1. Download About:Buster: http://www.majorgeeks.com/download4289.html
2. Reboot to Safe Mode
3. Open HijackThis. Press Config. Enter "http://www.yahoo.com/" in the boxes for Search Page, Search Assistant, and Search Customize. Press Back, then Scan.
4. Fix these:

   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sp/*http://www.yahoo.com
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
   R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = about:blank
   R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
   R3 - Default URLSearchHook is missing
   
   O16 - DPF: Yahoo! Pyramids - http://download.games.yahoo.com/games/clients/y/pyt1_x.cab
   O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB
   O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
   O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/031a1bb26e30d7f54621/netzip/RdxIE601.cab
   O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20040427/qtinstall.info.apple.com/saba/us/win/QuickTimeInstaller.exe
   O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/activedata/SymAData.cab
   O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) - https://www-secure.symantec.com/techsupp/activedata/ActiveData.cab
   These are likely fine, but unneeded. If they are ever needed again, they'll be reinstalled.
   

5. You may also fix these:

   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Steve & Monica Surf The Web
   R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
   I assume these are your customizations...
   
   R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
   May be a problem, but most likely it's from Norton.
   
   O4 - HKLM\..\Run: [PC-CAM 300 STI App Registration] RunDLL32.exe Pd016pin.dll,RunDLL32EP 513
   Do you know what this is?
   
   O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
   Unneeded startup item. Updater for Java...
   
   O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
   O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
   If you have problems accessing Internet Options.
   

6. Run About:Buster and allow it to scan twice.
7. Reboot normally and post another log.

The Wereotter

• Reply or follow-up to this message

• Search this forum
• Start a new thread on a different subject

• Report abuse of the forum