Post Your HijackThis logs here

[BingoBalls]

Just spied this great thread.

Anything outstanding with mine?

[Zap]

BingoBalls, you have one of the cleanest hijackthis logs I have ever seen. Did you just buy this computer or something?

You can get rid of the following line, just because you don't really need it, but there is nothing wrong with your system from a spyware perspective.

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[Kalina]

People are supposed to start their own HijackThis thread, this should be locked. I think it would keep better track of all these logs. It says right in the first post of this thread to "start your own thread" Oye!

[BingoBalls]

Originally Posted by Zap

BingoBalls, you have one of the cleanest hijackthis logs I have ever seen. Did you just buy this computer or something?

I’m glad and surprised to hear that as its 6 months old with a full hard drive.

Cheers

[Jimmy2]

Helppppppppppp I have stuff like winfixer I can't get rid of.

[Jimmy2]

I'll try to load the attached documents

[Jimmy2]

Attached

[G10]

Jimmy dude, I'm going to remove the hijack this text you placed in the thread as when this site gets spidered next, it will also bring up your hijack this log.

Can you save it all into a text file and upload it dude?

Just thought I'd let you know in case you thought I was being Mr Nasty

[John Scott]

I attached it.

[G10]

Hi Jimmy2,

Winfixer is such a pain in the backside and is something that is just going to cause you grief as you are finding out

First, make sure your Windows system is up to date. If you don't have Windows Update running on auto-pilot, I highly recommend that.

From Internet Explorer, click on Tools, then Windows Update. This will ensure that you have the latest Windows security fixes and patches.

Without that in place, you are wide open to many different exploits that can wreak havoc on your PC.

• Download the VundoFix.zip file on desktop and run the file and run it.
• In the opened window select Run VundoFix as a task
• After VundoFix reopened press Scan for Vundo button
• After scan press Remove Vundo button. Click Yes
• After VundoFix finished removal process you will be asked to shutdown the computer - press ok
• Turn on the computer
• Winfixer infection should be gone - Hopefully!

If that doesn't work, we are gona have to go for the manual approach



Let me know how that goes dude

[Jimmy2]

So far we are winfixer free. Thanks a bunch, I was about ready to chew my arm off with this thing. It is a huge pain. Thanks again G10 ( you da man)!!!

[G10]

No probs dude

[TanyaMartin]

Here is mine. I'm sure I have a bunch I can delete.

[Zap]

Working on it right now, Tanya....

[Zap]

OK, Tanya, you can get rid of....

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/mini...ansporter.cab?
O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cab
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe


There's a lot of stuff loading that doesn't need to load if you don't use it...
Alexa Toolbar
Yahoo Toolbar


You can also look through Add/Remove for items that you don't use.

The Norton software is loaded on your system. You can check that too and if you have a lot of components, maybe you can uninstall one or two but leave the antivirus.

The last thing I noticed was that you are still on SP1 for WindowsXP. Unless there is some specific reason for that, you should install SP2 and the Windows Updates that have been released since then so that the latest holes in WinXP are plugged.

[TanyaMartin]

The reason, well I got this computer the same time as my partner. She tried to update, it killed here hard drive. Dell said the hard drive wasn't compatible with the patch.

So I didn't want to take that chance.

Thank you

[kiraz]

Heres mine, can someone take a look please?

[Henny]

Here is mine

[Zap]

@Kiraz and Henny: Haven't had a chance yet and this weekend is hairy, but I'll have a look asap.

[Zap]

@Kiraz:

You can get rid of...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\lfeqh.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,valtsfq. exe
O4 - HKLM\..\Run: [autobuyerV2] C:\WINDOWS\system32\autobuyerV2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,ClientStartup -s
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] C:\Program Files\webHancer\Programs\whsurvey.exe
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKCU\..\Run: [Anonymizer] C:\Program Files\Anonymizer\Anonymizer Software\Anonymizer.exe -nogui
O4 - HKCU\..\Run: [PicoZip] C:\PROGRA~1\PicoZip\PicoZipTray.exe
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} - http://promo.dollarrevenue.com/activ...38352D2D2D.exe
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} -
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: autobuyerV2 - C:\WINDOWS\SYSTEM32\autobuyerV2.dll
O20 - Winlogon Notify: OptimalLayout - C:\WINDOWS\system32\k2no0c53ef.dll (file missing)


When you are done removing those items, update your antivirus software and do a complete scan of your computer. Remove anything it finds and then rescan with hijackthis! and post the new log here. There is a lot on your system and I want to make sure you're not infected at that time.