HELP - Something's hijacked the pc (ultimate cleaner 2007?)

Browntoa

then run hiajckthis again and tick

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2

O2 - BHO: (no name) - !!02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - !!7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O8 - Extra context menu item: &Search - ?p=ZCxdm491MFCA

O16 - DPF: !!02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab

O16 - DPF: !!149E45D8-163E-4189-86FC-45022AB2B6C9} - [URL="file:///C:/Program%20Files/Monopoly%...es/stg_drm.ocx"]file:///C:/Program%20Files/Monopoly%...es/stg_drm.ocx[/URL]

O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - [URL="file:///C:/Program%20Files/Monopoly%.../armhelper.ocx"]file:///C:/Program%20Files/Monopoly%.../armhelper.ocx[/URL]

O24 - Desktop Component 0: Privacy Protection - [URL="file:///C:\WINDOWS\privacy_danger\index.htm"]file:///C:\WINDOWS\privacy_danger\[/url]index.htm

then click on the fix selected button

Browntoa

then go to the start button , then click on Run

type Msconfig then Ok

click on the Services Tab and then look for entries

C:/windows/privacy_danger/index.htm

and untick them

then click apply and let the Pc reboot

Browntoa

then follow

http://forums.moneysavingexpert.com/showthread.html?t=133269

Browntoa

and the source of your infection is Limewire !!

jussme7

I went to the services tab and C:/windows/privacy_danger/index.htm
wasn't there. And when I started up my computer I got the message again:

Cannot find 'file: ///C:/windows/privacy_danger/index.htm'. Make sure the path or internet address is correct.

And if limewire is my problem should I remove it or just watch what I download?

Browntoa

did you do this ??

Browntoa wrote: »

then go to the start button , then click on Run

type Msconfig then Ok

click on the Services Tab and then look for entries

C:/windows/privacy_danger/index.htm

and untick them

then click apply and let the Pc reboot

jussme7

Yes and I just did it again and it's still not there.

Chippy_Minton

O24 - Desktop Component 0: Privacy Protection - [URL="file:///C:%5CWINDOWS%5Cprivacy_danger%5Cindex.htm"]file:///C:\WINDOWS\privacy_danger\index.htm[/URL]

O24 items are Desktop components so don't appear on the Services tab.

You have to manually delete the index.htm file above, or probably the whole privacy_danger folder.

jussme7

ok thanks but how do i do that?? :embarasse

pchelpman

Just a little note from me that may help here and elsewhere when this .....

Chippy_Minton wrote: »

O24 - Desktop Component 0: Privacy Protection - [URL="file:///C:%5CWINDOWS%5Cprivacy_danger%5Cindex.htm"]file:///C:\WINDOWS\privacy_danger\index.htm[/URL]

....comes up.


SDFix should clear it out.

Instructions >

Download this to your desktop ...

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following .....


Restart your computer ...

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually ...

Instead of Windows loading as normal, the Advanced Options Menu should appear ...

Select the first option, to run Windows in Safe Mode, then press Enter ...
Choose your usual account.


Open the extracted SDFix folder and double click RunThis.bat to start the script ...

Type Y to begin the cleanup process ...

It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot ...

Press any Key and it will restart the PC ...

When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons ...

Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum) ...

Finally paste the contents of the Report.txt back on the forum with a new HijackThis log.


PCH