A little update I ran Spybot - Search & Destroy and also ran Ad-aware it found see blow --------
coolwwwsearch.lefovers effectivebordtoolbar about:blank Also browserhijecting Okay everytime I run it it keeps finding this even if I boot to safe mode !!! It removes this than comes back .. I have ben running scans all night evem online virus and spyware scans --- In [email protected], "hotrock11" <[EMAIL PROTECTED]> wrote: > CWShredder 2.1 (search download.com for it) that will get rid of the > coolwwwsearch completely. > > And the other 3...if you have win2k/xp, get microsoft's antispyware > (its good). Webroot may also be a suitable program, but it wants money. > > Also, run an antivirus (like Avast!, which is free) and see what pops > up. If it asks to do a boottime scan, do it. When you scan, unplug > your modem/take out your phone line. > > --- In [email protected], "Matt" <[EMAIL PROTECTED]> wrote: > > The computer has ben down for weeks too many spyware and pop up > > adds .We got adware and spybot SE and done scan and it remove some > > spyware but there still syware . > > > > coolwwwsearch.lefovers > > effectivebordtoolbar > > about:blank > > Also browserhijecting > > > > > > At leat we can go on the internect but still too many spyware and pop > > up adds . > > > > Here is the hijectthis long > > > > Logfile of HijackThis v1.99.1 > > Scan saved at 12:40:52 AM, on 3/30/2005 > > Platform: Windows ME (Win9x 4.90.3000) > > MSIE: Internet Explorer v5.50 (5.50.4134.0100) > > > > Running processes: > > C:\WINDOWS\SYSTEM\KERNEL32.DLL > > C:\WINDOWS\SYSTEM\MSGSRV32.EXE > > C:\WINDOWS\SYSTEM\MPREXE.EXE > > C:\WINDOWS\SYSTEM\SSDPSRV.EXE > > C:\WINDOWS\SYSTEM\mmtask.tsk > > C:\WINDOWS\SYSTEM\STIMON.EXE > > C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE > > C:\WINDOWS\EXPLORER.EXE > > C:\WINDOWS\SYSTEM\SYSTRAY.EXE > > C:\CPQS\BWTOOLS\SCCENTER.EXE > > C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\CPQEADM.EXE > > C:\WINDOWS\RUNDLL32.EXE > > C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\BTTNSERV.EXE > > C:\WINDOWS\SYSTEM\WMIEXE.EXE > > C:\PROGRAM FILES\COMPAQ\EASY ACCESS BUTTON SUPPORT\EAUSBKBD.EXE > > C:\WINDOWS\SYSTEM\DDHELP.EXE > > C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\UPDATES\IMMUFIX.EXE > > C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE > > C:\PROGRAM FILES\WINZIP\WINZIP32.EXE > > C:\WINDOWS\TEMP\HIJACKTHIS.EXE > > > > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = > > res://C:\WINDOWS\TEMP\se.dll/spage.html > > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = > > about:blank > > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = > > res://C:\WINDOWS\TEMP\se.dll/spage.html > > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = > > about:blank > > R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant > > = about:blank > > R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant > > = about:blank > > R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = > > about:blank > > R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = > > about:blank > > O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D- > > 784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0 > > \READER\ACTIVEX\ACROIEHELPER.DLL > > O2 - BHO: (no name) - {3E6DBF82-3656-4AA5-B205-CE202617A648} - > > C:\WINDOWS\SYSTEM\NBIO.DLL > > O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - > > C:\Program Files\Spybot - Search & Destroy\SDHelper.dll > > O3 - Toolbar: @msdxmLC.dll,[EMAIL PROTECTED],&Radio - {8E718888-423F-11D2- 876E- > > 00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX > > O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun > > O4 - HKLM\..\Run: [SystemTray] SysTray.Exe > > O4 - HKLM\..\Run: [Service Connection] c:\cpqs\bwtools\sccenter.exe > > O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\Compaq\Easy Access > > Button Support\cpqeadm.exe > > O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall > > O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe > > O4 - HKLM\..\RunServices: [*StateMgr] > > C:\WINDOWS\System\Restore\StateMgr.exe > > O4 - HKLM\..\RunServices: [StillImageMonitor] > > C:\WINDOWS\SYSTEM\STIMON.EXE > > O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E- > > 00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE > > O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910- F110- > > 11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE > > O9 - Extra button: Translate - {06FE5D05-8F11-11d2-804F- > > 00105A133818} - http://search.presario.net/scripts/...&c=3c00&LC=1009 > > (file missing) > > O9 - Extra 'Tools' menuitem: AV &Translate - {06FE5D05-8F11-11d2- 804F- > > 00105A133818} - http://search.presario.net/scripts/...&c=3c00&LC=1009 > > (file missing) > > O9 - Extra button: (no name) - {06FE5D02-8F11-11d2-804F- > > 00105A133818} - http://search.presario.net/scripts/...&c=3c00&LC=1009 > > (file missing) > > O9 - Extra 'Tools' menuitem: &Find Pages Linking to this URL - > > {06FE5D02-8F11-11d2-804F-00105A133818} - > > http://search.presario.net/scripts/...&c=3c00&LC=1009 (file missing) > > O9 - Extra button: (no name) - {06FE5D03-8F11-11d2-804F- > > 00105A133818} - http://search.presario.net/scripts/...&c=3c00&LC=1009 > > (file missing) > > O9 - Extra 'Tools' menuitem: Find Other Pages on this &Host - > > {06FE5D03-8F11-11d2-804F-00105A133818} - > > http://search.presario.net/scripts/...&c=3c00&LC=1009 (file missing) > > O9 - Extra button: (no name) - {06FE5D04-8F11-11d2-804F- > > 00105A133818} - http://search.presario.net/scripts/...&c=3c00&LC=1009 > > (file missing) > > O9 - Extra 'Tools' menuitem: AV Live - {06FE5D04-8F11-11d2-804F- > > 00105A133818} - http://search.presario.net/scripts/...&c=3c00&LC=1009 > > (file missing) > > O18 - Filter: text/plain - {5F4658DD-656C-48B5-8669- 89F64A17C865} - > > C:\WINDOWS\SYSTEM\NBIO.DLL > > O18 - Filter: text/html - {5F4658DD-656C-48B5-8669-89F64A17C865} - > > C:\WINDOWS\SYSTEM\NBIO.DLL If you have any questions or problems with any aspect of this site, please feel free to contact me directly [EMAIL PROTECTED] Please do not post personal issues directly to the group. To unsubscribe from this list, send an email to [EMAIL PROTECTED] Thank you for using A-1 Computer Tech Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/A-1-Computer_Tech/ <*> To unsubscribe from this group, send an email to: [EMAIL PROTECTED] <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/
