Unable to download Active X Controls

I think I have a virus, spyware, adware, SOMETHING!!!!!! My computer is a P4 2.8 running XP Home SP2. I'm unable to download Active X Controls for anything. I attempted to follow procedure outlined in the post, "Read Me First....." I got all the way to the online scans, but being that I can't download the Active X, was unable to perform that step. I already have Windows AntiSpyware, Spybot, Ad-Aware, and Trend Micro PC-cillin Internet Security on computer. I have updated and ran all. They detected nothing. I then completely disabled my firewall and the real time scan on PC-cillin and MA-S (firewall only on PC-cillin) and tried everything again, without success. When I close an IE window, I briefly see "about:blank" displayed before the window closes, which sometimes causes ALL IE windows to close. Extremely aggrevating! Could this have something to do with it? If not, is this something completely different, and can you help with that also? Oh, yeah, I also have Hijack This and About Buster on computer and have attached these files which I ran immediately before this post. Can you please help????? Thanks!!!!

 

First, please look in Add/Remove Programs and uninstall anything relating to MyWebSearch.

After you complete the above, download this trial version of Ewido Security Suite

• Install ewido security suite
• Launch ewido, there should be an icon on your desktop double-click it.
• The program will have a window come up. One of the buttons on the left is to Update. Click the Update button.and then Start the Update. The update will start and a progress bar will show the updates being installed.
• After it completes the update, click the Scanner button

Now exit Ewido. Now print the below instructions or save them locally because I want you do have no browsers opened and also have no connection to the internet (unplug your cable) while doing the below.

Okay, reboot into safe mode and follow the steps below. (If you have any problems at all trying to get into safe mode to complete these steps, just run them in normal boot mode and make sure you tell me when you come back.)

Open up Ewido and do the following:

• Click on Scanner
• Then click Settings
• Under What to Scan? Select Scan every file
• Then click OK
• Click on Complete System Scan and the scan will start.
• Let the program scan the machine

While the scan is in progress you will be prompted to clean files that are infected. Leave the defaults selections (to Remove and backup) and click OK. To save yourself some time, you can select Perform action with all infections and then click OK. With the option to scan every file, a lot of cookies will be removed.

Once the scan has completed, there will be a button located on the bottom of the screen named Save report

• Click Save report
• Save the report to your desktop or anyplace you will be able to find it to upload here.

Reboot into normal mode and reconnect to the internet.

Come back here and post the Ewido Scan Report along with a fresh HJT log.

 

OK. I have completed everything as instructed. The Ewido scan WAS performed in safe mode and the new HJT log was created in normal mode. Next??

 

Please look in Add or Remove Programs for the following and Uninstall them if found:

Microsoft AntiSpyware

Ewido

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portal.lifeteam.net/default.aspx
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://my.netzero.net/s/search?r=minisearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://my.netzero.net/s/search?r=minisearch

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7900
(Keep this if you need it)

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 64.136.29.30;64.136.21.30;64.136.29.34;searchap.untd.com;127.0.0.1;localhost;*mi crosoft.com;*windowsupdate.com;*wustat.windows.com;*.pogo.com;*.worldwinner.com; *test-speed.com;liveupdate.symantecliveupdate.com;*symantec.com;*.nai.com;*.netw orkassociates.com;

O2 - BHO: (no name) - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - (no file)
O2 - BHO: (no name) - {512ACF1B-64D9-4928-B382-A80556F28DB4} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O2 - BHO: (no name) - {656EC4B7-072B-4698-B504-2A414C1F0037} - (no file)
O2 - BHO: (no name) - {9579D574-D4D8-4335-9560-FE8641A013BD} - (no file)
O2 - BHO: (no name) - {E713904C-DF05-4C79-BBAD-02DB923253BE} - (no file)

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZZ

O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)

O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) -

O18 - Protocol: x-excid - {9D6CC632-1337-4A33-9214-2DA092E776F4} - c:\WINDOWS\Downloaded Program Files\mimectl.dll

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\Downloaded Program Files\mimectl.dll

NEXT:
Run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

Step #3? I know my computer was severly f*&$(^@. Computer is running much better. I'm able to download Active X Controls and the "about:blank" no longer shows up when I close IE windows. I downloaded the necessary windows updates, but they won't install. Is that something to do with what we are fixing? HJT log is attached. When I ran Ad-Aware, it only detected my solitaire game which is Super Solitaire from www.gamehouse.com. Is this a spyware or such? AA detected it as a possible BHO. A couple of questions: 1) Do I need to reinstall Microsoft AntiSpyware &/or Ewido? and 2) When I rebooted in safe mode, on the log in screen, there was on option to log in as administrator. I'm the only person on this computer, and set it up as such when I bought it (2 yrs ago). Why the administrator log in?

 

Update from post a couple hours ago. The "about:blank" IS still showing up when I close IE window, and occassionally, not as often as before, all IE windows close when trying to close just one.

 

Only if you want to, you dont need them as there are many free ones which I will provide to you when we're done.

The Administrator account is default on every system, its hidden usually but when you login Safe Mode it shows, this is normal.

 

Scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;127.0.0.1;;localhost;

O4 - Startup: Office Startup.lnk.disabled
O4 - Startup: Skyscape smARTupdate.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: DataViz Messenger.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled

Again, make sure All Browser Windows are Closed when you Click FIX.

NEXT:
Run CCleaner to clean up cookies and temp files.


After you complete the abvove, reboot and let me know how things are running.