Please Help! - Windows Explorer - Microsoft XP Microborg Edition

[omg_i_need_help]

Hello, I'm Mark.

I'm not new to computers or computer technology. I can program VB, PHP, ASP, JavaScipt n a couple more but my problem is this;

My brother in law wanted ago on my laptop so i let him. I went to work came back and "BANG!" the laptop would be no use to the scrap yard (I'm on it now). The biggie is my taskbar. something keep exiting the process of explore.exe now i keep opening task manager then clicking "New Task" typeing "explorer" then quickly jumping to the "Processes" tab to see what keep closing it because then I could narrow down the problem even if its just a little bit but i cant see anything thats stopping the process so now its bothering me because to get on the internet i have to use the task manager! So, Anyway i had a bit of a plan!

If I was to Copy "explorer.exe". Paste it to the same directory (WINDOWS) then rename it. What ever is closing the process wouldn't recognize what ever I called it right ? Right! but when i do that it all works fine and dandy and then "My Documents" comes up but no task bar.

I'm affriad I'm going to have to result in reformatting the laptop.

Is all this nessacerry ? If not please please please let me know asap

Thanks, Mark.

P.S - Sorry for my foul spelling.

[Broni]

You may have some infection....

1. Run free ESET Online Scanner at: http://www.eset.com/onlinescan/
Note: This Scanner is for Internet Explorer Only
   1.  You will notice that the "Start" button is grayed out. Place a check mark at "Yes, I accept the Terms of use". The "Start" button will become visible. Click on it.
   2. If it wants to install an ActiveX component allow it
   3. You will be asked to install an ActiveX, click the "Install" button (Note: If you have a Firewall install you may have to approve the installation)
   4. Once ActiveX control is installed click on the "Start" button to initialize the scanner
   5. After initialization is complete uncheck\untick "Remove found threats"
   6. Check\tick "Scan unwanted applications"
   7. Click the "Scan" button
   8. Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt
Post ESET's log.

2. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/

Print these instructions out.

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
    * Close SUPERAntiSpyware.

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; pick Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Under "Configuration and Preferences", click the Preferences button.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
          o Close browsers before scanning.
          o Scan for tracking cookies.
          o Terminate memory threats before quarantining.
    * Click the "Close" button to leave the control center screen.
    * Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, under "Complete Scan", choose Perform Complete Scan.
    * Click "Next" to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
    * Make sure everything has a checkmark next to it and click "Next".
    * A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
    * If asked if you want to reboot, click "Yes".
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
          o Click Preferences, then click the Statistics/Logs tab.
          o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
          o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
          o Please copy and paste the Scan Log results in your next reply with a new HijackThis log.
    * Click Close to exit the program.
Post SUPERAntiSpyware log.

3. Download HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.

[omg_i_need_help]

Hello, I'm Mark.

I'm not new to computers or computer technology. I can program VB, PHP, ASP, JavaScipt n a couple more but my problem is this;

My brother in law wanted ago on my laptop so i let him. I went to work came back and "BANG!" the laptop would be no use to the scrap yard (I'm on it now). The biggie is my taskbar. something keep exiting the process of explore.exe now i keep opening task manager then clicking "New Task" typeing "explorer" then quickly jumping to the "Processes" tab to see what keep closing it because then I could narrow down the problem even if its just a little bit but i cant see anything thats stopping the process so now its bothering me because to get on the internet i have to use the task manager! So, Anyway i had a bit of a plan!

If I was to Copy "explorer.exe". Paste it to the same directory (WINDOWS) then rename it. What ever is closing the process wouldn't recognize what ever I called it right ? Right! but when i do that it all works fine and dandy and then "My Documents" comes up but no task bar.

I'm affriad I'm going to have to result in reformatting the laptop.

Is all this nessacerry ? If not please please please let me know asap

Thanks, Mark.

P.S - Sorry for my foul spelling.

I seem to have found the problem. Some virus has infected my "Kernel32" Bad, Very Bad. Can i solve this ?

[omg_i_need_help]

this is my hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 01:36:39, on 19/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\huzi.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\no 1\Desktop\Everything\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MicroBorg Internet Exploder
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhee.exe
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - Startup: Stat Bar 2.46.lnk = C:\StatBar.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{040BB65D-EF2A-4A82-A339-14DB0AFE5735}: NameServer = 212.139.132.23 212.139.132.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{040BB65D-EF2A-4A82-A339-14DB0AFE5735}: NameServer = 212.139.132.23 212.139.132.22
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\msgrapp.8.5.1302.1018.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\msgrapp.8.5.1302.1018.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

[Broni]

I need all THREE logs from you. Make sure HJT is run as the last one.
Also, get HJT from my link. Your version is outdated.

[omg_i_need_help]

Self explanatry

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 01/19/2008 at 02:01 AM

Application Version : 3.9.1008

Core Rules Database Version : 3143
Trace Rules Database Version: 1159

Scan type       : Complete Scan
Total Scan Time : 00:10:33

Memory items scanned      : 314
Memory threats detected   : 0
Registry items scanned    : 4524
Registry threats detected : 0
File items scanned        : 1083
File threats detected     : 0

[Broni]

I need all THREE logs from you. Make sure HJT is run as the last one.
Also, get HJT from my link. Your version is outdated.

[omg_i_need_help]

I'm just waiting on "eset".

I cannot start the laptop in Safe Mode, when I try the "Virus/maleware/adware" what ever just restarts the laptop 

[Broni]

I'm just waiting on "eset"

OK...and current version of HJT, please.

