SpywareNo porblems now bigger than I thought! Help!!

Some of your problems are due to the fact the you have downloaded your updates from Microsoft. You are way out of date. After we try to fix your current problems, you must get updated. You also do not have a firewall installed which is a very bad thing to not have.

You have multiple problems. One of them is a nasty HSA hijacker (mentioned quite a bit in the sticky threads).

You seem to be running msconfig to control startups. You will need to stop using it. Set it to Normal Startup.

Let's see if we can start to make a dent in your problems. Did you download and run (I know you cannot update right now) About:Buster. If not, download about:Buster now. Run it and save the log. Immediately after it completes, reboot your PC into safe mode. And run About:Buster again in safe mode. Then reboot into normal mode. Please post the About:Buster log.

Then continue onto my next message.

 

After running About:Buster per my previous message and posting the log. Continue with the below. Note that some items given may no longer be found because their names may have changed. The hijacker does this to make things difficult.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\SYSTEM\SVHOST.EXE
C:\WINDOWS\SYSTEM\APPIU.EXE
C:\PROGRAM FILES\COMMON FILES\MC-58-12-0000093.EXE

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\clqpg.dll/sp.html#34429
R3 - Default URLSearchHook is missing
F1 - win.ini: run=C:\WINDOWS\SYSTEM\svhost.exe
O2 - BHO: Class - {AB1F2469-424C-0E58-738F-2149079121EF} - C:\WINDOWS\SYSTEM\SDKNY.DLL
O4 - HKLM\..\Run: [EXPLORER.EXE] C:\WINDOWS\EXPLORER.EXE
O4 - HKLM\..\Run: [APPIU.EXE] C:\WINDOWS\SYSTEM\APPIU.EXE
O4 - HKLM\..\Run: [System backup] C:\WINDOWS\SYSTEM\MSXMIDI.EXE
O4 - HKLM\..\RunServices: [APPKW.EXE] C:\WINDOWS\APPKW.EXE /s
O4 - HKCU\..\Run: [Sopc] C:\WINDOWS\Application Data\hraa.exe
O4 - HKCU\..\Run: [System backup] C:\WINDOWS\SYSTEM\MSXMIDI.EXE
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000093.exe
O8 - Extra context menu item: LimeShop Preferences - file://c:\Program Files\topMoxie\TEMP\limeshop_script.htm
O13 - WWW. Prefix: http://
O15 - Trusted Zone: *.c4tdownload.com
O15 - Trusted Zone: *.awmdabest.com
O15 - Trusted Zone: *.addictivetechnologies.com
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted Zone: *.c4tdownload.com (HKLM)
O15 - Trusted Zone: *.overpro.com (HKLM)
O15 - Trusted Zone: *.megapornix.com (HKLM)
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.addictivetechnologies.com (HKLM)
O15 - Trusted Zone: *.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O16 - DPF: {32F36743-3FDE-4AB3-3793-4CE327E12C72} - http://67.19.178.86/1/rdgAU1742.exe

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\SYSTEM\SVHOST.EXE
C:\WINDOWS\SYSTEM\APPIU.EXE
C:\PROGRAM FILES\COMMON FILES\MC-58-12-0000093.EXE
C:\WINDOWS\SYSTEM\SDKNY.DLL
C:\WINDOWS\SYSTEM\APPIU.EXE
C:\WINDOWS\SYSTEM\MSXMIDI.EXE
C:\WINDOWS\APPKW.EXE
C:\WINDOWS\Application Data\hraa.exe
c:\Program Files\topMoxie <--- the whole folder

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST).

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

DO NOT REBOOT OR POWER DOWN AT THIS POINT. If you do, my next suggested fixes may not be of any use. This hijacker can respawn and rename upon reboot.

 

Have you run the steps in message # 3 yet?

 

That looks alot better but you did not answer how things are working.

We have to apply another fix though to get rid of those two Trusted Zone entries:

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixTZ.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixTZ.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to add to the registry say yes.

Then double check your HJT log yourself to make sure those two O15 lines are now gone. Let me know.

 

I'm not sure what is wrong with your Wireless connection. You may need to check all your network configuration parameters or possible reinstall the Software. That may be a topic better discussed in the Networking or Software Forums.

You can reboot or power down now that you are clean. And to help keep you clean, check out the below:

How to Protect yourself from malware!