HIJACK THIS! Please :)

Reluctant_spender

try this if you are still having problems;

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt and save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with Dr.Web CureIt as follows:

• Double-click on launch.exe to start the program.
• Cancel any prompts to download the latest CureIt version and click Start.
• At the prompt to "Start scan now", click Ok. Allow the setup.exe/driver to load if asked by any of your security programs.
• The Express scan will automatically begin.
  (This is a short scan of files currently running in memory, boot sectors, and targeted folders).
• If an infected object is found, you will be prompted to move anything that cannot be cured. Click Yes to All.
• When complete, click Select All, then choose Cure > Move incurable.
  (This will move any detected files to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if they can't be cured)

• Now put a check next to Complete scan to scan all local disks and removable media.
• In the top menu, click Settings > Change settings, and UNcheck "Heuristic analysis" under the "Scanning" tab, then click Ok.
• Back at the main window, click the green arrow "Start Scanning" button on the right under the Dr.Web logo.
• When the scan is complete, a message will be displayed at the bottom indicating if any viruses were found.
• Click "Yes to all" if asked to cure or move the file(s) and select "Move incurable".
• In the top menu, click file and choose save report list.
• Save the DrWeb.csv report to your desktop.
• Exit Dr.Web Cureit when done.
• Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

minirolo2004

Thanks reluctant, Ill get her to do that in a sec.

Meanwhile heres some shots of her addons.


















the xml dom document one is the one that when it's running, takes the cpu usage up to 100% and freezes everything else when using IE7 to watch netflix.

Thanks again

aliEnRIK

Disable anything you dont want (the xml doc would be one im sure )
Make sure you disable CIRIX ICA CLIENT
everything by WORLDWINNER .com, MOVIENETWORKS, NETFLIX

Im also concerened you have so many saying the same. That points to nasties pretending to be something legit (Like WINDOWS LIVE for example)

Reluctant_spender

It could be a conflict somewhere - is this a company computer?

aliEnRIK

spud17 wrote: »

Could be a record?

hell no

Just a few days ago Malwarebytes found over 2300 nasties on my mates (ians) girlfriends computer! Then Avira found some more!

My personal record is ians own (my above mate) with over 3600 found before it bluescreened and died on me
That was a full reinstall of XP as it had some SERIOUS nasties on it!

minirolo2004

Nope not a company computer, personal..and sadly (or luckily :P) not mine.

Netflix is an online dvd thing she pays for to watch movies.....surely if she disables them, she cant watch the movies shes paying for? Sorry if that sounds like a silly Q - neither of us are that clued up on fixing stuff like this!

aliEnRIK

Just my personal thoughts too. Mcafee is absolute junk. Id recommend downloading a decent 3rd party firewall (Sunbelt, Comodo and Zonealarm are the top 3)

And AVIRA anti virus (More chance of picking anything up than Avast and particularly AVG)

Disconnecting from the net. Uninstalling Mcafee using the uninstall tool if need be.
Install the firewall. reconnect the net. Install Avira, UPDATE and SCAN.

aliEnRIK

minirolo2004 wrote: »

Nope not a company computer, personal..and sadly (or luckily :P) not mine.

Netflix is an online dvd thing she pays for to watch movies.....surely if she disables them, she cant watch the movies shes paying for? Sorry if that sounds like a silly Q - neither of us are that clued up on fixing stuff like this!

ahhhh

My bad. Youd be the first person I know who actually uses it. leave it be then

minirolo2004

But still get her to disable the CIRIX ICA CLIENT right?

Stupid Zango thing.

aliEnRIK

minirolo2004 wrote: »

But still get her to disable the CIRIX ICA CLIENT right?

Stupid Zango thing.

Yes, certainly for now

My main concern is ive NEVER seen so many addons on a single computer!
Im thinking some of them are a tad nasty (Though its impossible to tell from where im sitting), which is why I recommend firing off mcafee and trying Avira.

First things first though.

Download SUPERANTI SPYWARE
http://www.download.com/SUPERAntiSpyware-Free-Edition/3000-8022_4-10523889.html
UPDATE and SCAN with it (Its designed more for finding nasties in browsers than most other programs)