[omg_i_need_help]

Ok, the "eset" scan is nearly done with 3 errors.

[Broni]

OK. Post them, please.

[omg_i_need_help]

  Nearly 100,000 files scanned and still not done 

I'm sorry for the delay and very gratefull of your help

[Broni]

It's OK. You just have to be patient.

[omg_i_need_help]

ok, its very nearly done with 5 errors, will post when its done

[omg_i_need_help]

Right, It's done. What do I do ?

Do I click "Details" or "More Information"?

[Broni]

you will find a log in C:\Program Files\esetonlinescanner\log.txt

[omg_i_need_help]

The Log


# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2806 (20080118)
# vers_arch_module=1.063 (20080117)
# vers_adv_heur_module=1.060 (20070601)
# EOSSerial=6b7275a0b674b74db35b5e8760bf7d80
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-01-19 11:21:16
# local_time=2008-01-19 04:21:16 (-0700, Mountain Standard Time)
# country="United Kingdom"
# osver=5.1.2600 NT Service Pack 2
# scanned=203829
# found=7
# scan_time=6106
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4VOPALU5\nn[1].exe   multiple infiltrations   C7BB2AF13C5B2D4A0BCD11753C729DD3
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4VOPALU5\nn[1].exe »RAR »helper.exe   probably unknown NewHeur_PE virus   00000000000000000000000000000000
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\4VOPALU5\nn[1].exe »RAR »relpk.exe   probably a variant of Win32/TrojanProxy.Ranky trojan   00000000000000000000000000000000
C:\Serials and cracks\Crack Searchers.rar   Win32/Adware.Craagle application   F95FF9774DCB7C3FD578EE43D18CFAB4
C:\Serials and cracks\Crack Searchers.rar »RAR »Crack Searchers\craagle1.91\Craagle.exe   Win32/Adware.Craagle application   00000000000000000000000000000000
C:\WINDOWS\system32\iifgged.dll   Win32/Adware.Virtumonde application   C0DB659272F997D3D03EA9520ADE5BC1
C:\WINDOWS\system32\ljjjggf.dll   Win32/Adware.Virtumonde application   C0DB659272F997D3D03EA9520ADE5BC1

[omg_i_need_help]

Now HJT?

[Broni]

Yes, please.

[omg_i_need_help]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:32:11, on 19/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\TASKILL.exe
C:\WINDOWS\huzi.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = MicroBorg Internet Exploder
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhee.exe
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Stat Bar 2.46.lnk = C:\StatBar.exe
O4 - Global Startup: BlueSoleil.lnk = C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{040BB65D-EF2A-4A82-A339-14DB0AFE5735}: NameServer = 212.139.132.23 212.139.132.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{040BB65D-EF2A-4A82-A339-14DB0AFE5735}: NameServer = 212.139.132.23 212.139.132.22
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe

--
End of file - 5374 bytes

[omg_i_need_help]

"huzi.exe" is "explorer.exe" copied and renamed so what ever is closing explorer.exe cant close huzi.exe.

get me ?

[Broni]

Yep.

[omg_i_need_help]

Any ideas?

[Broni]

* I can't see any firewall running, unless you're using Windows firewall?

* You need to update your Java: http://www.java.com/en/download/index.jsp

* Go Start>Control Panel>Add\Remove, and uninstall Bearshare (if present).

Now...

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries:

- R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb

- F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhee.exe

- O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - (no file)

4. Click on "Fix checked" button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to "Show hidden files, and folders".

7. Delete following files/folders (if present):

- jkhee.exe from C:\WINDOWS\system32

8. Turn off System Restore:

- Windows XP:
   1. Click Start.
   2. Right-click the My Computer icon, and then click Properties.
   3. Click the System Restore tab.
   4. Check "Turn off System Restore".
   5. Click Apply.   
   6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
   7. Click OK.
- Windows Vista:
   1. Click Start.
   2. Right-click the Computer icon, and then click Properties.
   3. Click on System Protection under the Tasks column on the left side
   4. Click on Continue on the "User Account Control" window that pops up
   5. Under the System Protection tab, find Available Disks
   6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
   7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
   8. Click OK

9. Restart in Normal Mode.

10. Turn System Restore on.

11. Post new HijackThis log.

[Broni]

Any ideas?

No pushing. There is no rush, when dealing with malwares.

[omg_i_need_help]

Just rebooted in Safe Mode, When the logon screen appeared the laptop restarted it's self I still have no taskbar.

File "C:\WINDOWS\System32\jkhee.exe" has the exact name "jkhee.dll". I'm guessing thats accociated. Anything I can do? lol

[omg_i_need_help]

Ok, i found this at the bottom of "jkhee.dll"

Code: [Select]

CharUpperA  @ CopyRect  E CreateCursor  R CreateMenu  „ DestroyCursor Œ DispatchMessageA  ” DrawStateA  user32.dll   CompareStringA  n EnumResourceLanguagesA  € ExitProcess ? ExitThread  õ GetFileSize ż GetLastError  
GetPrivateProfileStringA  @
GetSystemTime Ź
OpenFile  `Sleep wUnmapViewOfFile ƒVirtualFree µlstrcatA  ·lstrcmpA  ¹lstrcmpiA »lstrcpyA  ælstrlenA  kernel32.dll
That tells me its playing with my Kernel file, Cant that cause some major damage ?

[Broni]

Did you try to delete jkhee.exe file?

i found this at the bottom of "jkhee.dll"

What do you mean by "at the bottom"?