileCruiser Class) - http://mfr.mlxchange...FileCruiser.cab
O16 - DPF: {16FD824B-8E7B-11D2-9855-00802962956C} (Specfile Control) - http://mfr.mlxchange...ol/Specfile.cab
O16 - DPF: {284DAE3C-A691-11D3-AD58-00E0B8107A24} (SISCtrl Class) - http://mfr.mlxchange...ontrol/SISC.cab
O16 - DPF: {2E12FB00-546B-4EE3-9CC2-057BF02E1C17} (Webshots Multiple Media Uploader - Container) - http://community.web...wsaxcontrol.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp...ads/sysinfo.cab
O16 - DPF: {4989312D-58CF-11D5-A7D7-00E02911103E} (Interealty MultiSelect) - http://mfr.mlxchange...ectComboBox.cab
O16 - DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} (MLXchange Client Utils) - http://mfr.mlxchange...ClientUtils.cab
O16 - DPF: {78523E50-56EB-11D3-B739-CAA1986A452F} (LiteGridCtl Class) - http://mfr.mlxchange...ol/LiteGrid.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://mfr.mlxchange...ol/IRCSharc.cab
O16 - DPF: {CCA0B877-CB5E-4ADC-AD30-457C379512DD} (Gif89 Lite Class) - http://192.168.1.240/xplugLiteAL.cab
O16 - DPF: {F060A272-A18A-11D3-B75B-00E0B81077E8} (DropList Class) - http://mfr.mlxchange...CustomCtrls.cab
O20 - AppInit_DLLs:
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

thank you so much! so far so good, no popups in the few minutes since I've rebooted. You folks are wonderful... a very encouraging counterpoint to the insanity and mean-spirited-ness of the people who are propagating the malware... I cannot for the life of me understand the mentality and spirit behind it... anyway, thank you very sincerely.
  • 0

#6
MFDnSC
Posted 15 December 2006 - 01:50 PM

MFDnSC

    Banned

  • Banned
  • PipPipPipPip
  • 1,137 posts
Yes you can delete C:\QooBox

Clean Posted Image

Turn off restore points, boot, turn them back on – here’s how

http://service1.syma...src=sec_doc_nam
  • 0

#7
Bluesail20
Posted 15 December 2006 - 09:37 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Ok that was pretty simple. I've noticed 2 things since working on this fix, one good, one bad: 1(good) my pc (an HP notebook) seems to be booting up faster. 2(bad) Internet explorer is having an error and closing more often, with the box that says it's "encountered a problem" and needs to close, and would I like to send a message to Microsoft with info on the problem. I always select "don't send" but I am getting this error a lot now... really a lot. Any insight on this? Thanks.
  • 0

#8
Bluesail20
Posted 15 December 2006 - 10:36 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
I got the IE error just as I hit enter to post the previous entry, and a couple more times in the last hour. And now I got the error while using Ahead Nero to prepare to burn a CD (I'm going to offload photos to free up disk space and then do a defrag). The message was the same, something like "the application has encountered an error and needs to close" with the 2 buttons to send or Don't Send. I always select Don't Send. I am starting to think this is more malware causing this problem now. Any help is greatly appreciated. Thanks.
  • 0

#9
MFDnSC
Posted 16 December 2006 - 09:21 AM

MFDnSC

    Banned

  • Banned
  • PipPipPipPip
  • 1,137 posts
IE Fix - http://windowsxp.mvps.org/IEFIX.htm - Repair - http://www.theelderg.../repair_ie6.htm

DownLoad EasyCleaner http://www.majorgeek...ownload414.html

Use the clear files and Unnecessary files buttons – I do not recommend
using the Duplicates files button as many dupes are there on purpose.

Not all files will delete – that is normal.

In the unnecessary button I check the top 4 entries
  • 0

#10
Bluesail20
Posted 16 December 2006 - 07:58 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
After these steps I still have bad things happening. IE frequently closes down with an error and Ahead Nero has numerous quirks. I'm thinking of uninstalling/reinstalling Ahead Nero, but don't know what to do about IE.
  • 0

Advertisements

#11
MFDnSC
Posted 16 December 2006 - 08:01 PM

MFDnSC

    Banned

  • Banned
  • PipPipPipPip
  • 1,137 posts
<<bad things happening>>

That does not tell me anything - be specific
  • 0

#12
Bluesail20
Posted 16 December 2006 - 09:54 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Two separate issues:
1) Internet Explorer frequently closes down with the dialog box that says "Internet Explorer has encountered a problem and has to close" or something close to that. It gives the send/don't send msg to MS buttons.

2) I also got this error once today when using Ahead Nero, and then after that, using Ahead Nero resulted in 3 problems:
1) after drag and drop of files to the left window (selection for the burn), files were reordered randomly
2) progress bar at bottom for how much space on the target disk would be available, is way off. After dragging 500 MB of files over, it indicated much less, around 200.
3) After performing the burn, the target disk is unreadable or has nothing on it although it shows in properties it's 100% used.
  • 0

#13
MFDnSC
Posted 17 December 2006 - 09:41 AM

MFDnSC

    Banned

  • Banned
  • PipPipPipPip
  • 1,137 posts
DownLoad EasyCleaner http://www.majorgeek...ownload414.html

Use the clear files and Unnecessary files buttons – I do not recommend
using the Duplicates files button as many dupes are there on purpose.

Not all files will delete – that is normal.

In the unnecessary button I check the top 4 entries


Cannot help w/Ahead Nero
  • 0

#14
Bluesail20
Posted 17 December 2006 - 07:33 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Hi, thanks, I understand about Nero, since that's so application-specific. I've already done the EasyCleaner steps several times and that's not helping with the IE error I get. Are there any other steps I can try?
  • 0

#15
Bluesail20
Posted 17 December 2006 - 07:38 PM

Bluesail20

    New Member

  • Topic Starter
  • Member
  • Pip
  • 9 posts
Once again, as soon as I clicked to post my reply, I got the very error I've been talking about. I did some cutting and pasting this time. I looked closer this time and noticed there was a link at the bottom for additional technical info, which I'm copying here after the copy of the error message text:

Internet Explorer has encountered a problem and needs to close. We are sorry for the inconvenience.

AppName: iexplore.exe AppVer: 6.0.2800.1106 ModName: ntdll.dll
ModVer: 5.1.2600.1217 Offset: 00033905
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP