Be back on monday everyone have a great weekend

Please run HijackThis and place a checkmark by the following entries:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL (file missing)
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {D73F49B1-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\1.bin\MBSRCAS.DLL (file missing)
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\1.bin\MORPHBAR.DLL (file missing)
O4 - HKLM\..\Run: [cash acid bias online] C:\Documents and Settings\All Users\Application Data\CloseMathCashAcid\Teaminternet.exe
O4 - HKCU\..\Run: [film rect] C:\DOCUME~1\MATT~1.TEL\APPLIC~1\HOLDKN~1\sixth cool meow.exe
O9 - Extra button: Instant Buzz - {066040F0-5018-4E15-8AA0-81D36136D989} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis and restart the computer to safe mode:
PC Hell: How to Start Windows in Safe Mode


Navigate to and delete the following files if found:
C:\Documents and Settings\All Users\Application Data\CloseMathCashAcid\Teaminternet.exe

C:\Documents and Settings\Matt.TELFORD'S\Application Data\HOLDKN~1\sixth cool meow.exe
(There will be more to the name of the folder, but it starts with HOLDKN, and contains the file sixth cool meow.exe.)


After the folders are deleted, reboot. You should get back to normal mode.


Now Open Hijackthis, click "Open the Misc Tools section"
Next to "Generate StartupList log", place a check next to "List also minor sections" (full) and "List empty sections (complete).
Then click "Generate StartupList log"
Click "Yes" to the box that pops-up.
Then copy and paste the notepad text that appears to this topic.

Attached Files

startuplist.txt (33.7 KB, 1 views)

Thanks a bunch no popups now. I'm fairly new to the forum how do you mark this as answered?

We do that one Matt.

Glad we could get rid of all the popups.

Glad your system is well now.

Read the "Afterwork" for some great malware prevention tips:
http://www.pchelpforum.com/hijackthi...afterwork.html



See you around the forum.