R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\search.html R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = C:\WINDOWS\system32\search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\system32\search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = C:\WINDOWS\system32\search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = C:\WINDOWS\system32\search.html R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = C:\WINDOWS\system32\search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = C:\WINDOWS\system32\search.html
MSIE: Internet Explorer v6.00 SP2 (.2180)Ĭ:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeĬ:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeĬ:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exeĬ:\Program Files\Common Files\Real\Update_OB\realsched.exeĬ:\Program Files\Multimedia Card Reader\shwicon2k.exeĬ:\Program Files\Common Files\Symantec Shared\ccApp.exeĬ:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeĬ:\Program Files\HP\Digital Imaging\bin\hpqtra08.exeĬ:\Program Files\interMute\PopSubtract\PopSub.exeĬ:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exeĬ:\Program Files\Common Files\Real\Update_OB\rnathchk.exeĬ:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exeĬ:\Program Files\Common Files\AOL\1124520072\ee\AOLHostManager.exeĬ:\Program Files\interMute\SpamSubtract\SpamSub.exeĬ:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exeĬ:\Program Files\Common Files\AOL\1124520072\ee\AOLServiceHost.exeĬ:\Program Files\Internet Explorer\iexplore.exeĬ:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXEĬ:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmjb.exeĬ:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_director.exeĬ:\Program Files\Hijackthis\HijackThis.exe Most of what it finds will be harmless or even required.Īlright, I did it all. It will scan and then ask you to save the log.Ĭlick Save to save the log file and then the log will open in notepad.Ĭlick on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.Ĭome back here to this thread and Paste the log in your next reply.ĭO NOT have Hijack This fix anything yet. Put a check by Create a desktop icon then click Next again.Ĭontinue to follow the rest of the prompts from there.Īt the final dialogue box click Finish and it will launch Hijack This.Ĭlick on the Do a system scan and save a log file button.
You might also still be infected with something.ĭouble click on the HJTsetup.exe icon on your desktop.īy default it will install to C:\Program Files\Hijack This.Ĭontinue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue. Double click it and answer yes to the import prompt. Save the following REG File to your hard disk. You will need to do this step for every user account. To restore the desktop to whatever picture you normally have right click on a blank part of desktop & select properties/desktop & select your prefered picture press apply & then ok to exit and then press F5 Double click on Other Profiles Regfix.vbsĮxplorer will be ended and that user's active desktop registry entries will be repaired. Open C:\ (Go to Start>Run and type C: Press enter) and Open the c:\desktopclean folder.
Have each User sign in and run Other Profiles Regfix.vbs
Once you have performed the big cleanup, each of the other Users on the System needs to be signed in to clean up their desktop and regain the right click. It will repair the registry entries returning your normal desktop and context menu functions. If you get a message when you first run it "Can not find script file "blah blah blah" then don't worry just doubleclick the cleandesktop.vbs script again you sometimes get that message when a script blocker blocks the script
If you have script blocking enabled you will get a warning about a malicious script wanting to run. If it doesn't open then go to c:\desktopclean and double click on the cleandesktop.vbs Do not run any other file from there please unless asked to It will automatically extract to c:\desktopclean where it needs to be to run and will automatically run the cleandesktop.vbs script
Download and Save Cleandesktop to your computer from this link: and double click on the cleandesktop.exe