RUNDLL error C:\WINDOWS\DOWNLO~1\CONFLICT.1\ymmapi.dll

[Mechoopda]

Hi
Can anyone help please? I have Windows XP SP2.
Everytime I try to click on a link that says Email Me I get this RUNDLL error::eek:
RUNDLL error C:\WINDOWS\DOWNLO~1\CONFLICT.1\ymmapi.dll
The specific module cannot be found.
:mad:
I have downloaded some dll files for a game in the last month & I think that might be the cause but I am not sure which ones!:-|

I have ran hijackthis & this is the logs::rolleyes:
Thank you:cool:

Logfile of HijackThis v1.99.1
Scan saved at 12:18:18, on 20/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopMail.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\PRIVAC~1\PRIVAC~1.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\system32\rundll32.exe
C:\DOCUME~1\Kiana\LOCALS~1\Temp\Rar$EX16.6339\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.google.com/mail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ntlworld.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.google.com/mail
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
http://uk.rd.yahoo.com/slv/ycheck/as/*http://search.yahoo.com/search?p=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by ntl:home
R3 - Default URLSearchHook is missing
O1 - Hosts: comments (such as these) may be inserted on individual
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [vptray] C:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [Privacy Restorer] C:\PROGRA~1\PRIVAC~1\PrivacyRestorer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealPlayer\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\RegClean.exe"
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma
Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O14 - IERESET.INF: START_PAGE_URL=http://www.ntlworld.com/
O16 - DPF: {084F552D-19EB-4668-9788-984CBC781A8F} (AsyncDownloader Class) - http://survey.otxresearch.com/Preloader.dll
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) -
http://sib1.od2.com/common/Member/ClientInstall/7.20.0003/OCI/setup.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1125426848903
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) -
https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F9A42912-7F3C-4D13-ADF4-233B9686FF8B}: NameServer = 212.67.96.129
212.67.120.148
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation -
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe

[gemini4]

The error is related to the Yahoo Mail plugin. Your Internet Explorer thinks that Yahoo is your default mail client. In Internet Explorer go to Tools/Internet Options click programs on the top. Change the E-mail value to Hotmail or Outlook Express and apply the settings.

In your Hijackthis log there are some elements of spyware. You have

O4 - HKLM\..\Run: [Privacy Restorer] C:\PROGRA~1\PRIVAC~1\PrivacyRestorer.exe

O4 - HKCU\..\Run: [Registry Cleaner] "C:\Program Files\Registry Cleaner Trial\RegClean.exe"

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

http://survey.otxresearch.com/Preloader.dll
O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) -

O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540000} (CInstall Class) - http://www.spywarestormer.com/files2/Install.cab

O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) -
https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab

Run the following commands (Start, Run):
tskill LimeWire.exe
tskill PRIVAC~1.EXE
tskill RegClean.exe

Use Hijackthis to fix the entries.

Download and install Windows Defender from here: http://www.microsoft.com/athome/security/spyware/software/default.mspx

Windows defender is free and will run in the memory to protect you from spyware.

[tayspen]

Hmm, I have never seen a blank host.

O1 - Hosts: comments (such as these) may be inserted on individual

Might want to check that one to.

Moved to virus forum...

[Mechoopda]

Thank you very much for your help. That was the problem, Yahoo used to be my default email but the link doesn't work anymore (don't know why).I have also fixed the spyware but I already have Spychecker, but will uninstall it now as it doesn't seem to work properly & will install the Window's Defender instead, thank you for your help!

PS. sorry I'm new to this forum I hope quick reply is the right place for replies,

[Mechoopda]

I'll check out that one too, is a very good idea! never thought of that...hmmmm

[tayspen]

The line I mentioned above, shows that there is a problem with the original MS hosts. You will need to do the following.

Download Hoster.

• Unzip Hoster to

C:\Hoster .[*]Run Hoster.exe from its new home[*]Click "Make Hosts Writable?" in the upper right corner (If available) .[*]Click Restore Original Hosts and then click OK.[*]Click the X to exit the program.
Note: If you were using a custom Hosts file you will need to replace any of those entries yourself.

[Mechoopda]

ohok thank you, I donot excatly know what hosts I was using,? is firefox a host?
I'll do that & see what happens.
Thank you for your help.

[Mechoopda]

I;ve done that! Thank you how can I know it is fixed?

[DMR]

ohok thank you, I donot excatly know what hosts I was using,? is firefox a host?

The "hosts" refered to in a hosts file are computers on your local network and/or URLs of locations (servers) on the Internet; the word "host" has nothing to do with browsers or other software.

...how can I know it is fixed?

Aside from a block of comment lines at the head of the file, a clean Windows hosts file will contain only the following entry:
127.0.0.1 localhost
(What your HJT log was listing in its "O1 - Hosts:" entry was actually a line from the comment block of your hosts file)

Some anti-spyware utilities such as SpyBot can add entries to your host file which block communication to/from known "bad" web sites. Unfortunatley, malicious infections can do the reverse, adding entries which will deny you access to "good" sites like Microsoft's Windows Update site or your anti-virus maker's web site.

[Mechoopda]

Thank you for your help. I still have lots of spyware I'm getting rid of. I found a software that's supposed to be very the best for removing spyware (recommneded by expert) but you have to subscribe:
http://www.pctools.com/spyware-doctor/?ref=g77

Regards

[Mechoopda]

The "hosts" refered to in a hosts file are computers on your local network and/or URLs of locations (servers) on the Internet; the word "host" has nothing to do with browsers or other software.

Aside from a block of comment lines at the head of the file, a clean Windows hosts file will contain only the following entry:
127.0.0.1 localhost
(What your HJT log was listing in its "O1 - Hosts:" entry was actually a line from the comment block of your hosts file)

Some anti-spyware utilities such as SpyBot can add entries to your host file which block communication to/from known "bad" web sites. Unfortunatley, malicious infections can do the reverse, adding entries which will deny you access to "good" sites like Microsoft's Windows Update site or your anti-virus maker's web site.

Thank you for your help. I still have lots of spyware I'm getting rid of. I found a software that's supposed to be very the best for removing spyware (recommneded by expert) but you have to subscribe:
http://www.pctools.com/spyware-doctor/?ref=g77

Regards