toolbar 888 deadpoetic [Resolved]

DeadPoeticDeadPoetic
edited October 2006 in Spyware & Virus Removal
Hi i got toolbar 888 from msn and i've ran a virus scan and it tells me it only deleted one threat. I have Kapersky Anti-Virus..it came with System Mechanic Pro 6. I've done everything on System mechanic..even ran a adware.madware scan..it found toolbar888..i rebooted and its still on my computer. how can i completely delete toolbar888 of my comp. and i also keep getting other threats. x\ it makes my comp start off very slow. can someone help me please.
«1

Comments

  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Hi Deadpoetic. Sorry for the delay in getting back to you. Please follow the instructions below:

    Click here to download HJTsetup.exe. Save it to your Desktop!
    • Double click on the HJTsetup.exe icon on your desktop.
    • By default it will install to C:\Program Files\Hijack This.
    • Continue to click Next in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
    • Put a check by Create a desktop icon then click Next again.
    • Continue to follow the rest of the prompts from there.
    • At the final dialogue box click Finish and it will launch Hijack This.
    • Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
    • Copy and paste the log here
    DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
  • DeadPoeticDeadPoetic
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 10:24:50 PM, on 10/4/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Documents and Settings\Louis Vargas\Yinstall.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\MSN Messenger\msgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}\Update.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SysMech6.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Louis Vargas\Yinstall.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Hi. Please run a Bit Defender online scan from my signature below. Please post back the results of the Bit Defender scan along with a fresh Hijack This log.
    :)
  • DeadPoeticDeadPoetic
    edited October 2006
    Will do...i've also recently been getting this window when i restart my comp and my desktop shows..click here for image of the window. http://img527.imageshack.us/img527/6523/idontknowbm6.jpg
  • DeadPoeticDeadPoetic
    edited October 2006
    BitDefender Online Scanner







    Scan report generated at: Thu, Oct 05, 2006 - 14:41:58









    Scan path: A:\;C:\;D:\;E:\;















    Statistics

    Time


    00:55:49

    Files


    73179

    Folders


    3283

    Boot Sectors


    2

    Archives


    507

    Packed Files


    79







    Results

    Identified Viruses


    1

    Infected Files


    15

    Suspect Files


    0

    Warnings


    0

    Disinfected


    0

    Deleted Files


    14







    Engines Info

    Virus Definitions


    21376

    Engine build


    AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

    Scan plugins


    1

    Archive plugins


    10

    Unpack plugins


    1

    E-mail plugins


    0

    System plugins


    1







    Scan Settings

    First Action


    Disinfect

    Second Action


    Delete

    Heuristics


    Yes

    Enable Warnings


    Yes

    Scanned Extensions


    *;

    Exclude Extensions




    Scan Emails


    Yes

    Scan Archives


    Yes

    Scan Packed


    Yes

    Scan Files


    Yes

    Scan Boot


    Yes








    Scanned File


    Status

    C:\Documents and Settings\Louis Vargas\Yinstall.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\Documents and Settings\Louis Vargas\Yinstall.exe


    Disinfection failed

    C:\Documents and Settings\Louis Vargas\Yinstall.exe


    Delete failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0224711.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0224711.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0224711.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0224712.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0224712.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0224712.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0225034.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0225034.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0225034.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0227053.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0227053.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0227053.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0227463.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0227463.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP58\A0227463.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228152.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228152.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228152.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228300.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228300.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228300.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228829.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228829.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0228829.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0229661.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0229661.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0229661.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0229903.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0229903.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP59\A0229903.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0239047.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0239047.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0239047.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0239812.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0239812.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0239812.exe


    Deleted

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0240501.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0240501.exe


    Disinfection failed

    C:\System Volume Information\_restore{0BC48E0A-B04D-4F7C-BF81-78B38A4215F9}\RP62\A0240501.exe


    Deleted

    C:\WINDOWS\Yinstall.exe


    Infected with: BehavesLike:Trojan.LowZones

    C:\WINDOWS\Yinstall.exe


    Disinfection failed

    C:\WINDOWS\Yinstall.exe


    Deleted
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Could you post a new Hijack This log please.
    :)
  • DeadPoeticDeadPoetic
    edited October 2006
    will do...after i did that bitdefender scan..these windows pops out saying windows cannot find dev.exe Make sure you typed the name correctly and then try again. and then another comes out saying sever2.exe and says the same thing
  • DeadPoeticDeadPoetic
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 4:12:34 PM, on 10/5/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Documents and Settings\Louis Vargas\Yinstall.exe
    C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\PROGRA~1\iolo\SYSTEM~1\SysMech6.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}\Update.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Louis Vargas\Yinstall.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    OK. Follow the instructions below:

    First click Start--->Run. In the run box type appwiz.cpl

    A window will appear showing installed programs. Search for the following program:

    Toolbar888

    If it's there click the remove button. If it has it's own uninstaller that would be great, if not we'll have to kill it manually.

