Connected to the internet, pages won't display, tried several things

[blueknight]

My wife's computer, Presario 1200 upgraded from windows 98 to XP, will not dipslay web pages. I have updated to SP2 and the computer uses IE6. It is connected to the internet. It does display my start page when I first connect, but then if you try to go to a different page, or refresh the start page, it comes up with "page not found",

Her computer had a series of viruses, Download.Trojan, Spybot, Sasser, that I removed. The problem started after the viruses were removed. I have tried several of the fixes recommended on your boards. I have installed and used Ad-ware, Microsoft's new Antispyware, Spyware Doctor. They each picked up and fixed several spyware & adware.

One last clue, I noticed a couple of times that when I would try to go to a web page the searching for message at the bottom of the screen would have and added an extra net or com to the address.

I am at a loss what to do next. I have attached the HJT. Any help you could provide would be much appreciated!

 

[RealBlackStuff]

Boot in Safe Mode

UNinstall this piece of M$-beta-crap, the virus-writers and script-kiddies are already after it:
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe

press ctrl-alt-del, go in Taskmanager. Try and STOP the following processes:
mssams.exe
msams.exe
gcasServ.exe

Run HJT on its own and let it 'fix':
Running processes:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.earthlink.net/partner/more/msie/button/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net
O4 - HKLM\..\Run: [Security Agent Manager] mssams.exe
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\RunServices: [Security Agent Manager] mssams.exe
O4 - HKCU\..\Run: [Windows Media Player] msams.exe
O4 - HKCU\..\Run: [Security Agent Manager] mssams.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1105097390477

Delete the bold files. When a directory is also bold, delete everything in it, including that directory itself.

 

[lordx]

Read the hijack.log again.
Delete in the registry everything related to http://www.earthlink.net
and the .dll's related to this
Also delete the folder X:\program files\messenger(look where is located msn messenger) and instal new msn messenger from the internet.

Note that not all antyspy software over the internet are safe!!!!!Most of them are programmed by the spyers,hackers.....Use Spybot search and destroy
Check also the registry for the Internet explores home page and see if something wrong
Note that sometimes is very hard to find the problem 'cause the spy software is trying to activate itself from backups even if u delete them and a clean instal of operating system is almost the single step to get rid of good programmed spyware

 

[blueknight]

Thanks, I give it a try and report back!

 

[blueknight]

It worked! Thanks for the help!