bonaventura

hi everybody.....

this is my first post in this forum, so bear with me guys

the symptoms started when i installed the an application from download.com (http://www.download.com/3120-20_4-0....-20&x=12&y=16).

the first thing i noticed was that my zone labs firewall freezes and wont start. and then when i was browsing a pop up showed like this :

Title bar : Add/Remove Programs

sometimes with a pic of the windows' add/remove screenshot on the browser.

i noticed that the browser is sending cookies like these :

Sending cookies to :
http://www.winfixer.com/pages/scanner/?p=20&ex=1&ax=2&aid=avm_ls_wfx5h_7,10&lid=keyin

http://www.winfixer.com/pages/scanner/libs/functions.js.php?aid=vm_ls_wfx5h%252c10&lid=keyin&ex=1

what happens next is that the browsers would almost always freezes up and then the windows shuts down the IE. it would offer me to report the error to microsoft's site. the following is the error signature :

AppName: iexplore.exe AppVer: 6.0.2800.1106 ModName: browseui.dll
ModVer: 6.0.2800.1106 Offset: 000078a9

sometimes the browser (when only one browser launched) would just freeze and shuts down. i cant open more than 1 browser bcs additional browser seems to trigger this behavior. it is as if lauching a new browser triggers the pop up but sometimes the popup fails to open and crashes the IE application.

i've looked for the "O2 - BHO: MSEvents Object" entry using hijackthis software and came up with nothing. i also cant find winfixer 2005 signature files/item as listed in www3.ca.com/securityadvisor/pest (abt winfixer), so i am (roughly) conviced that this is not a winfixer 2005 atack.

can anybody help me?

thank you very much for your help.

MoralTerror

Hi and welcome to TSF

Follow the 5 step process and then post a HijackThis Log in the HijackThis Help forum. 1 of the Analysts there will guide you through the process of cleaning your computer. Good Luck

bonaventura

hi mr terror.

happy new year.

just to let you know that the 5 steps process saved my new year's eve

all symptoms are gone. still have a couple of suspicious looking entries at the startup list, though. i've disabled them and see if my pc is acting funny again.

in the mean time, better get some info on them.

thank you, man.

greyknight17

bonaventura, I suggest not disabling them. Enable them back and give us the HijackThis log. Disabling them doesn't solve the problem if it's a bad process; it's best to remove them completely.

bonaventura

i'm going to dedicate this weekend to fix my baby so look in the hjt forum for my post.

thanks....