offeroptimizer

Unknown

This nasty have landed intelf on my PC, can you please help me remove it. Below is my Hijack this log. Please advise as to which ones I can fix.

Many thanks
Kelvin

Logfile of HijackThis v1.97.7
Scan saved at 7:10:36 AM, on 23/08/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\RunDll32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\System32\qocjqn.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Temp\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.0.201:3128
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://www.picknowl.com.au/
O2 - BHO: (no name) - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\multimpp.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [jaqzmdnfqjcwn] C:\WINDOWS\System32\qocjqn.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /0
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research (HKLM)
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O13 - WWW. Prefix: http://
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ¨À
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ¨À
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ¨À

Dexter

Welcome to Short-Media

Refer to the Steps to Take Thread to first run Ad Aware and Spybot, and see if they fix your problem.

If they don't solve it, refer to the "how-to's" on the other posts at that link, and do the following.

Disable System Restore. Show hidden files and folders. Reboot in Safe Mode, run HJT, and Fix:

O2 - BHO: (no name) - {002EB272-2590-4693-B166-FBD5D9B6FEA6} - C:\WINDOWS\multimpp.dll

O4 - HKLM\..\Run: [jaqzmdnfqjcwn] C:\WINDOWS\System32\qocjqn.exe

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ¨À
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ¨À
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ¨À

Reboot normally, check things out, and let us know how it looks, post a new log for follow-up. Re-enable system restore if it all looks good.

Dexter...

kelvin

Thanks very much for your help, will see how it goes and let you know.

kelvin

Thank you Dexter,
That nasty seems to be gone for good.
Thanks again
kelvin

Dexter

Good to hear.

Please click the links in my signature to learn about the Folding for a Cure project, a very worthwhile endeavour that we are involved with here. We'd love to have you on the Team

Dexter...