1.) Hello here is my Hijackthis log.
2.) When I first open Explorer it trys to connect to IP 85.12.25.105 or 89.188.16.18 , however
SpySweeper prevents this.
3.) When I delete BHO in hijackthis it returns as annoyance.
4.) The registry key is located here: registry key that keeps coming back located here
HKEY_CLASSES_ROOT\CLSID\{6D1A2FF3-1ADF-4935-A2A7-CA9DCE67D450}\InprocServer32
5.) I used 2 online scanners and neither one detected this BHO (Kapersky & Trend Micro)
6.) This BHO resets privacy settings in explorer (all cookies become enabled)
7.) C:\WINDOWS\system32\rqrrqon.dll does not exist when I search for the file. (folder settings set to
show hidden files)
8.) Ad-Aware deleted initial trojans this BHO is a remnant of the trojan.
9.) CAN SOMEONE PLEASE HELP ME !! THANKS IN ADVANCE !!
===============================================
Logfile of HijackThis v1.99.1
Scan saved at 10:58:40 AM, on 2/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\AdSubtract\adsub.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Compaq_Administrator\Desktop\SOFTWARE\HijackThis 1.99.1.exe
O2 - BHO: (no name) - {6D1A2FF3-1ADF-4935-A2A7-CA9DCE67D450} -
C:\WINDOWS\system32\rqrrqon.dll
O20 - Winlogon Notify: rqrrqon - C:\WINDOWS\SYSTEM32\rqrrqon.dll
============================================