Options
HJT log for review...
Hey Gang,
Here's the latest log. Ran Spybot, Adaware and XoftSpy before HJT. Ran through the awesome topic on getting rid of Shopping Wizard et al. but no luck! Please, hope we can fix this extreme annoyance...! Thanks in advance!
Logfile of HijackThis v1.98.2
Scan saved at 3:55:20 PM, on 12/5/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Trend Micro\Internet Security\Tmntsrv.exe
D:\Trend Micro\Internet Security\tmproxy.exe
C:\WINDOWS\system32\javauy32.exe
C:\WINDOWS\Explorer.EXE
D:\Trend Micro\Internet Security\PccPfw.exe
D:\Trend Micro\Internet Security\pccguide.exe
D:\Trend Micro\Internet Security\PCClient.exe
D:\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\system32\winss.exe
C:\WINDOWS\System32\wuauclt.exe
E:\XoftSpy\XoftSpy.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\Hijack This\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {90B6D35D-F18C-1E30-36BD-03BE13C66986} - C:\WINDOWS\system32\atljb32.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
Here's the latest log. Ran Spybot, Adaware and XoftSpy before HJT. Ran through the awesome topic on getting rid of Shopping Wizard et al. but no luck! Please, hope we can fix this extreme annoyance...! Thanks in advance!
Logfile of HijackThis v1.98.2
Scan saved at 3:55:20 PM, on 12/5/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\crypserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
D:\Trend Micro\Internet Security\Tmntsrv.exe
D:\Trend Micro\Internet Security\tmproxy.exe
C:\WINDOWS\system32\javauy32.exe
C:\WINDOWS\Explorer.EXE
D:\Trend Micro\Internet Security\PccPfw.exe
D:\Trend Micro\Internet Security\pccguide.exe
D:\Trend Micro\Internet Security\PCClient.exe
D:\Trend Micro\Internet Security\TMOAgent.exe
C:\Program Files\Common Files\Logitech\QCDriver\LVCOMS.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\WINDOWS\system32\winss.exe
C:\WINDOWS\System32\wuauclt.exe
E:\XoftSpy\XoftSpy.exe
C:\Program Files\Internet Explorer\iexplore.exe
E:\Hijack This\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rqmww.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {90B6D35D-F18C-1E30-36BD-03BE13C66986} - C:\WINDOWS\system32\atljb32.dll
O15 - Trusted Zone: *.frame.crazywinnings.com
0