Problem with IE

Why would you wait so long to get this fixed??? Doing this makes it much much harder for us to find and remove your problems. Many scans we use are looking for new files/folders. Something that is 6 months old is not going to show up since it is not new. Thus there may be things that we just are not going to see now.

I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe here for now as we need it, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing.

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Uninstall the below old versions of software:
Spybot - Search & Destroy 1.5.2.20

Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

After clicking Fix, exit HJT.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Make sure that you tell me if you receive a success message about adding the above
to the registry. If you do not get a success message, it definitely did not work.

Now run Ccleaner!

Now goto this link Using MGtools and download the new version of MGtools.exe from the black bold print link in the first sentence. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

Most likely it would have been a waste of time since most of them do not have a clue when it comes to malware problems.

No! I meant the below do not belong on your Desktop. Move them somewhere else if you wish to keep them and do not download things to your Desktop anymore.

Code:

 "C:\Documents and Settings\Bill\Desktop\"
avg_ip~1.exe  Oct 26 2008    57949552  "avg_ipw_stf_en_8_196a1383.exe"
ccsetu~1.exe  Jan 25 2009      920792  "ccsetup215_slim.exe"
defrag~1.exe  Jan 25 2009     2558984  "DefragSetup.exe"
driver~1.exe  Jan 25 2009     3172744  "driverscanner.exe"
mb-setup.exe  Oct  8 2008     2189864  "mb-setup.exe"
regist~1.exe  Jun 23 2008      479488  "registry-defrag.exe"
smplay~1.exe  Dec 26 2008    12799855  "smplayer_0.6.5.1_setup.exe"
smplay~2.exe  Jan 24 2009     6949405  "smplayer_codecs_20071007.exe"
spybot~1.exe  Oct  8 2008    14968808  "spybotsd160.exe"
stella~1.exe  Feb 27 2007    17372875  "stellarium-0.8.2.exe"
supera~1.exe  Oct  8 2008     6637592  "SUPERAntiSpyware.exe"
vlc-09~1.exe  Jan 24 2009    16320472  "vlc-0.9.8a-win32.exe"

You don't need to move IE or Recyle Bin as they were already shortcuts. An no you should not be saving anything in the C:\Windows folder nor in the C:\Program Files folder which is only for installed programs.

Maybe an example of what I always do would better illustrate what I mean. I create a Downloads folder, like

C:\Downloads

Under this folder I create categories of subfolders, like:

C:\Downloads\AntiVirus
C:\Downloads\AntiSpyware
C:\Browsers
..... etc

And under those folders there are more category subfolders to contain the specific downloads. Like

C:\Downloads\AntiVirus\AVG
C:\Downloads\AntiVirus\Avast
C:\Downloads\AntiVirus\McAfee

And under them may even be more specifc folders like:

C:\Downloads\AntiVirus\AVG\AVG AntiVirus Free Edition 8.0 Build 175a1382
C:\Downloads\AntiVirus\AVG\AVG Anti-Virus Update December 15, 2008
C:\Downloads\AntiVirus\AVG\AVG Internet Security 8.0.93.1283

I think you get the point of the above. At any given point in time, I can always tell exactly what I have downloaded because the folder names (like a file cabinet) tell me exactly what I have. Even after months without looking at some file, I know exactly what is is because of where it is located. Example, if I had simply download and save WDC3Setup.exe to My Documents or to my Desktop and then a few weeks or months later see it. I would be wondering, what the heck is this..... is it safe to run it to find out what it is??? However by my method, it is not saved to My Documents, it is saved like this:

C:\Downloads\Drive-Cleaners\Wise Disk Cleaner 3.7.4\WDC3Setup.exe

That is rather self-explanatory on what it is. And it is in a safe place where nothing will delete it my mistake.

Uninstall Spybot - Search & Destroy 1.5.2.20 which is the old version and you now have the current version installed from running our procedures.

Don't need it.

In a link in my final instructions you will see a list of them.

Startup speed is different issue and this is not a malware problem when no malware is present. Your logs are clean now. You need to decide which things that you really load at startup. I definitely would not allow the below to load at startup if it were my PC:

O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

No problems leaving the logs like tens of thousands before you.





If you are not having any other malware problems, it is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /u
     • Notes: The space between the combofix" and the /u, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
   • Delete the C:\combofix folder from combofix (if it exists)
3. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
4. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
5. Go to add/remove programs and uninstall HijackThis.
6. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
7. If you are running Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures in step 3 the READ ME for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
8. After doing the above, you should work thru the below link:
   • How to Protect yourself from malware!

 

Yes you can have shortcuts to installed programs on your Desktop. When you install most programs, they already create or may ask to if you want them to create a shortcut on your Desktop. Like Ccleaner, SUPERAntiSpyware, Malwarebytes, Spybot Search & Destroy all did when you installed them. These are okay to have on your Desktop if you want them there. If you don't want those shortcuts on your Desktop you can delete them and run them via the Start, All Programs selection when you want to run them. You should not be creating shortcuts ( or links) to the installer programs.

Everyone has different opinions and also PC specs. So what may work fine for me may not fit into your needs. You could try Jetico or PC Tools (observe the notes/comments).

False claims! And it leaves your PC open to connections from everyone in the world and thus slows down both your upload and download speeds and overall PC performance. Also, you stand the risk of your ISP shutting you down since you are using their connection as a server which is more than likely illegal according to the contract you signed with them. In addition downloading via torrents and P2P programs is the largest single cause of people coming here to have malware removed from their PCs.

Software Forum would be a better place but there may be a way to configure it not to load. I rarely if ever use Windows Media Player so I could not say. All I know is on the 25 or so PCs I use, it does not load on any of them. You probably allowed it to configure the network sharing feature which most people have no need of using. You need to disable it. The service probably needs to be disabled using sevices.msc from the run box..... but as I said, this is something to discuss in the Software Forum.