    After you do that, follow the instructions below:


    Download Pocket Killbox by Option^Explicit from here. Open Killbox by double clicking the icon.

    In the Killbox menu please make sure the delete on reboot button is pressed in and that the all files button is pressed in (it will blink green if you do it right). Copy the full paths below to your clipboard (ctrl + c):

    C:\WINDOWS\system32\crunner
    C:\Documents and Settings\Louis Vargas\Yinstall.exe



    Click the file menu on Killbox and select paste from clipboard. The files will now appear in Killbox. Click the red "X" on the Killbox window and follow the prompts thereafter. The PC will reboot. Once rebooted please post a fresh Hijack This log.
  • DeadPoeticDeadPoetic
    edited October 2006
    Skywalker...can you help me out with this other problem i am having...after i did that bitdefender scan..these windows pops out saying windows cannot find dev.exe Make sure you typed the name correctly and then try again. and then another comes out saying sever2.exe and says the same thing
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Does this happen when Windows loads? Does Windows work OK now? Can you take a screen shot of the Windows and then post them back here.

    sever2.exe is related to GainPublishing adware. A more intense spyware scanner will probably take care of it, but we won't do that until I hear back an answer from you on the above.
  • DeadPoeticDeadPoetic
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 9:50:26 PM, on 10/4/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}\Update.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Louis Vargas\Yinstall.exe
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe


    Everytime my windows starts..i get this message thats pops up cproc.exe
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Was this scan done after you used Killbox to delete the things I asked for? Also did you look for the uninstaller for Toobar888? I need to know these things before we continue.
    :D
  • DeadPoeticDeadPoetic
    edited October 2006
    Yes it was done after the scan, and yes i looked for the unistaller for toolbar 888, i delete it and its still on there. I hope that makes sense :banghead:
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    OK. We're going to do something a little different here. You'll need to print these instructions as you will not have access to the internet for most of this fix. I need you to make sure you can see all hidden files, explained below:
    • Click "Start".
    • Click "My Computer".
    • Select the "Tools" menu and click "Folder Options".
    • Select the "View" tab.
    • Under the "Hidden files and folders" heading, select "Show hidden files and folders".
    • Uncheck the "Hide protected operating system files (recommended)" option.
    • Click "Yes" to confirm.
    • Uncheck the "Hide file extensions for known file types".
    • Click Apply then click "OK".

    Next,

    Please download AVG Anti-Spyware from my signature below. Save the install file to your desktop.
    • Install AVG by double clicking the installer.
    • Follow the prompts. Make sure that Launch AVG is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
        Note: If the Update now option is grayed out, follow the steps below.
        • Click on Update on the toolbar.
        • Under Manual update, click on the Start Update button.
        • Wait until you see the Update succesfull message.
    • Right-click the AVG Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update AVG.
    AVG manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG is closed before installing the update.

    Disconnect your PC from the internet at this point.

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    ______________________________
    Navigate to C:\Windows\Temp
    Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

    Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
    Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

    Clean out your Temporary Internet files. Proceed like this:
    • Quit Internet Explorer and quit any instances of Windows Explorer.
    • Click Start, click Control Panel, and then double-click Internet Options.
    • On the General tab, click Delete Files under Temporary Internet Files.
    • In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
    • On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
    • Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
    • Click OK.
    Next Click Start, click Control Panel and then double-click Display. Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.

    Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
    ______________________________

    Close ALL open Windows / Programs / Folders. Please start AVG and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Automatically generate report after every scan and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
        Note that the image below might not reflect the image you will see but the instructions are the same.
        scan1nx.jpg
    • When done, click the Save Scan Report button.
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Tray Icon and select Exit. Confirm by clicking Yes.
    .

    While still in safe mode I need you to use Windows Explorer to look for and delete the following if found:

    C:\Documents and Settings\Louis Vargas\Yinstall.exe<---This file.
    C:\WINDOWS\system32\crunner<---This folder.
    C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}<---This folder.


