PLEASE HELP! My browser has been Hijacked and I can't do anything - whever I go on the internet it just redirects me. Here is the HijackThis log file - can someone please tell me which entries I need to fix and what files are missing....also how to fix it all! I'm desperate now!!! Logfile of HijackThis v1.99.1 Scan saved at 5:03:25 PM, on 1/06/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\fast.exe C:\WINDOWS\System32\taskswitch.exe C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\DNA\btdna.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\QuickTime\QTTask.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\Documents and Settings\LocalService\cftmon.exe C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE C:\Program Files\Nero\Nero8\InCD\NBHGui.exe C:\Program Files\Nero\Nero8\InCD\InCD.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe C:\WINDOWS\System32\Fast.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\PSIService.exe C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Spyware & Security Tools\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: StumbleUpon Launcher - {145B29F4-A56B-4b90-BBAC-45784EBEBBB7} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll O2 - BHO: Mininova Toolbar - {f592709f-ff4a-4862-b659-4afabda56312} - C:\Program Files\Mininova\tbMini.dll O3 - Toolbar: StumbleUpon Toolbar - {5093EB4C-3E93-40AB-9266-B607BA87BDC8} - C:\Program Files\StumbleUpon\StumbleUponIEBar.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL O3 - Toolbar: Mininova Toolbar - {f592709f-ff4a-4862-b659-4afabda56312} - C:\Program Files\Mininova\tbMini.dll O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\System32\taskswitch.exe O4 - HKLM\..\Run: [FastUser] C:\WINDOWS\System32\fast.exe O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe O4 - HKLM\..\Run: [iKeyWorks] C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [WheelMouse] C:\PROGRA~1\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero8\InCD\InCD.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Owner\cftmon.exe O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [BM5327d81b] Rundll32.exe "C:\WINDOWS\system32\ahcphjdp.dll",s O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe" O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [EPSON Stylus CX5500 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAP.EXE /FU "C:\WINDOWS\TEMP\E_SE6.tmp" /EF "HKCU" O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Owner\cftmon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.auctiva.com/hostedimages/activex/xupload/XUpload.ocx O16 - DPF: {EA1B8527-E422-4909-825A-70BE0694F18E} (PortfolioManagerWT ProfileManager Class) - https://online.westpac.com.au/wtoa/wtOtherAccounts/portfoliomanagerwt.cab O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.1.6.cab O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: xxyaArRH - xxyaArRH.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing) O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
Hi jsparke. I have picked out a few suspicious entries with your log. O4 - HKLM\..\Run: [BM5327d81b] Rundll32.exe "C:\WINDOWS\system32\ahcphjdp.dll",s O20 - Winlogon Notify: xxyaArRH - xxyaArRH.dll (file missing) Also, please post here the contents of your hosts file (C:\Windows\system32\drivers\etc). You can open it with notepad. To fix your malware problem, please download A-squared, and then post the A-squared scan log here, without deleting anything. Best Regards PS: I see that you have btdna.exe and Mininova toolbar, both of which have to do with torrent files, and can introduce malware into your system if infected torrent files are run.
Hi cdavfrew, Thanks. I amruuning A-Sqaured now nd will post the log when done (as long as I can work out how t see the log after scanning) Did you think I should delete those entries you mntioned from HijackThis? I'm not actually sure what you mean by :- please post here the contents of your hosts file (C:\Windows\system32\drivers\etc). You can open it with notepad. Could you please advise wher eI can find this info so I can post it here. Thanks for our help, I hope I can get this fixed soon.
