problems and I am going to do a virus scan with Housecall. Hopefully someone will be able to give me some assistance with what do get rid of from the Hijack this log.
Run Hijack This again and put a check by these. Close all windows except HijackThis and click "Fix checked"
O1 - Hosts: 217.116.231.7 aimtoday.aol.com12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O4 - HKLM\..\Run: [Dialer] c:\Program Files\Instant Access\Dialer.exe
O4 - HKLM\..\Run: [Antivirus] C:\WINDOWS\av.exe
O4 - HKLM\..\Run: [abgggzch] C:\WINDOWS\qciusude.exe
O4 - HKLM\..\Run: [tbrnkfff] C:\WINDOWS\muyqjhdn.exe
O4 - HKLM\..\Run: [camdwbbx] C:\WINDOWS\vmcorwrv.exe
O4 - HKLM\..\Run: [lqlgzdhd] C:\WINDOWS\rhnzblps.exe
O4 - HKLM\..\Run: [BEILOVYIL] C:\WINDOWS\BEILOVYIL.exe
O4 - HKLM\..\Run: [<H] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [ Error</TI] c:\WINDOWS\System32\ Error
O4 - HKLM\..\Run: [</H] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [<B] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKLM\..\Run: [GANDI then par] c:\WINDOWS\System32\GANDI then parked.
O4 - HKLM\..\Run: [</B] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe
O4 - HKCU\..\Run: [<H] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [ Error</TI] c:\WINDOWS\System32\ Error
O4 - HKCU\..\Run: [</H] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [<B] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKCU\..\Run: [GANDI then par] c:\WINDOWS\System32\GANDI then parked.
O4 - HKCU\..\Run: [</B] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {197AB1D7-A7DD-4C86-A938-1FCC0DB21B85} (DMProxyCtl Class) - http://dm.cometsystems.com/dm/dm_286.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/f...etup1.0.0.6.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://www109.coolsavings.com/download/cscmv5X.cab
O16 - DPF: {C5F5BD70-3BC5-A328-FD4E-FCA11BDACE6E} - http://public.searchbarcash.com/cab/037/nnznqdib.cab
Restart to safe mode.
How to start your computer in safe mode
First in safe mode click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
Now open the C:\Windows folder and delete these files:
av.exe
qciusude.exe
muyqjhdn.exe
vmcorwrv.exe
rhnzblps.exe
BEILOVYIL.exe
Now in the C:\Windows folder open the System32 folder and delete this file:
zzb.exe
Next navigate to the C:\Program Files folder and delete these folders:
MyWebSearch
Instant Access
Open the C:\Program Files\Common files folder and delete this folder:
CommonName
After you've done all that run Adaware and Spybot according to these directions:
Go here and download Adaware 6 Build 181
Install the program and launch it.
First in the main window look in the bottom right corner and click on Check for updates now and download the latest referencefiles.
Make sure the following settings are made and on -------ON=GREEN
From main window :Click Start then Activate in-depth scan (recommended)
Click Use custom scanning options then click Customize and have these options selected: Under Drives and Folders put a check by Scan within archives and below that under Memory and Registry put a check by all the options there.
Now click on the Tweak button in that same window. Under Scanning engine select Unload recognized processes during scanning and under Cleaning Engine select Let windows remove files in use at next reboot
Click proceed to save your settings.
Now to scan just click the Next button.
When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)
Restart your computer.
Then go here and download Spybot Search & Destroy.
Install the program and launch it.
Before scanning press Online and Search for Updates .
Put a check mark at and install all updates.
Click Check for Problems and when the scan is finished let Spybot fix/remove all it finds marked in RED.
Restart your computer.
