Member Panel

kalderz

hi! ?ummm .. . i had been having trouble with the thnall1 aureco betterinternet thing not being removed when i ran pestpatrol. i found your posts about hjt and followed the advise in other logs to download hjt, nail, ccleaner, ewico. ?i followed instructions to disable auto restor and show hidden files in win xp and rebooted into safe mode ran nail, ewico, ccleaner, hjt. ?it "seems" to have solved the aureco thing, but i am wondering with all the stuff in my hjt log file - are there other issues there you can point out to me that i should deal with? ?i purchased pest patrol a year or so ago. ?i don't know if it is the same thing as hjt or different or ewico - whether it is redundant to run pestpatrol and ewico. ?any advidse based upon my hjt log file? ?thanks for your help.

joe5

Hi there Kalderz , welcome to PCHF.

Im a bit short for time atm , but can you first run (in safemode) Cwshredder and add this to youre registry by unpacking and doubleclicking on it , then running ccleaner and then reboot and post a new hjt log?

kalderz

ok. here is the new hjt log file.

kalderz

here also is the ewido scan log file, in case it is of any help.

joe5

Ok , lets have a look. First please delete the files PestPatrol has in Quarantine.

Then disable system restore to prevent re-infection.
(if you have/use it.)
(you can turn it back on when youre pc is clean).

How to disable system restore:

WinXP.

Click the Start button.
Right-click My Computer, and then click Properties.
On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives.

And then boot in safemode (hit f8 when booting up) and fix these with hjt:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.search-exe.com/nph-sea...ook=stmpl1&fw=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.search-exe.com/nph-sea...ook=stmpl1&fw=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.search-exe.com/nph-sea...ook=stmpl1&fw=
O2 - BHO: (no name) - {00F1D395-4744-40f0-A611-980F61AE2C59} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)? ?
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab

If you didnt add/don't want this one then you can fix it to:

O15 - Trusted Zone: *.napster.com

Then reboot and post a new hjt log please.

Member Panel

Sponsors and Ads

Join the Team

Live Tag Cloud