[hurley999er]

[bleep] keeps popping up whenever my friend opens up the internet, here is my hijack this log, any help would be much appreciated so they dont have to pay some rip off company to fix the problem

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Administrator\Local Settings\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofin....php?id=15&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\spe\start.chm::/start.html#
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.heretofin....php?id=15&q=%s
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\spe\start.chm::/start.html#
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AuditMode] C:\sysprep\factory.exe -logon
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ASHLT] C:\WINDOWS\Ashlt.exe
O4 - HKLM\..\Run: [Mmgsvc] C:\WINDOWS\mmgsvc.exe
O4 - HKLM\..\Run: [w3si3ER] telug.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0b\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: hp officejet 4100 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O9 - Extra button: (no name) - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe (file missing)
O9 - Extra 'Tools' menuitem: MaxSpeed - {120E090D-9136-4b78-8258-F0B44B4BD2AC} - C:\WINDOWS\System32\ms.exe (file missing)
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file)
O9 - Extra button: Corel Network monitor worker - {7B771ABD-7A9E-4A7C-9A6B-5E8A9DA672B7} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {7B771ABD-7A9E-4A7C-9A6B-5E8A9DA672B7} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {237AA178-C3BC-4f67-A8BB-D8BC14BA0B89} - (no file) (HKCU)
O13 - DefaultPrefix: http://www.heretofin...ow.php?id=15&q=
O13 - WWW Prefix: http://www.heretofin...ow.php?id=15&q=
O13 - Home Prefix: http://www.heretofin...ow.php?id=15&q=
O13 - Mosaic Prefix: http://www.heretofin...ow.php?id=15&q=
O13 - Gopher Prefix: http://www.heretofin...ow.php?id=15&q=

thanks in advance

[Advertisements]

Hi hurley999er, welcome to Geeks to Go!

Please download this to fix the Start.chm Hijack:
http://tools.zerosre...startchmfix.exe
(The following is typically seen in the HijackThis log: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\WINDOWS\start.chm::/start.html)
Run it and extract the folder to the desktop preferably.
Open the folder after extracted.
Double click the fix.bat
Please make sure all Internet Explorer windows are closed.
Only run it once or you will lose the backups although they shouldn't be needed.
Notepad will open at the end with a message and the bad file listing at the end. Reboot Windows and delete that bad file.

Reboot and paste a fresh Hijack This log.

[admin]

Hi hurley999er, welcome to Geeks to Go!

Please download this to fix the Start.chm Hijack:
http://tools.zerosre...startchmfix.exe
(The following is typically seen in the HijackThis log: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = mk:@MSITStore:C:\WINDOWS\start.chm::/start.html)
Run it and extract the folder to the desktop preferably.
Open the folder after extracted.
Double click the fix.bat
Please make sure all Internet Explorer windows are closed.
Only run it once or you will lose the backups although they shouldn't be needed.
Notepad will open at the end with a message and the bad file listing at the end. Reboot Windows and delete that bad file.

Reboot and paste a fresh Hijack This log.