[Supermoth]

I seem to have a problem with WinFixer on my computer. I took all of the steps which you recommended, and that has solved most of the pop-up problem on the computer, but I still have some pop-ups and WinFixer is always coming up telling me that there's problems. I would like to get rid of WinFixer, but I can't seem to find it. The computer is one provided by my parent company, which is located out of state. Unfortunately, staff got on the computer, downloaded stuff, and now it's having problems. When the computer is sent to us, the company has already loaded programs on it so that they can access it and send messages back and forth. I'm worried about accidently deleting an important file which is necessary for those programs. I would really appreciate any help anyone could provide. Thank you!

Here is my HijackThis log:
Logfile of HijackThis v1.99.1
Scan saved at 9:11:03 AM, on 12/4/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ntvdm.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\QuickTime\qttask.exe
C:\bwi\star\exe\MDTR2.EXE
C:\bwi\star\exe\MSGDMON.EXE
C:\bwi\star\exe\Hsts.exe
C:\bwi\bin\mdtr.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\Documents and Settings\Administrator\My Documents\My eBooks\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://online.bestw...E_REDIRECT.show
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
F3 - REG:win.ini: run=C:\bwi\star\exe\sentinel.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {D31D6E58-8044-52DA-670F-BEE5656B940B} - C:\WINDOWS\laxefnpi.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search - {BFA82212-E645-CC72-830D-9A29A58529CA} - C:\WINDOWS\laxefnpi.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Auto Updater] C:\WINDOWS\System32\aupdate.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\msbk32.dll,DllRun
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000121.exe
O4 - HKCU\..\Run: [qmkr] C:\PROGRA~1\COMMON~1\qmkr\qmkrm.exe
O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://zone.msn.com/...iveLauncher.cab
O16 - DPF: {3DA5D23B-EFE1-4181-ADB7-7D457567AACA} (TGOnlineCtrl Class) - http://zone.msn.com/...pandaonline.cab
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - ms-its:mhtml:file://c:\nesuney.mht!http://sniper34.100f...ysb_regular.cab
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://reciperewards.../rr-toolbar.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/...mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/...ro.cab34246.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/...outLauncher.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCCCBCA1-861A-441F-B27F-4C165CA64B1D}: Domain = bestwestern.com
O17 - HKLM\System\CS1\Services\VxD\MSTCP: NameServer = 192.168.1.3,192.168.1.1
O17 - HKLM\System\CS2\Services\VxD\MSTCP: NameServer = 192.168.1.3,192.168.1.1
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 192.168.1.3,192.168.1.1
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - (no file)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\eflzzao.exe (file missing)


If more information is needed, please let me know. Again, I really appreciate the help! Thank you very much!

[Advertisements]

Hi Supermoth and welcome to GeeksToGo! My name is Excal and I will be helping you.


DOWNLOAD PROGRAMS

Download and install CleanUp! Here
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.
We will use this program later.


THE FIX

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Click this link to be sure you can view hidden files.

2. Ensure you are NOT connected to the internet.

3. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

4. Open up and run Ewido:

• Click on scanner
• Click Complete System Scan and the scan will begin.
• During the scan when it ask if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK
• When the scan is finished, look at the bottom of the screen and click the Save report button.
• Save the report to your desktop

Close Ewido

5. Close all browsers, windows and unneeded programs.

6. Open HiJack and do a scan.

7. Put a Check next to the following items:

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
O2 - BHO: (no name) - {D31D6E58-8044-52DA-670F-BEE5656B940B} - C:\WINDOWS\laxefnpi.dll (file missing)
O3 - Toolbar: Search - {BFA82212-E645-CC72-830D-9A29A58529CA} - C:\WINDOWS\laxefnpi.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Auto Updater] C:\WINDOWS\System32\aupdate.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\msbk32.dll,DllRun
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000121.exe
O4 - HKCU\..\Run: [qmkr] C:\PROGRA~1\COMMON~1\qmkr\qmkrm.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - ms-its:mhtml:file://c:\nesuney.mht!http://sniper34.100f...ysb_regular.cab
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://reciperewards.../rr-toolbar.cab
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - (no file)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\eflzzao.exe (file missing)

8. click the Fix Checked box

9. Please remove these entries from Add/Remove Programs in the Control Panel(if present):

Windows Overlay Components

10. Please remove the following folders using Windows Explorer (if present):

C:\Program Files\Common Files\qmkr

11. Please remove just the files from the following paths using Windows Explorer (if present):

C:\WINDOWS\System32\aupdate.exe
C:\WINDOWS\msbk32.dll
C:\Program Files\Common Files\Windows\mc-110-12-0000121.exe
C:\WINDOWS\eflzzao.exe

12. Run the program CleanUp!

13. Reboot into normal mode and please run this online virus scan: ActiveScan - Save the results from the scan!

14. Please post the Active scan log, Ewido log and a fresh HiJackThis log. Let me know how your computer is running.

[Excal]

Hi Supermoth and welcome to GeeksToGo! My name is Excal and I will be helping you.


DOWNLOAD PROGRAMS

Download and install CleanUp! Here
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.
We will use this program later.


THE FIX

Please read this post completely, it may make it easier for you if you copy and paste this post to a new text document or print it for reference later.

1. Click this link to be sure you can view hidden files.

2. Ensure you are NOT connected to the internet.

3. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

4. Open up and run Ewido:

• Click on scanner
• Click Complete System Scan and the scan will begin.
• During the scan when it ask if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK
• When the scan is finished, look at the bottom of the screen and click the Save report button.
• Save the report to your desktop

Close Ewido

5. Close all browsers, windows and unneeded programs.

6. Open HiJack and do a scan.

7. Put a Check next to the following items:

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
O2 - BHO: (no name) - {D31D6E58-8044-52DA-670F-BEE5656B940B} - C:\WINDOWS\laxefnpi.dll (file missing)
O3 - Toolbar: Search - {BFA82212-E645-CC72-830D-9A29A58529CA} - C:\WINDOWS\laxefnpi.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Auto Updater] C:\WINDOWS\System32\aupdate.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\msbk32.dll,DllRun
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-110-12-0000121.exe
O4 - HKCU\..\Run: [qmkr] C:\PROGRA~1\COMMON~1\qmkr\qmkrm.exe
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - ms-its:mhtml:file://c:\nesuney.mht!http://sniper34.100f...ysb_regular.cab
O16 - DPF: {4E7BD74F-2B8D-469E-DEFA-EB76B1D5FA7D} - http://reciperewards.../rr-toolbar.cab
O18 - Filter: text/html - {8293D547-38DD-4325-B35A-F1817EDFA5FC} - (no file)
O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\eflzzao.exe (file missing)

8. click the Fix Checked box

9. Please remove these entries from Add/Remove Programs in the Control Panel(if present):

Windows Overlay Components

10. Please remove the following folders using Windows Explorer (if present):

C:\Program Files\Common Files\qmkr

11. Please remove just the files from the following paths using Windows Explorer (if present):

C:\WINDOWS\System32\aupdate.exe
C:\WINDOWS\msbk32.dll
C:\Program Files\Common Files\Windows\mc-110-12-0000121.exe
C:\WINDOWS\eflzzao.exe

12. Run the program CleanUp!

13. Reboot into normal mode and please run this online virus scan: ActiveScan - Save the results from the scan!

14. Please post the Active scan log, Ewido log and a fresh HiJackThis log. Let me know how your computer is running.

[Excal]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.