HELP - websites giving me login prompt

[vajpowb]

I recently had spyware on my system. I have removed but when I navigate to certain sites i.e. bankofamerica.com, free.grisoft.com, trendmicro.com and many others, I am getting an authorization pop-up. These are public sites. Something is hosed but I have done thorough searches and cannot find a solution. I've run HijackThis:
Logfile of HijackThis v1.99.1
Scan saved at 11:40:17, on 8/2/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\RioMSC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\System32\dllhost.exe
C:\Program Files\Mozilla Firefox\fire.exe
C:\Documents and Settings\andy\Desktop\HijackThis.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O23 - Service: InCD File System Service (InCDsrv) - AHEAD Software - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\System32\RioMSC.exe

Noth'n weird there. Just short of re-imaging system, not sure what to do.

 

[linney]

Your "Hijack This" is not the latest version of Hijack This, and the log looks incomplete to me too?

It looks like you could benefit from a visit to Windows Update too, as your log indicates that you are still at SP1 whereas XP is now at SP3. Maybe updating to IE7 would help too?

Trend Micro HijackThis 2.02

http://www.majorgeeks.com/download5554.html

Have you tried cleaning out your Cookies, Temp. Internet Files, browsing History?

Maybe you have corruption in one of the Index.dat files?
Safely Delete the Temporary Internet Files

http://www.mvps.org/winhelp2002/delcache.htm

Make sure your options in IE/ Tools/ Internet Options/ Advanced are correct.

Uncheck the boxes for "Install on Demand" for IE and Other programs (two boxes).

Try running temporarily with the third box "Enable Third Party Browser Extensions" unchecked and see how this goes.

"This specifies that you want to disable features you installed for use with Internet Explorer that may have been created by companies other than Microsoft.
If you encounter problems with Internet Explorer that you cannot resolve, you can use this option to help determine if third-party features are causing the problems without uninstalling the feature. You must restart Internet Explorer after turning this option on or off."


If that stops your errors, you will know where the trouble is.

Internet Explorer Fix

http://www.mvps.org/sramesh2k/IEFIX.htm

 

[BadBigBen]

C:\Program Files\Mozilla Firefox\fire.exe

should actually be:

C:\Program Files\Mozilla Firefox\firefox.exe

about the rest, I agree with Linney!



Ben

"If it works don't fix it! If it doesn't use a sledgehammer..."