O1 - Hosts: 217.116.231.7 aimtoday.aol.com12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com
O2 - BHO: BabeIE - {00000000-0000-0000-0000-000000000000} - C:\PROGRA~1\COMMON~2\ADDRES~1\cnbabe.dll
O2 - BHO: (no name) - {0019C3E2-DD48-4A6D-ABCD-8D32436323D9} - C:\WINDOWS\bxxs5.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL
O4 - HKLM\..\Run: [Dialer] c:\Program Files\Instant Access\Dialer.exe
O4 - HKLM\..\Run: [Antivirus] C:\WINDOWS\av.exe
O4 - HKLM\..\Run: [abgggzch] C:\WINDOWS\qciusude.exe
O4 - HKLM\..\Run: [tbrnkfff] C:\WINDOWS\muyqjhdn.exe
O4 - HKLM\..\Run: [camdwbbx] C:\WINDOWS\vmcorwrv.exe
O4 - HKLM\..\Run: [lqlgzdhd] C:\WINDOWS\rhnzblps.exe
O4 - HKLM\..\Run: [BEILOVYIL] C:\WINDOWS\BEILOVYIL.exe
O4 - HKLM\..\Run: [<H] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [ Error</TI] c:\WINDOWS\System32\ Error
O4 - HKLM\..\Run: [</H] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [<B] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKLM\..\Run: [] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKLM\..\Run: [GANDI then par] c:\WINDOWS\System32\GANDI then parked.
O4 - HKLM\..\Run: [</B] c:\WINDOWS\System32\
O4 - HKLM\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe
O4 - HKLM\..\Run: [bxxs5] RunDLL32.EXE C:\WINDOWS\bxxs5.dll,DllRun
O4 - HKLM\..\Run: [winnet] C:\PROGRA~1\COMMON~2\ADDRES~1\winnet.exe
O4 - HKCU\..\Run: [<H] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [ Error</TI] c:\WINDOWS\System32\ Error
O4 - HKCU\..\Run: [</H] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [<B] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The site you have requested doesn't ex] c:\WINDOWS\System32\The site you have requested doesn't exist.
O4 - HKCU\..\Run: [] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [The associated domain name has probably been reserved by a client ] c:\WINDOWS\System32\The associated domain name has probably been reserved by a client from
O4 - HKCU\..\Run: [GANDI then par] c:\WINDOWS\System32\GANDI then parked.
O4 - HKCU\..\Run: [</B] c:\WINDOWS\System32\
O4 - HKCU\..\Run: [zzb] c:\WINDOWS\System32\zzb.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {197AB1D7-A7DD-4C86-A938-1FCC0DB21B85} (DMProxyCtl Class) - http://dm.cometsystems.com/dm/dm_286.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/f...etup1.0.0.6.cab
O16 - DPF: {549F957E-2F89-11D6-8CFE-00C04F52B225} (CMV5 Class) - http://www109.coolsavings.com/download/cscmv5X.cab
O16 - DPF: {C5F5BD70-3BC5-A328-FD4E-FCA11BDACE6E} - http://public.searchbarcash.com/cab/037/nnznqdib.cab
Restart to safe mode.
How to start your computer in safe mode
First in safe mode click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"
Now open the C:\Windows folder and delete these files:
av.exe
qciusude.exe
muyqjhdn.exe
vmcorwrv.exe
rhnzblps.exe
BEILOVYIL.exe
Now in the C:\Windows folder open the System32 folder and delete this file:
zzb.exe
Next navigate to the C:\Program Files folder and delete these folders:
MyWebSearch
Instant Access
Open the C:\Program Files\Common files folder and delete this folder:
CommonName
After you've done all that run Adaware and Spybot according to these directions:
Go here and download Adaware 6 Build 181
Install the program and launch it.
First in the main window look in the bottom right corner and click on Check for updates now and download the latest referencefiles.
Make sure the following settings are made and on -------ON=GREEN
From main window :Click Start then Activate in-depth scan (recommended)
Click Use custom scanning options then click Customize and have these options selected: Under Drives and Folders put a check by Scan within archives and below that under Memory and Registry put a check by all the options there.
Now click on the Tweak button in that same window. Under Scanning engine select Unload recognized processes during scanning and under Cleaning Engine select Let windows remove files in use at next reboot
Click proceed to save your settings.
Now to scan just click the Next button.
When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)
Restart your computer.
Then go here and download Spybot Search & Destroy.
Install the program and launch it.
Before scanning press Online and Search for Updates .
Put a check mark at and install all updates.
Click Check for Problems and when the scan is finished let Spybot fix/remove all it finds marked in RED.
Restart your computer.
