My internet browser has been hijacked, help!!! i ran hijackthis and below is the logfile?

Logfile of HijackThis v1.99.1


Scan saved at 15:40:20, on 13/10/2007


Platform: Windows XP SP2 (WinNT 5.01.2600)


MSIE: Internet Explorer v7.00 (7.00.6000.16544)





Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\csrss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\Ati2evxx.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


C:\WINDOWS\system32\spoolsv.exe


C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


C:\PROGRA~1\Grisoft\AVG7\avgemc.exe


C:\WINDOWS\eHome\ehRecvr.exe


C:\WINDOWS\eHome\ehSched.exe


C:\Program Files\LogMeIn\x86\RaMaint.exe


C:\Program Files\LogMeIn\x86\LogMeIn.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\ehome\mcrdsvc.exe


C:\WINDOWS\system32\dllhost.exe


C:\WINDOWS\System32\alg.exe


C:\WINDOWS\system32\wscntfy.exe


C:\WINDOWS\system32\Ati2evxx.exe


C:\WINDOWS\Explorer.EXE


C:\WINDOWS\ehome\ehtray.exe


C:\WINDOWS\SOUNDMAN.EXE


C:\Program Files\ATI Technologies\ATI.ACE\cli.exe


C:\WINDOWS\eHome\ehmsas.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe


C:\Program Files\QuickTime\qttask.exe


C:\PROGRA~1\Grisoft\AVG7\avgcc.exe


C:\Program Files\LogMeIn\x86\LogMeInSystray.exe


C:\WINDOWS\system32\ctfmon.exe


C:\Program Files\Messenger\msmsgs.exe


C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe


C:\Program Files\ATI Technologies\ATI.ACE\cli.exe


C:\Program Files\Common Files\Real\Update_OB\realsched.exe


C:\Program Files\Internet Explorer\IEXPLORE.EXE


C:\Program Files\Salon Iris\Iris.exe


C:\Program Files\WinRAR\WinRAR.exe


C:\DOCUME~1\salon\LOCALS~1\Temp\Rar$EX...





R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.ie/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=6...


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=5...


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=5...


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=6...


R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.pcservicecall.co.uk/


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!


R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)


O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll


O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll


O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe


O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE


O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE


O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime


O4 - HKLM\..\Run: [AOL_Demo] C:\Applications\Tool\AOL Demo\DSGDemo.exe


O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


O4 - HKLM\..\Run: [Microsoft Installshield] rundll32.exe


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP


O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe


O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"


O4 - HKLM\..\Run: [Salon Iris] C:\Program Files\Salon Iris\Iris.exe


O4 - HKLM\..\RunServices: [Microsoft Installshield] rundll32.exe


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8... "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"


O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h


O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background


O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S


O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9


O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


O4 - Global Startup: Catalyst System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll


O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe


O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe


O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)


O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O11 - Options group: [INTERNATIONAL] International*


O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/2006...


O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windo...


O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent...


O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://garyscomputer-wfwuavyikf.app106....


O17 - HKLM\System\CCS\Services\Tcpip\..\{9B399... NameServer = 208.67.220.220,208.67.222.222


O17 - HKLM\System\CS1\Services\Tcpip\Parameter... NameServer = 208.67.220.220,208.67.222.222


O17 - HKLM\System\CCS\Services\Tcpip\Parameter... NameServer = 208.67.220.220,208.67.222.222


O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll


O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll


O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll


O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe


O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe


O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe


O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe


O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe


O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe


O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe

My internet browser has been hijacked, help!!! i ran hijackthis and below is the logfile?
in most cases hijack viruses/worms can be removed using antivirus such as Symantec Norton antivirus and anti-spyware such as Webroot Spyware.





I WOULD recommend AVG free anti-virus and anti-spyware but apparently you have it installed already and your system got hijacked, that's why free software is never that great. go grab the two software i told you, i guarantee those two paid software above will remove all bugs you have.
Reply:Try typing the name in "search" that should bring up all the files associated with it then you can delete them.
Reply:Do the following. Make sure you have downloaded all updates for IE.Download Free CW Shredder. Download Free Spyware Blaster.Click on Start then Settings then Control Panel. Double click on Add/Remove and if Httper entry is there then Remove it. Download Ftee one of the following


Ad-Aware 2007


Spybot Search %26amp; Destroy


Superantispyware. and for the virus programme download AVG Free version
Reply:Get Ad-aware se personal from http://www.lavasoft.com/products/ad_awar...


it costs less than money and it works really well!


it will remove all spyware, malware and data miners that none of the antivirus software picks up.
Reply:Post the log file on the site www.hijackthis.de You will get an instant analysis of all the entries with the suspect ones highlighted.
Reply:Get ya self spyware detector (update the ones you got) cos i can see you got a few things running in ya process that really shouldnt be. A browser hijacker is a form of malware or spyware that replaces the existing internet browser home page, error page, or search page with its own. These are generally used to force hits to a particular website
Reply:Get a good Anti-Virus system like Avast or AVG run Ad-aware 7 and Spybot search and destroy and another way around browser hijacks is not to use Internet Explorer but use Firefox instead and looking at the log i can see what's probably the cause of the hijack. You have Party Poker on your system now that's not good in my opinion as that's more than likely the one that's the cause of the problem in the first place if i were you i'd get rid of it but hey that's just me!!
Reply:Ares.exe this is highly suspect for starters...P2P I don't bother with for obvious reasons! could be a worm, you just don't know.


Your java needs to be updated.


Partypoker.com should go too!





[Norton antivirus] I for one wouldn't recommend this bloatware at all! A huge system resources hog!! Steer clear at all costs, it is now getting less and less used all the time, and people who do use it are usually beginners and know no bettter (Me for instance before switching to AVG)


NAV WILL fall to it's knees if spyware /nasties get thru, it is a useless piece of software IMHO