Delete browsing history in Explorer 8

Hello,

You have a spyware not a virus.

Regards

Have you tried in safe mode? I recommend starting computer in safe mode and trying.  Both CCcleaner and avg are free so they might just take care of some. I recommend buying an antivirus for around 40-80 bucks and update its definitions. Only then you might be protected. It sound like a strand of persistent trojans or viruses.  

Other alternative, http://www.malwarebytes.org/ but you still have to pay some to get the best results.  Good luck buddy!

Cheers.

yeller--You could try Security System Suite.  Check the Temporary boxes in both columns
http://www.geocities.com/igor_shpak/
But malware removal is probably the right solution.  Run a scan with your existing (I hope) antivirus program and  SuperAntiSpyware as well
http://www.superantispyware.com/  The scan is free.
Then run HiJackThis.
http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html
If you need help in analysis, post here or analyze online at

Hi all,

Thanks for the suggestions.  I'll try CCleaner, Malwarebytes and SAS in Safe Mode.  I'll let you know what happens.

Thanks a million.

Ok, so I tried the following:

Boot Safe Mode
Ran Malwarebytes: it found something like "hijack.displayProperties
Ran SAS: 0 found
Ran Spybot: 0 found
Ran: Ccleaner

I thought Malwarebytes had found and removed the problem but as soon as I rebooted, the problem returned.

I always get the same 4 or 5 pron web sites listed in the History.

Help

yeller--Put IE8 into InPrivate mode for the future.  See left panel here
http://www.microsoft.com/windows/internet-explorer/features/safer.aspx

Run Malwarebytes in Normal mode.  Then run HiJackThis.

I ran hijackthis and removed a few items.  I ran Malwarebytes in normal and safe mode.
The sites in the history remain.
Help please.

yeller--You might be better off by posting your MalwareBytes and HiJackThis logs here.  Statements such as "it found something like "hijack.displayProperties"  do not give us much information.  
I have a strong feeling you have not eliminated all malware.
Once that is done, you can then do the following.
Did you try putting IE8 into InPrivate mode?.  See left panel here
http://www.microsoft.com/windows/internet-explorer/features/safer.aspx

Delete History items by using http://www.nirsoft.net/utils/iehv.html
Once you run it, click Edit|Clear All.

Hi jcimarron,

Thanks for the replies.  I am sure you are right.  The Malware is definitely still there.  I don't see how to put IE8 in "inprivate" mode.


Here is the hijackthis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:08:21 PM, on 04/10/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe
C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
C:\Program Files (x86)\SMINST\BLService.exe
C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Spyware Doctor\pctsAuxs.exe
C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files (x86)\Spyware Doctor\pctsTray.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
C:\PROGRA~2\AVG\AVG8\avgemc.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files (x86)\AVG\AVG8\avgcsrvx.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=91&bd=Pavilion&pf=cnnb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.canoe.ca/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=91&bd=Pavilion&pf=cnnb
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=91&bd=Pavilion&pf=cnnb
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0541.0\msneshellx.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [ISTray] "C:\Program Files (x86)\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Unknown owner - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_7477fb4c\AESTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~2\AVG\AVG8\avgwdsvc.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security - Unknown owner - C:\Program Files (x86)\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Recovery Service for Windows - Unknown owner - C:\Program Files (x86)\SMINST\BLService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files (x86)\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Audio Service (STacSV) - Unknown owner - C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_7477fb4c\STacSV64.exe (file missing)
O23 - Service: TV Background Capture Service (TVBCS) (TVCapSvc) - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVCapSvc.exe
O23 - Service: TV Task Scheduler (TVTS) (TVSched) - Unknown owner - C:\Program Files (x86)\Hewlett-Packard\Media\TV\Kernel\TV\TVSched.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10685 bytes

Well now you can try taking IE8 off and deleting the history using the methods you have tried. If this doesn't work, then try this method that helps you go through the hole nine yards and more.  

http://browsers.about.com/od/internetexplorertutorials/ss/ie8privatedata.htm

As always follow the steps, and report your findings.

just a last thought, do you have any software that prevents you from making some changes to your computer such as deepfreeze, windows steady state, centurion technologies or something like that?

