Ok, I admit it... I need help. I have to actually finally STOP and ask for directions. I recognize there is no shame in this. I have a problem and the first step is admitting to the world....that I don't know what the heck I'm doing. LOL..
As a lurker I've tried to follow the directions on this website, I have two computers on a network and I've used many of the programs to clean up virtumonde that was on both. I've also deleted all my other anti spyware and firewall ZA programs and am down to just one that seems to be doing the job. My question is, why on each of these computers do I have the following identical HKLM's and HKCU's?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
I'm not including everything on my HJ log but look at the go microsoft ?LinkId 's ... what do they mean? The browser hijacks appear to have stopped but I cannot get rid of these proceeding entries.
Help and TIA!!
EDIT: Please be patient. There are over 180 unanswered topics in this forum at present and the current average wait time to receive help is 6 days. ~BP
Edited by Budapest, 14 February 2011 - 04:31 PM.