internet explorer..opens too many

aliEnRIK

TICK this in hijack and FIX it ~
R3 - URLSearchHook: (no name) - - (no file)

Please run COMBOFIX
Follow the simple instructions it gives
Post the COMPLETE log it creates here (Split into sections if need be)

If it comes up with a RENAMING error then RIGHT click the exe file and RENAME and call it QWERTY (Making the complete file name 'QWERTY.exe') Or SAVE as 'QWERTY' on download

aliEnRIK

hamaradam wrote: »

By the way, Thanks aliEnRIK, very much, :beer:for simplifying how to do this! much appreciated. Whenever I ask the computer man he is reluctant to ever explain, impatient, and seems to get anxious as to why I am wanting to learn ...

Which 'computerman' is this?


They dont want people learning anything as they dont want to lose trade (Or be caught out if theyre taking the p*ss)

hamaradam

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:15:53, on 30/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ICQ6.5\ICQ.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WPSC3PSW.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [WpsRePsw] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\WpsRePsw.EXE
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6.5\ICQ.exe" silent
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\WINDOWS\system32\shdocvw.dll
O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} (OSInfo Control) - http://www.sis.com/ocis/OSInfo.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1243362921781
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Unknown owner - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe (file missing)
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 3822 bytes


I did this and then it asked 'do you want to scan your computer', I did not, as I thought the only thing needed was the above list at this time/or that the action we require has been done with the above list..or do i need to do this again and allow it to scan?

hamaradam

I seem to have hit a problem with the COMBOFIX....when it comes to the renaming, it says you can't rename it combofix1...I press OK, then I do the right click on the mouse(in order to rename it QWERTY)...but nothings happening...

Whereabouts is the exe file which I need to click on...

hamaradam

Oh, and it (COMBOFIX) told found something, - AVIRA antivirus desktop and told me to take it off, to be able to continue, so I have...(remember having problem with this before (last year) and the umbrella would never open ie it didn't work correctly, (don't know why) and it was subsequently taken off....but its been put back on, is this something which is known as a problematic anti virus thing?, I wonder..?

hamaradam

aliEnRIK...come back!! ......please don't lose the will to live......!!!:D:D

aliEnRIK

Been away for dinner and installing service pack 2 (Still waiting for something major to go wrong )

Aviras fine ~ though you may need to install the latest version ~
Download AVIRA (Make sure you click 'DOWNLOAD LATEST VERSION')
http://www.filehippo.com/download_antivir/

combofix ~
Click the link again and BEFORE you click to 'ok' it, RENAME it first THEN click to save it.

hamaradam

Hi there aliEnRIK...I still can't do that with COMBOFIX...When I have to rename it I press the RIGHT button on the mouse, nothing happens...where actually can I be able to se where it says 'exe file'...I wonder if something should be happening but isnt?

andy2004

what alienrik is saying, is when you click to download combofix.exe and it asks to run save or cancel, click on save, then in the next window it will ask where, to the left of the save button it will have the name combofix.exe in the window, if select the name, you can rename the file before it downloads onto your computer.
so if you changed combofix.exe to qwerty.exe and then clicked SAVE it would download to your computer and be in the folder you told it to download to, as qwerty.exe and not combofix.exe

Damn alienrik service pack 2, erm, just thought you didnt say vista or xp, but if your running xp surely you would have installed service pack 3 by now, no troubles since it was released.

aliEnRIK

Vista service pack 2 (I installed my XP service pack 3 yonks ago)