aim's not work, aim mail is not working, aim express isn't even working. Help me, please.
Logfile of HijackThis v1.99.1
Scan saved at 11:23:43 PM, on 6/23/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
-> Right-click the BFU folder on your desktop, and choose Extract All -> Click Next -> In the box to choose where to extract the files to,
-> Click Browse -> Click on the + sign next to My Computer -> Click on Local Disk ( C: ) or whatever your primary drive is
-> Click Make New Folder -> Type in BFU -> Click Next, and Uncheck the Show Extracted Files box and then click Finish.
RIGHT-CLICK the following link and choose "Save As" (in IE it's "Save Target As") in order to download QooFix.bat by LonnyRJones -> http://downloads.subratam.org/Lon/qooFix.bat Save it in the same folder you made earlier (c:\BFU).
Please close ALL other open windows & explorer folder's, then double-click on QooFix.bat Choose option #1 (Qoolfix autofix) and follow the prompts.
Please be patient, it will take about five minutes.
Run HijackThis, press "Do a system scan only", close all other windows, checkmark entries and press "Fix checked":
F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\System32\lixaj.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,vefetdk.exe
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "c:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKCU\..\Run: [qnsok] C:\WINDOWS\System32\uyhvjw.exe reg_run
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
Open Notepad
-> copy the following lines into a new document:
@echo off
sc stop ccEvtMgr
sc delete ccEvtMgr
sc stop ccPwdSvc
sc delete ccPwdSvc
sc stop navapsvc
sc delete navapsvc
Save the document to your desktop as Removal.bat and filetype: All Files Go to your desktop and run the file Removal.bat and answer yes to any questions.
Delete these files (if found):
C:\WINDOWS\web\related.htm
Scan and clean your computer with Ewido and save the log file.
Restart your computer normally.
Then
-> click on Start -> click on Run -> type msconfig to the field and press enter.
-> a window opens
-> click on the startup tab and make sure there are check marks in every entry.
-> Then press ok until you are out of the program.
Post a fresh HijackThis log and Ewido's log to here so we can see if your computer is now clean.