Just a thought!

yeller--I am no HJT expert , but you do seem to have some baddies
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)  
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files (x86)\Spyware Doctor\pctsSvc.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: HP Service (hpsrv) - Unknown owner - C:\Windows\system32\Hpservice.exe (file missing)

The first and the last are "missing" so serve no purpose.  The other six seem to be running from the the wrong folder and probably are the baddies.  
So, run HiJackThis again and this time "Fix" the baddies.  I think you will be able to quarantine them in case I am wrong and you want to restore.  Alternatively, backup your hard drive to an external drive to allow a restore.  If all is OK after a day or so, DELETE those/that backup(s) immediately. Also delete any System Restore points from the past and start fresh.

I tried pr0t0c0l12's removal procedures and the problem remains. I don't quite understand what you means by "now you can try taking IE8 off".  Do you want me to uninstall IE8?

cimarron:  I have already  fixed those items in Hijackthis but the problem remains. IThis PC does not have any of that software you mentioned.  I finally figured out how to put IE8 in inprivate mode.  I ran the "delete browsing history" but no improovement.

I really do not know what else I can do.

yeller--"I have already  fixed those items in Hijackthis but the problem remains. IThis PC does not have any of that software you mentioned.  I finally figured out how to put IE8 in inprivate mode.  I ran the "delete browsing history" but no improovement."
If you put the baddies into quarantine, both from MalwareBytes and HJT, they should not be affecting IE until at least the next boot, if ever again.  So I do not understand how the problem can remain unless you need stronger malware removal such as ComboFix.  I am not at all expert with that, so hope someone else will guide you.  There is no point to putting IE8 into InPrivate mode until you are free of the baddies.  It does not act retroactively.  Conderning software you feel you do not have, there is none you need (except perhaps ComboFix, which I have only now mentioned) so I do not know what you mean by that.

jcimmaron: sorry, it was pr0t0c0l12: that asked " just a last thought, do you have any software that prevents you from making some changes to your computer such as deepfreeze, windows steady state, centurion technologies or something like that?"  This PC does not have any of thoses programs installed.

I am at a loss as well.  I have run all the suggested removal programs but the problem remains.
I will try Combofix.
Thanks

I can not run Combofix.  This PC is running Visat 64 bit.

Now what?????

Unfortunately this is a business PC and they want me to get rid of any Malware, if it exists.  So, they would not want to just rename the sites.

I do not understand this suggestion: "Encrypt it, using TrueCrypt or something similar".  It seems to me that you are suggesting I encrypt the History file but I might be confused.   What do you want me to encrypt?  Do you want me to encrypt the entire hard disk?

Additionally, you said "Rebooting should create a new and empty History file."  Is this after the hard disk is encrypted?  I am not clear on this suggestion.

In the "further steps" you gave links to XP repair installation.  This PC is Vista 64bit.

Thanks for all your help.  Any clarification would be really appreciated.

yeller--I presume the reason for your question here is because the History folder, full of porn site URL's, is embarassing.  It actually causes no harm to the function of the PC--assuming all malware has been removed.  If you encrypt the existing, but renamed, History folder, it cannot be opened for all to see, except those that have the password.
" So, they would not want to just rename the sites."  I do not know if anyone has suggested that.  Interesting idea.  But if you are trying to get rid of the sites, why would "they" care if you renamed them?
You have done just about everything that can be done to get rid of malware (though I think your order was sometimes mixed up), so either a Repair Install or Clean Install
http://www.vistax64.com/tutorials/88236-repair-install-vista.html
http://www.vistax64.com/tutorials/117366-clean-install-full-version-vista.html
is about all there is left to do.  The latter will wipe everything off the drive.  

jcimarron,

Thanks a million for all you help and suggestions.
I will give you the points for this question.

I did find an alternative to your suggestions (but it basically disables your ability to see any history):

1) This clears existing address bar autocomplete history: (but will also clear your entire index, which will rebuild next startup)

Start button>Control Panel>System And Maintenance>Indexing Options, Click on Internet Explorer History, Click ADVANCED, Click RESTORE DEFAULTS

2) This will stop autocomplete history showing again in future: (slightly different for IE7 vs IE8 but you will get the idea)

IE8 > Tools > Internet Options > Content > AutoComplete Settings > Use Autocomplete for: > Uncheck 'Web Addresses'  

Thanks again,

Yeller