Buffer Overrun

[Broni]

Post fresh HJT log, please.

[woodworks]

Here it is

[recovering space - attachment deleted by admin]

[Broni]

Open HJT, checkmark all O1 entries.
Click "Fix checked".
Restart computer. Post new log.

[woodworks]

Here's the log.

How do I get rid of the pop up that can't load the dll file or whatever it is?

[Broni]

I see no log. Don't worry about pop-ups. We're in the middle of cleaning process.

[woodworks]

I guess I forgot to send it.  Sorry.



[recovering space - attachment deleted by admin]

[Broni]

Restart in Safe Mode (keep tapping F8 key, when computer restarts, until menu appears), and run HostsXpert from there one more time.
Restart in Normal Mode, and post new HJT log.

[woodworks]

It says it can't create file and when I click ok, it exit's the program.

[Broni]

OK. Let's remove some other stuff, first, and we'll worry about it later. I'll post back in a moment.

[Broni]

Temporarily disable Spysweeper, and wait for my next instructions:

If you have Spy Sweeper version 4:

    * Open it, Click Options over on the left, then Program options
    * Uncheck load at windows startup.
    * Over to the left, Click shields and Uncheck all there.
    * Uncheck home page shield.
    * Uncheck automatically restore default without notification.
    * Reboot your machine for the changes to take effect before running HJT.

+++++++++++++++++++++++++++++

If you have SpySweeper version 5:

To disable SpySweeper Shields

    * Open SpySweeper.
    * Click Shield Settings on the right

(or Shields on the left, depending what screen you're on).

    * Click Internet Explorer and uncheck all items.
    * Click Windows System and uncheck all items.
    * Click Hosts File and uncheck all items.
    * Click Startup Programs and uncheck all items.
    * Close SpySweeper.

Reboot you computer, and ensure Spy Sweeper is disabled.

[woodworks]

I don't have just Interne Explorer.

Under Browser Shields I have
IE Cookies
IE Favorites
IE Security
Browser helped object
IE highjack
I am running 5
But I think I unchecked everything.  Going to reboot now.

[woodworks]

Ok, I believe it is shut down.

[Broni]

When you're done with Spysweeper...

*** Is Windows firewall on?

*** Go Start>Control Panel>Add\Remove, and uninstall Hotbar, and QdrPack

1. Print this post out, since you won't have an access to it, at some point.

2. Close all windows, except for HijackThis.

3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):

- O2 - BHO: WhgHelper Class - {00000000-0000-11D1-ABED-709549C10000} - C:\Program Files\WHG\Instant Help Application Update 1.2\IEHelper.dll
- *O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
- O4 - HKLM\..\Run: [HotbarOE] "C:\Program Files\Hotbar\bin\10.0.412.0\OEAddOn.exe"
- *O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
- *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
- *O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
- O4 - HKLM\..\Run: [0e651c44] "rundll32.exe" "C:\WINDOWS\system32\dnqhlxle.dll",b
- O4 - HKLM\..\RunServices: [Microsoft Taskhide Driver] taskhide.exe
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] J:\CAMEFR~1\COMCAS~1\COMCAS~1\data\Xtras\mssysmgr.exe
- O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe"
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
- O4 - HKCU\..\RunServices: [Microsoft Taskhide Driver] taskhide.exe
- O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
- *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
- O20 - Winlogon Notify: jkkHXNDV - jkkHXNDV.dll (file missing)

4. Click on Fix checked button.

5. Restart your computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)

6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.

7. Delete following files/folders (if present):

- WHG, Hotbar, QdrPack folders from C:\Program Files
- dnqhlxle.dll file from C:\WINDOWS\system32
- search computer for taskhide.exe, and delete all instances

8. Restart in Normal Mode.

9. Post new HijackThis log.

[woodworks]

There is no Hotbar or QdrPack

[Broni]

if present