IE 6.0 right click menu 1

[crmace]

When I right click inside of my IE 6.0 browser an Adult Website link appears between Refresh and Properties. How do I remove this link from the menu?

 

[steamwiz]

Please Download hijackthis

http://tomcoyote.org/hjt

Unzip, doubleclick HijackThis.exe, and hit "Scan".

After the scan has finished the "scan" button will turn into a "save log" button

save the log file and paste it here

We can delete the registry key from the log - and probably a lot of other rubbish as well

 

[crmace]

Logfile of HijackThis v1.97.2
Scan saved at 12:26:27 AM, on 9/22/2003
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\msdtc.exe
C:\WINNT\System32\ati2plab.exe
C:\WINNT\System32\PcNicCtl.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\tp4mon.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\System32\Atiptaxx.exe
C:\WINNT\System32\ltcm000c.exe
C:\WINNT\System32\Promon.exe
C:\WINNT\System32\RunDll32.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\TP98.EXE
C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
C:\WINNT\System32\WLANSTA.EXE
C:\WINNT\System32\P2P Networking\P2P Networking.exe
C:\CFGSAFE\AUTOCHK.EXE
C:\Program files\ThinkPad\Utilities\tponscr.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\Altnet\DOWNLO~1\asm.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\unzipped\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.the-exit.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL =

http://www.the-exit.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =

http://g.msn.com/0SEENUS/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.bellsouth.net/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://www.the-exit.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.the-exit.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

http://www.the-exit.com/search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.the-exit.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

http://www.the-exit.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

http://www.the-exit.com

O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\1.bin\MYBAR.DLL
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IBMPMSVC] %SystemRoot%\System32\ibmpmsvc.exe -helper
O4 - HKLM\..\Run: [AtiPTA] Atiptaxx.exe
O4 - HKLM\..\Run: [XircWinModem4] ltcm000c.exe 9
O4 - HKLM\..\Run: [Promon.exe] Promon.exe
O4 - HKLM\..\Run: [SoundFusion] RunDll32 cwcprops.cpl,CrystalControlWnd
O4 - HKLM\..\Run: [TP98UTIL] C:\PROGRA~1\ThinkPad\UTILIT~1\TP98.EXE /s
O4 - HKLM\..\Run: [TpHotkey] C:\PROGRA~1\ThinkPad\UTILIT~1\tphkmgr.exe
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART
O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
O4 - Startup: Shockwave Init.lnk = C:\WINNT\system32\Macromed\Shockwave\SwInit.exe
O4 - Global Startup: AUTOCHK.LNK = C:\CFGSAFE\AUTOCHK.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM (HKLM)
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O16 - DPF: {00000000-CDDC-0704-0B53-2C8830E9FAEC} (IELoaderCtl Class) -

http://install.global-netcom.de/ieloader.cab

O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} -

http://akamai.downloadv3.com/binaries/IA/ia.cab

O16 - DPF: {B942A249-D1E7-4C11-98AE-FCB76B08747F} (RealArcadeRdxIE Class) -

http://games-dl.real.com/gameconsole/Bundler/CAB/RealArcadeRdxIE.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) -

http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/1,5,0,4285/mcfscan.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{96794F34-1FC1-4A5D-A869-6C6440DC90F9}: NameServer = 205.152.26.252 205.152.37.254

 

[crmace]

Thanks for the tip! I was able to fix it myself w/ the info you gave me. I really appreciate it.

 

[steamwiz]

crmace

Your browser has been hijacked

Close ALL browser windows - run hijackthis and tick to delete the following :-


R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL =

http://www.the-exit.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL =

http://www.the-exit.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

http://www.the-exit.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

http://www.the-exit.com/search

R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

http://www.the-exit.com/search

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.the-exit.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

http://www.the-exit.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

http://www.the-exit.com

O4 - HKLM\..\Run: [P2P Networking] C:\WINNT\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O16 - DPF: {00000000-CDDC-0704-0B53-2C8830E9FAEC} (IELoaderCtl Class) -

http://install.global-netcom.de/ieloader.cab

I suggest you now Download and install SpyBot

http://security.kolla.de/

click the online tab to search for and download the updates, then shut down and relaunch SpyBot.

Go to the Settings tab > File Sets, and uncheck 'System Internals' and 'Tracks' .
These aren't needed for our present purpose, and you can always experiment with them later on.

Finally, after closing down Internet Explorer, click 'Check for problems', and have SpyBot remove all it finds 'Fix selected problems'

you may have to run spybot more than once to clear everything

Remove everything pre-ticked in Red

You should now have a clean as new computer - good luck

steam

 

[crmace]

Hey thanks, again! I downloaded SpyBot and did everything I needed to with it. It was kind of scary to see how many trackers showed up, I had no idea.

 

[steamwiz]

crmace

you're very welcome

steam