    Reboot into normal mode and run Hijack This again. Put a check (tick) next to the following entries (do not worry if some don't exist):

    R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)

    O2 - BHO: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll

    O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll

    O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Louis Vargas\Yinstall.exe
    O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe

    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/Activ...veLauncher.cab


    Close all other browsers/windows and click Fix Checked. Close Hijack This. Reboot the PC and reconnect the internet. Post back here with the AVG log and a fresh Hijack This log.
  • DeadPoeticDeadPoetic
    edited October 2006
    Will do..but i dont have a printer so i would have to send everything you typed to my dads email so he can print it out and i would get back on you with the results. if thats ok?
  • DeadPoeticDeadPoetic
    edited October 2006
    Probably it wont be till tomorrow, around 7-8 eastern time.
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    No prob. I'm not going anywhere.
    :D
  • DeadPoeticDeadPoetic
    edited October 2006
    Quick question, "Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp" when you say EVERY LISTED USER..does that mean every user that i'm using on my comp? Such as Me and my mothers user name
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    Yes.
    :)
  • DeadPoeticDeadPoetic
    edited October 2006
    Ok i dont know if its the same problem or not but i was on msn earlier and it kept sending everyone on my list..the link that got me the virus in the first place. and i personally think my computer is completely in deep sh*t. it knocks me off conversations. so i deleted msn..now when i am on aim..it does the same thing. does this has anything to do with the things i am about to delete tomorrow? :scratch::scratch:
  • DeadPoeticDeadPoetic
    edited October 2006
    Ok so apperantly its doing it, to some of my programs...it shuts it down and windows messenger keeps popping out. its even making my comp slowier then usual. :bawling: :bawling: :bawling:
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    OK. Before you run the scan with AVG Anti-Spyware try the below first.

    Please run this tool--> http://www.jayloden.com/AIMFix.exe
    The tool will produce a text document. Please post that back here in your next reply.

    Also visit the site below and run the Purity Scan uninstaller:

    http://www.purityscan.com/uninstall.html


    Don't forget to post the log from AIMFix.exe and a fresh Hijack This log in your next reply. We'll run a scan with AVG later.
  • DeadPoeticDeadPoetic
    edited October 2006
    On AVG Anti-Spyware how do i active an internet connections..I use a cable modem as my internet.:scratch:
  • DeadPoeticDeadPoetic
    edited October 2006
    Logfile of HijackThis v1.99.1
    Scan saved at 12:48:24 PM, on 10/6/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\System32\ups.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Documents and Settings\Louis Vargas\Yinstall.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Common Files\{B081CD3D-0574-1033-0314-021102010001}\Update.exe
    C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe
    C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    C:\Program Files\Mozilla Firefox\firefox.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Program Files\Common Files\{3081CD3D-0574-1033-0314-021102010001}\MyToolBar.dll
    O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
    O4 - HKLM\..\Run: [SystemGuardAlerter] "C:\Program Files\iolo\System Mechanic Professional 6\SystemGuardAlerter.exe"
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [ioloDelayModule] C:\Program Files\iolo\System Mechanic Professional 6\delay.exe
    O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Louis Vargas\Yinstall.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [SMSystemAnalyzer] "C:\Program Files\iolo\System Mechanic Professional 6\SMSystemAnalyzer.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
    O4 - HKCU\..\Run: [System Mechanic Popup Blocker] "C:\Program Files\iolo\System Mechanic Professional 6\PopupBlocker.exe"
    O4 - Startup: desktop(2).ini
    O4 - Global Startup: desktop(2).ini
    O4 - Global Startup: Kaspersky Anti-Hacker(2)(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O4 - Global Startup: Kaspersky Anti-Hacker(2).lnk = C:\Program Files\Kaspersky Lab\Kaspersky Anti-Hacker\KAVPF.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Louis Vargas\Start Menu\Programs\IMVU\Run IMVU.lnk
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20B845BF-450F-4C1E-AF60-3CC380CDE328} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager/plugin/IENetOpPluginNOSSO.ocx
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {3A7FE611-1994-4EF1-A09F-99456752289D} (WildTangent Active Launcher) - http://install.wildtangent.com/ActiveLauncher/ActiveLauncher.cab
    O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqcpc/downloads/sysinfo.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://heislegendx.spaces.live.com//PhotoUpload/MsnPUpld.cab
    O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.pestpatrol.com/pestscan/pestscan.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6C6A77C7-B4CC-4792-BB9D-5B50A211F69E} (ProductInformation Control) - http://www.iolo.com/app/ocx/ProductInformation.ocx
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1151353940671
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} - http://www.nick.com/common/groove/gx/GrooveAX27.cab
    O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqcpc/downloads/msxml4.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://messenger.zone.msn.com/binary/ZAxRcMgr.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols3/fscax.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} (Installer Class) - http://activex.matcash.com/speedtest2.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iolo System Guard (IOLO_SRV) - Unknown owner - C:\Program Files\iolo\System Mechanic Professional 6\IoloSGCtrl.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe
    O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe


    AIMFix version: 1.6.106.152 (Oct 6 2006 02:00:53)
    SeDebug Privilege set successfully

