Kindly request assistance with Hijack This log

[brandiecase]

I have read the topic how to remove search assist and did as directed. I am running spybot 1.4b and it removed an extra couple of things spybot 1.3 couldn't/didn't. I am working on win98 and I keep getting weird things happening. This is a friend computer, mine doesn't have any of this stuff and I honestly don't know how it gets there. I must have a firewall and my norton must be working well along with spybot.

Thank you very much for your help. I appreicate you folks being here!

 

[RealBlackStuff]

Move C:\WINDOWS\DESKTOP\HIJACKTHIS[1].EXE to its own permanent directory.

Boot in Safe Mode.

Get rid of this pest, C:\WINDOWS\SYSTEM\LOCATORS.DLL following these instructions:
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076978

Run HJT on its own and let it 'fix':
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.earthlink.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = http://ls0.net/srchasst.html (obfuscated)
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\SYSTEM\LOCATORS.DLL
O9 - Extra 'Tools' menuitem: Locators.com Search Bar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\WINDOWS\SYSTEM\LOCATORS.DLL
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O19 - User stylesheet: (file missing)

When done, delete C:\WINDOWS\SYSTEM\LOCATORS.DLL

 

[bugman]

My HijackThis log-file - please help!

I've followed all the instructions from realblackstuff and cleaned out a lot of spyware, etc. The only thing I haven't done yet is switched from IE to Firefox.
I attach my HijackThis log-file. What else is there that needs cleaning?
Many thanks for your help.

 

[RealBlackStuff]

bugman,
you are clean, congrats.

 

[bugman]

Thanks

Many thanks for your help!
:giddy:

 

[brandiecase]

Check back

I did as you suggested. The only thing is when I deleted the first one for earthlink, I lost my start page. so that one is still there because I want start.earthlink.net as start page.

Let me know if ok, otherwise.

 

[RealBlackStuff]

brandiecase
Your log is clean. Hope you are using Firefox from now on!

 

[brandiecase]

Here I go again

A friend used this computer before I got a chance to switch to firefox or to get a firewall and it is all messed up again. :dead: I keep getting a toolbar called for intra. can't get it to go away, keeps coming back. puke:

 

[RealBlackStuff]

With the exception of this file, wucrtupd.exe, your log LOOKS clean.
That program MIGHT contain the W32/Ticton-A, but I can't see that from your log.
Go here for more details and how to remove if it is the infected version: http://www.sophos.com/virusinfo/analyses/w32tictona.html

The Intra bar is new to me, but you may find this removal tool useful:
http://windowsxp.mvps.org/toolbarcop.htm