Help! I've tried everything listed here and still need help!

First, I have completed all the steps in your sticky post - HOW TO:SPYWARE, TROJAN AND VIRUS REMOVAL. Twice. Stuff is still popping up R0 in my Hijack this log. I've run all the downloads multiple times and done regedits, but it keeps coming back.

My roommate clicked where she shouldn't have and downloaded this crap onto my computer. The steps above helped only slightly. I am still innudated with popups everytime I log on. There are all sorts of strange looking things in my registry and I don't what is and isn't good.

My browser is still being hijacked.

HELP!

 

Make sure you have HijackThis 1.99.1 and follow the guidelines on where to install it and how to post a log as an attachment. This is all covered in the sticky thread NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting

Now post a HijackThis log as an attachment to your message (Do not post the log inline). All running programs should be closed, including your web browser and e-mail. Please close these before running Hijack This!

To repeat: Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file. Place it in its own folder, for example C:\Program Files\HJT


We are very busy here at MajorGeeks.Com PhilliePhan, Chaslang or myself with check back when time permits.!

 

Thank you!! Here's the log. Hope I followed the steps right.

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

P2P Networking

AutoUpdate

CxtPls

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.



Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:


P2P Networking.exe

76spwt4n.exe

winupdt.exe

76spwt4n1.exe

AutoUpdate.exe

xolbvm50.exe

3cdpstui.exe

CxtPls.exe



Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll

O2 - BHO: (no name) - {038CF93D-9665-453C-BD98-D95BCA97ACFA} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {0BDBF5E5-39D0-4692-BA3B-B8622FB00735} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: SDWin32 Class - {16CA2C89-AB54-43C8-A3AC-6AFB506ABA6D} - C:\WINNT\system32\vlwvi.dll

O2 - BHO: (no name) - {3D94BA10-4CBE-4C73-82FB-F3E8715B4E59} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: MSW.cIExplorer - {4B57B77A-B130-4EB8-8CFB-42B880F6D311} - C:\Documents and Settings\Administrator\Desktop\OLD USER FOLDERS\Application Data\msw\MSW.dll

O2 - BHO: CAUN Object - {59F12660-2B92-4554-98F9-87295AD8A0CE} - C:\WINNT\system32\AUNBHO.dll

O2 - BHO: (no name) - {6112DF56-36D0-43C9-A0A2-C0E3192C3E3D} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {69A6BB4F-FBAC-4E4E-8EEE-3A592DB033D2} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {70B62A06-C418-45DE-8B04-6CB4CA970518} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {7B2315FE-F8BC-45BD-A637-73F70A70517F} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: SDWin32 Class - {8CA9897E-C880-4AE3-9366-73A24922479E} - C:\WINNT\system32\txtxq.dll

O2 - BHO: (no name) - {A12CCE46-2C0E-4CF2-AE7E-B52E3AF173F3} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {C6887210-C011-43F0-BFDE-4E54965BA53F} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {E111D451-BCD7-4CD2-8AB0-EBF905DB8673} - C:\Program Files\76spwt4n\76spwt4n.dll

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\system32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [txtxqc] C:\WINNT\system32\txtxqc.exe

O4 - HKLM\..\Run: [76spwt4n] C:\Program Files\76spwt4n\76spwt4n.exe

O4 - HKLM\..\Run: [vlwvic] C:\WINNT\system32\vlwvic.exe

O4 - HKLM\..\Run: [winupdtl] C:\WINNT\system32\winupdt.exe

O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"

O4 - HKLM\..\Run: [qp5T3qi] 3cdpstui.exe

O4 - HKCU\..\Run: [bEu3RkGFT] xolbvm50.exe

O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone

O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone

O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O23 - Service: MacFormatService - Unknown owner - C:\Program Files\Conversions Plus\FORMATM.EXE" /SERVICE (file missing)


Again, make sure All Browser Windows are Closed when you Click FIX.


NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:


C:\WINNT\system32\P2P Networking <--- Delete Whole Folder!

C:\Program Files\AutoUpdate <--- Delete Whole Folder!

C:\Program Files\CxtPls <--- Delete Whole Folder!

C:\Program Files\76spwt4n <--- Delete Whole Folder!

C:\WINNT\system32\winupdt.exe

C:\WINNT\system32\xolbvm50.exe

C:\WINNT\system32\3cdpstui.exe

C:\WINNT\system32\vlwvi.dll

C:\WINNT\system32\AUNBHO.dll

C:\WINNT\system32\txtxqc.exe

C:\WINNT\system32\vlwvic.exe

C:\Documents and Settings\Administrator\Desktop\OLD USER FOLDERS\Application Data\msw\MSW.dll

3cdpstui.exe <--- Search and delete if found!

xolbvm50.exe <--- Search and delete if found!



NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"



Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

First, thank you for getting back to me so quickly!

I did all the steps below as listed and so far no popup windows, but when I ran HijackThis again the dreaded R0 crap is still showing up! grrrr....

On a side note (possibly related??) I had noticed when I did a regedit (before I posted here) in the registry were two strange things - both in the HKCU - Software/microsoft/windows/currentversion/internet settings

1. P3P folder which had a history folder listing a vast amount of websites I certainly never visited.

2. Below the P3P folder, another called ZoneMap, which had a domain folder listing even more websites I would never visit.

All in all though, things seem to be moving faster on the Internet and I haven't been interrupted with annoying windows while typing this post!

Attached as requested is the log.

I wish I could buy you a beer at least for helping me with this.

 

First:


Please download DelDomains and unzip it to your desktop.

Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.


Second:

Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =



Third:

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.


After you do these steps, post a new HJT log.

 

Here's the new log.

Thanks!

 

Save the below information in notepad, save this as ResetIESearch.reg

Double click the file ResetIESearch.reg you just saved and when it prompts you to import into the registry click OK

After you do the above, have HJT fix these entries.

O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone

O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone

O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be
Internet Zone


Now, Reboot and post new HJT log.