    ***ANY VIRUS FILES REMOVED WILL BE LISTED BELOW***

    BlockRemove(): Now checking for Block-Checker: .5
    BlockRemove(): Block-Checker not found
    IMNamesRemove(): Now checking for IMNames: .2
    IMNamesRemove(): IM Names not found
    CleanMstc(): mstc not found
    C:\Data found, attempting to remove...
    quarantine(): C:\Data quarantined
    C:\WINDOWS\system32\c.exe found, attempting to remove...
    quarantine(): C:\WINDOWS\system32\c.exe quarantined
    C:\Documents and Settings\Louis Vargas\c.exe found, attempting to remove...
    quarantine(): C:\Documents and Settings\Louis Vargas\c.exe quarantined
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\elegyofshame\info.htm
    quarantine(): C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\emo2extreme\info.htm quarantined
    Profile for emo2extreme edited to remove possible virus code.
    quarantine(): C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\emoqu33r\info.htm quarantined
    Profile for emoqu33r edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\jerseyxboi\info.htm
    Profile for jerseyxboi edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\myspacer4queers\info.htm
    Profile for myspacer4queers edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\obliviouscontrol\info.htm
    Profile for obliviouscontrol edited to remove possible virus code.
    quarantine(): C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\shadesofhatredx\info.htm quarantined
    Profile for shadesofhatredx edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\sliptool666\info.htm
    Profile for sliptool666 edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\suicidalfaggotx\info.htm
    Profile for suicidalfaggotx edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\suicidalfaggptx\info.htm
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\Talk\info.htm
    Profile for Talk edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\thebloodshefeed\info.htm
    Profile for thebloodshefeed edited to remove possible virus code.
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\thebloodshefeeds\info.htm
    quarantine(): Attemtped to Quarantine nonexistent file C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\thehandshefeed\info.htm
    Profile for thehandshefeed edited to remove possible virus code.
    quarantine(): C:\Documents and Settings\Louis Vargas\Application Data\Aim\hvgcsubv\youaresoem0\info.htm quarantined
    Profile for youaresoem0 edited to remove possible virus code.

    ***RUN COMPLETED. ANY FILES REMOVED LISTED ABOVE***

    Reboot cancelled by user


    AIMFix version: 1.6.106.152 (Oct 6 2006 02:00:53)
    SeDebug Privilege set successfully

    ***ANY VIRUS FILES REMOVED WILL BE LISTED BELOW***

    BlockRemove(): Now checking for Block-Checker: .5
    BlockRemove(): Block-Checker not found
    IMNamesRemove(): Now checking for IMNames: .2
    IMNamesRemove(): IM Names not found
    CleanMstc(): mstc not found

    ***RUN COMPLETED. ANY FILES REMOVED LISTED ABOVE***



    AIMFix version: 1.6.106.152 (Oct 6 2006 02:00:53)
    SeDebug Privilege set successfully

    ***ANY VIRUS FILES REMOVED WILL BE LISTED BELOW***

    BlockRemove(): Now checking for Block-Checker: .5
    BlockRemove(): Block-Checker not found
    IMNamesRemove(): Now checking for IMNames: .2
    IMNamesRemove(): IM Names not found
    CleanMstc(): mstc not found

    ***RUN COMPLETED. ANY FILES REMOVED LISTED ABOVE***


    virusiz6.jpg
    :banghead: :banghead:
  • DeadPoeticDeadPoetic
    edited October 2006
    Shoot, i accidently installed that thing from http://www.purityscan.com/uninstall.html...is that bad? if it is how can i find it and delete it? :banghead: :banghead:
  • DeadPoeticDeadPoetic
    edited October 2006
    It also said some files would be deleted at the next reboot??? is that badd?
  • skywalker45skywalker45 Bloomington, IN. USA
    edited October 2006
    No that's not bad that's what you want. The Purity Scan uninstaller is meant to remove Purity Scan adware from your PC. Did you update AVG before you booted to safe mode? You won't have internet access in safe mode, on a cable modem, unless you choose safe mode with networking and I don't want you to do that. Go ahead and let the tools run, update AVG in normal mode, run the Purity Scan uninstaller, it's safe, and then post back the AIMFix log again and a new Hijack This log.

    If you need me to help you step by step through the process I can post it for you. Just let me know. I know it's a little frustrating but we'll get it done.
  • DeadPoeticDeadPoetic
    edited October 2006
    I havent done that safe mode yet, till my dad gets home with the instructions you gave me to print out. this is what i mean about the internet thing. it wont show any update on AVG
    virusfc0.jpg
  • DeadPoeticDeadPoetic
    edited October 2006
    I tried to scan Purity Scan on the site and this came out virusib1.jpg
This discussion has been closed.