Here is the log from A-Squared (nothing deleted) a-squared Anti-Malware - Version 3.5 Last update: 1/06/2008 6:59:02 PM Scan settings: Objects: Memory, Traces, Cookies, C:\WINDOWS\, C:\Program Files Scan archives: On Heuristics: On ADS Scan: On Scan start: 1/06/2008 7:00:07 PM Value: HKEY_CLASSES_ROOT\arlnk --> URL Protocol detected: Trace.Registry.Ares Key: HKEY_CLASSES_ROOT\clsid\{9afb8248-617f-460d-9366-d71cdeda3179} detected: Trace.Registry.FunWebProducts Key: HKEY_CLASSES_ROOT\clsid\{147a976f-eee1-4377-8ea7-4716e4cdd239} detected: Trace.Registry.MyWebSearchToobar Key: HKEY_CLASSES_ROOT\clsid\{147a976f-eee1-4377-8ea7-4716e4cdd239} detected: Trace.Registry.MyWebSearchToolbar c:\windows\hh.ico detected: Trace.File.Xtractor Plus 3.6 Value: HKEY_CLASSES_ROOT\CLSID\{0AF8185C-26D7-4607-A005-7D586B750C38}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_CLASSES_ROOT\CLSID\{5BF31631-3D94-4267-B6F4-0CE18B008928}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_CLASSES_ROOT\CLSID\{D322CFB6-5195-4EDA-87CA-6D624CCF2751}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_CLASSES_ROOT\CLSID\{EFC25C6F-1A04-43FD-AB25-0F3ED89E050A}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0AF8185C-26D7-4607-A005-7D586B750C38}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BF31631-3D94-4267-B6F4-0CE18B008928}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D322CFB6-5195-4EDA-87CA-6D624CCF2751}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EFC25C6F-1A04-43FD-AB25-0F3ED89E050A}\InprocServer32 --> ThreadingModel detected: Trace.Registry.Blubster Value: HKEY_LOCAL_MACHINE\SOFTWARE\Freeze.com\Installer --> id detected: Trace.Registry.Living Beaches #2 Animated Wallpaper Value: HKEY_CLASSES_ROOT\CLSID\{03A1A408-CB07-4C90-B380-78C83828707D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{0622801A-0B11-4A90-A036-56CC93D4AA5E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{08CEC807-8452-4CE0-B682-6ED8FAC75FDB}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{09A3D436-4063-46DA-9DD6-0A4FE9D3F887}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{12798743-BA16-448C-B122-8A3EA40ECEB0}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{13151C33-1150-4D7A-8E43-87CA44E85D7E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{1A1FF417-C908-41F0-9AED-ED312EB68500}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{2062525A-D503-4ECE-A3C2-D1883DCBBFA6}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{247F1754-ABE2-4985-9A7A-94E106EDD15D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{29C32CDC-26AA-42C5-A6FD-2192F59B24BB}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{2AD3DEA9-C68D-4976-A627-5CA4ADF99EC4}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{38975430-A042-48C7-B6B9-42875B895589}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{4340BF93-8CB0-4DD9-89ED-5B2980E3F98C}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{4B51C1BC-C1EF-4DC6-B50E-61C50DDBFED0}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{4CE53602-D079-410F-BE21-0F86C472709D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{5BAD6705-C8AB-49FD-B76B-031C66171FFA}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{61634438-3BA1-419B-8CFB-A94ADF2B7B6A}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{6A5FB6A5-4B93-430F-A747-CA4F01A2BDB7}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{6DA92D60-5B0C-425E-97C8-658865A96E7D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{7237A978-67A9-455C-8E99-3E0A5B1AECEF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{7AB80000-6E98-4A2B-814E-8F259331AAFF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{8372E131-F6DF-41CE-AC89-FC5F2AB7FE0F}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{93993BC0-C75C-429A-819D-B04E7ED885DA}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{93E1BF2D-FAB5-4243-BD25-0EFDB8964935}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{A2AC1E1F-8F6B-4CA3-80EF-9AAEF18AA0EF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{AEFB259B-2CA8-47C5-AAB4-6557DFCC97D3}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{B269327C-3440-487A-8CDC-1A7741C467E9}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{BAF45FE2-CA67-49EE-BC0E-916B9F861E1E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{D0900FFC-332A-4405-A09E-C6147772D0A2}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{D0B07D23-4A06-4152-87EB-FD201233B137}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{D6D7387C-7369-49DD-B791-CD12A2243895}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{D8286F34-EEDA-4898-9EC7-D2D9E70DDBBF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{DAC39EE6-F721-4B4B-834D-244506139197}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{E615A9D8-2FAD-4732-803C-FFB21CA1EAEF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{E72E7BFF-7D81-4211-8598-77C701A827B8}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{FDC077D4-7094-4CC9-A3B6-9C28C362FF1E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_CLASSES_ROOT\CLSID\{FF9982B4-EB7D-49CF-A76A-08F38119FAB4}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_USERS\S-1-5-21-1214440339-413027322-839522115-1003\Software\Winferno\RegPowerClean --> AutoBackup detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_USERS\S-1-5-21-1214440339-413027322-839522115-1003\Software\Winferno\RegPowerClean --> SBOption detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_USERS\S-1-5-21-1214440339-413027322-839522115-1003\Software\Winferno\RegPowerClean --> StartBehavior detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{03A1A408-CB07-4C90-B380-78C83828707D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0622801A-0B11-4A90-A036-56CC93D4AA5E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08CEC807-8452-4CE0-B682-6ED8FAC75FDB}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{09A3D436-4063-46DA-9DD6-0A4FE9D3F887}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{12798743-BA16-448C-B122-8A3EA40ECEB0}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{13151C33-1150-4D7A-8E43-87CA44E85D7E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1A1FF417-C908-41F0-9AED-ED312EB68500}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2062525A-D503-4ECE-A3C2-D1883DCBBFA6}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{247F1754-ABE2-4985-9A7A-94E106EDD15D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{29C32CDC-26AA-42C5-A6FD-2192F59B24BB}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2AD3DEA9-C68D-4976-A627-5CA4ADF99EC4}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{38975430-A042-48C7-B6B9-42875B895589}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4340BF93-8CB0-4DD9-89ED-5B2980E3F98C}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4B51C1BC-C1EF-4DC6-B50E-61C50DDBFED0}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4CE53602-D079-410F-BE21-0F86C472709D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAD6705-C8AB-49FD-B76B-031C66171FFA}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{61634438-3BA1-419B-8CFB-A94ADF2B7B6A}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A5FB6A5-4B93-430F-A747-CA4F01A2BDB7}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6DA92D60-5B0C-425E-97C8-658865A96E7D}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7237A978-67A9-455C-8E99-3E0A5B1AECEF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7AB80000-6E98-4A2B-814E-8F259331AAFF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8372E131-F6DF-41CE-AC89-FC5F2AB7FE0F}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93993BC0-C75C-429A-819D-B04E7ED885DA}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93E1BF2D-FAB5-4243-BD25-0EFDB8964935}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A2AC1E1F-8F6B-4CA3-80EF-9AAEF18AA0EF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEFB259B-2CA8-47C5-AAB4-6557DFCC97D3}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B269327C-3440-487A-8CDC-1A7741C467E9}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BAF45FE2-CA67-49EE-BC0E-916B9F861E1E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0900FFC-332A-4405-A09E-C6147772D0A2}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D0B07D23-4A06-4152-87EB-FD201233B137}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D6D7387C-7369-49DD-B791-CD12A2243895}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D8286F34-EEDA-4898-9EC7-D2D9E70DDBBF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DAC39EE6-F721-4B4B-834D-244506139197}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E615A9D8-2FAD-4732-803C-FFB21CA1EAEF}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E72E7BFF-7D81-4211-8598-77C701A827B8}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDC077D4-7094-4CC9-A3B6-9C28C362FF1E}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF9982B4-EB7D-49CF-A76A-08F38119FAB4}\InprocServer32 --> ThreadingModel detected: Trace.Registry.RegistryPowerCleaner Value: HKEY_LOCAL_MACHINE\SOFTWARE\Freeze.com\Installer --> id detected: Trace.Registry.EZ Game Cheats Value: HKEY_CLASSES_ROOT\arlnk --> URL Protocol detected: Trace.Registry.Ares Galaxy P2P Plus Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\arlnk --> URL Protocol detected: Trace.Registry.Ares Galaxy P2P Plus c:\windows\fish.scr detected: Trace.File.Fish ScreenSaver C:\Documents and Settings\Owner\Cookies\owner@adtech[1].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@com[1].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@media.adrevolver[1].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@media.adrevolver[2].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@media6degrees[2].txt detected: Trace.TrackingCookie C:\Documents and Settings\Owner\Cookies\owner@trafficmp[1].txt detected: Trace.TrackingCookie C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL detected: Riskware.AdTool.Win32.MyWebSearch.az C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL detected: Riskware.AdTool.Win32.MyWebSearch.az C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL detected: Riskware.AdTool.Win32.MyWebSearch.az Scanned Files: 191130 Traces: 412111 Cookies: 43 Processes: 70 Found Files: 3 Traces: 95 Cookies: 8 Processes: 0 Registry keys: 0 Scan end: 1/06/2008 8:36:51 PM Scan time: 1:36:44
Woah.... you a-squared log sure tries to make a message! I will allow you to delete everything on that log, as long as you have no problem with it. You should probably look through it, and ignore anything you intentionally put on your system. Everything else should be deleted. Also, as for your hijack this entries, yes, you can check them and then click the option "fix". For your hosts file, navigate to C:\Windows\system32\drivers\etc and then open the hosts file in notepad. Best Regards
Hi, Thanks. I have delted/fixed hjackthis entries, and now running a-squared to dleter all there too. Here is the oher hosts file: # Copyright (c) 1993-1999 Microsoft Corp. # # This is a sample HOSTS file used by Microsoft TCP/IP for Windows. # # This file contains the mappings of IP addresses to host names. Each # entry should be kept on an individual line. The IP address should # be placed in the first column followed by the corresponding host name. # The IP address and the host name should be separated by at least one # space. # # Additionally, comments (such as these) may be inserted on individual # lines or following the machine name denoted by a '#' symbol. # # For example: # # 102.54.94.97 rhino.acme.com # source server # 38.25.63.10 x.acme.com # x client host 127.0.0.1 localhost What does all this mean?????
You should be all good now. Your hosts file shows nothing bad, only the default parameters and such. You can read all about the hosts file here (http://en.wikipedia.org/wiki/Hosts_file), and learn what it used for. Then you can understand those lines. That's it! If you still have problems, feel free to post here! Best Regards
