illmatic rob

okay .. what now ? I'm still getting this : The page cannot be displayed The page you are looking for is currently unavailable. The Web site might be experiencing technical difficulties, or you may need to adjust your browser settings. and shutting down shellconhiddenwindow is always the last thing to shut down before powering off . I've done all that you mentioned in post #14 ..

hey i didi .. i ran both and follow post #14 . I post both logs. See anything ?

ok .. i used the webroot spysweeper as requested. I'm submitting logs from webroot scan and HJT. See attachment please advise. thanks hijackthis_file__6.txt

hey, i'm back for a few before i turn in .. i ran the killbox.exe and copy and paste. now what ? Here's my latest HJT log after executing killbox.exe : Logfile of HijackThis v1.99.1 Scan saved at 12:46:35 AM, on 3/13/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Panda Software\Panda Titaniu

no problem .. then follow instructions you gave me right ? I'll do that and probably get back to you on the results tomorrow. It's getting late for me. Thanks for all your help. I hope to resolve this mess soon

ok .. where do i find killbox.exe ?

where do i get killbox.exe from ? And yes, I ran panda online scan and ended up downloading the panda anti-virus. Should I get rid of it ?

here's the panda report from scan : Panda Titanium 2006 Antivirus + Antispyware incident report EVENT DATE RESULTS ADDITIONAL INFORMATION ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

my latest HJY LOG : Logfile of HijackThis v1.99.1 Scan saved at 6:38:30 PM, on 3/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Panda Software\Panda Titanium 2006 Antivirus + Antispyware\TPSrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.

okay .. i downloaded everything and ran all the utilites . When I tried to erase this programs you mentioned I had problems with : C:\PROGRA~1\SOFTWA~1\soproc.exe ( I couldn't locate . In safe mode I could do a search for it and I wasn't sure where to look. ) And delete the following folders: C:\Program Files\RXToolBar\ ( This program even after I found I could not get rid of. ) C:\Program Files\VVSN\ ( this one was erased ) I still give the "shellconhiddenwindow" .. it's the very last program that shuts down when I turn off my laptop. Also, now my laptop is running a little slower . please ad

now what do i do after running both hijackthis and ewido anti-malware ? My IE problem still exist.

here is my latest hijackthis log after ewido anti-malware scan : Logfile of HijackThis v1.99.1 Scan saved at 11:10:39 AM, on 3/12/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido anti-malware\ewidoctrl.exe C:\Program Files\ewido anti-malware\ewidoguard.e

ok .. I ran the Ewido anit-malware program as suggested. Here is the report : --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 11:03:17 AM, 3/12/2006 + Report-Checksum: 6ED95B0F + Scan result: HKLM\SOFTWARE\Classes\ADM25.ADM25 -> Adware.Altnet : Cleaned with backup HKLM\SOFTWARE\Classes\ADM25.ADM25\CurVer -> Adware.Altnet : Cleaned with backup HKLM\SOFTWARE\Classes\ADM25.ADM25.1 -> Adware.Altnet : Cleaned with backup HKLM\SOFTWARE\Classes\ADM4.ADM4 -> Adware.

Thanks Matt, I followed your steps and download the "LSPFix.exe" in to a folder. I found a new.net domain and removed it and then rebooted. I'm still having trouble with some pages that are blank, page not able to display and some don't finish loading. I'm pretty sure that when I shut down to reboot the "shellconhiddenwindow" was gone but IE is still a problem not loading some website pages. here is my latest hijackthis log : Logfile of HijackThis v1.99.1 Scan saved at 11:25:44 PM, on 3/11/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Runni

brief description of IE problem : I get a lot of "page not display" problems. It says to click on "detect netowrk setting" but it does absolutely nothing. Here's one site i go to that gives me problems. After trying to download from it's page it cancel and in the address window it has "http://smiley.smileycentral.com/download/verisign_cancelled.jhtml". Why is verisign cancelling or block a page that is marked as "trusted" ? also, upon shutting down, the last thing to end is "shellconhiddenwindow". What is that ? I can't even locate with a search command. Please help. this is what i got when