4832 + Interview Questions in Computer viruses and spyware in Software Page 36 InterviewSolution

1751.	Solve : Please help me fix my computer from randomly freezing.?
Answer» Hi, this is the log from the MBR: Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK copy of MBR has been found in sector 0x012A18AC1 malicious code @ sector 0x012A18AC4 ! PE file found in sector at 0x012A18ADA ! THANKS!Now delete the current mbr.log file from the desktop and then follow the below instructions. Go to Start > Run then copy and paste the following into the Open field (do not copy the word Code): Code: [Select]"%userprofile%\desktop\mbr.exe" -f Double click on the mbr.exe file and post the contents of the new mbr.logOk, here is the newest file Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net device: opened successfully user: MBR read successfully kernel: MBR read successfully user & kernel MBR OK copy of MBR has been found in sector 0x012A18AC1 malicious code @ sector 0x012A18AC4 ! PE file found in sector at 0x012A18ADA ! Thank you OK go ahead with the FULL Dr Web scan now and post that log please. You can delete the mbr.exe and the log file.Ok, heres my log after the full scan: T-3877633-daddys little girl al martino - greatest hits.mp3;C:\Documents and Settings\Brad\My Documents\Incomplete;Trojan.WMALoader;Cured.; WxBug.EXE;C:\Program Files\aim\Sysfiles;Adware.Aws;; morpheustoolbar.exe/data001\data006;C:\Program Files\Morpheus\morpheustoolbar.exe/data001;Adware.Msearch;; data001;C:\Program Files\Morpheus;Container contains infected objects;; morpheustoolbar.exe;C:\Program Files\Morpheus;Container contains infected objects;; Thanks again. OK that found a few more. How is the computer running now?As of yet I've had now problems. So far I've been up for about 24 hours. Thanks again for all your help.Still no problems, thank you very much for all your guys' help. Sorry for the delay. Download OTMoveIt3 by OldTimer OTMoveIt3.exe and place it on your desktop. (unless you already have it installed) 1. Double click OTMoveIt3.exe to launch it. Vista users right click and choose Run As Administrator 2. Click on the CleanUp! button. 3. OTMoveIt2 will download a list from the INTERNET, if your firewall or other defensive programs alerts you, allow it access. 4. Click YES at the next prompt (list DOWNLOADED, Do you want to begin cleanup process?) 5. Once complete exit out of OTMoveIt3 ---------- Set a New Restore Point to prevent possible reinfection from an old one Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed. Go to Start > Programs > Accessories > System Tools and click System Restore Choose the radio button marked Create a Restore Point on the first screen then click Next GIVE the Restore Point a name then click Create. The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore. Next go to Start > Run and type Cleanmgr Click OK Click the More Options Tab. Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one. You can find instructions on how to enable and re-enable system restore here: Windows XP System Restore Guide or Windows Vista System Restore Guide . ---------- Use the Secunia Software Inspector to check for out of date software. Click Start Now Check the box next to Enable thorough system inspection. Click Start Allow the scan to finish and scroll down to see if any updates are needed. Update anything listed. . ---------- Go to Microsoft Windows Update and get all critical updates. ---------- I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free. SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also STOP certain cookies from being added to your computer when running Mozilla based browsers like Firefox. * Using SpywareBlaster to protect your computer from Spyware and Malware * If you don't know what ActiveX controls are, see here Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future. Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

1751.

Solve : Please help me fix my computer from randomly freezing.?

Answer»

Hi, this is the log from the MBR:

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x012A18AC1
malicious code @ sector 0x012A18AC4 !
PE file found in sector at 0x012A18ADA !

THANKS!Now delete the current mbr.log file from the desktop and then follow the below instructions.

Go to Start > Run then copy and paste the following into the Open field (do not copy the word Code):

Code: [Select]"%userprofile%\desktop\mbr.exe" -f
Double click on the mbr.exe file and post the contents of the new mbr.logOk, here is the newest file

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK
copy of MBR has been found in sector 0x012A18AC1
malicious code @ sector 0x012A18AC4 !
PE file found in sector at 0x012A18ADA !

Thank you OK go ahead with the FULL Dr Web scan now and post that log please.

You can delete the mbr.exe and the log file.Ok, heres my log after the full scan:

T-3877633-daddys little girl al martino - greatest hits.mp3;C:\Documents and Settings\Brad\My Documents\Incomplete;Trojan.WMALoader;Cured.;
WxBug.EXE;C:\Program Files\aim\Sysfiles;Adware.Aws;;
morpheustoolbar.exe/data001\data006;C:\Program Files\Morpheus\morpheustoolbar.exe/data001;Adware.Msearch;;
data001;C:\Program Files\Morpheus;Container contains infected objects;;
morpheustoolbar.exe;C:\Program Files\Morpheus;Container contains infected objects;;

Thanks again. OK that found a few more. How is the computer running now?As of yet I've had now problems. So far I've been up for about 24 hours. Thanks again for all your help.Still no problems, thank you very much for all your guys' help. Sorry for the delay.

Download OTMoveIt3 by OldTimer OTMoveIt3.exe and place it on your desktop. (unless you already have it installed)

1. Double click OTMoveIt3.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the INTERNET, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list DOWNLOADED, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt3

----------

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

Go to Start > Programs > Accessories > System Tools and click System Restore
Choose the radio button marked Create a Restore Point on the first screen then click Next GIVE the Restore Point a name then click Create.
The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Next go to Start > Run and type Cleanmgr
Click OK
Click the More Options Tab.
Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide
.
----------

Use the Secunia Software Inspector to check for out of date software.

Click Start Now
Check the box next to Enable thorough system inspection.
Click Start
Allow the scan to finish and scroll down to see if any updates are needed.
Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also STOP certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

1752.	Solve : Transfer avg to another computer??
Answer» Hi, I have AVG 8.5 on my laptop which I DOWNLOADED at a high speed site. Home I have DIAL up on our tower computer and wonder if SOMEHOW I can transfer AVG using a flash drive from the laptop to the tower? Is this even possible? Otherwise I DOWNLOAD 66mb by phone and wait...and wait....and wait....aaaarrrgh. Any help much appreciated. sampDownload the setup and copy it to the flash drive. To do this, when you click the download link, instead of clicking RUN, click save and save it to your desktop.Thanks very much... I will try this. Great forum by the way. Gracias again, sampAnytime. Good Luck.

1753.	Solve : Nasty virus?
Answer» Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to infect your system. First install the new Sun Java Runtime Environment Note: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update. Be sure to close all browser windows before beginning the install. Remove the old version(s) Download JavaRa * Unzip the file and open the JavaRa.exe * Click Remove Older Versions * JavaRa will search for and remove any outdated version of Java and remove any that are found. * Click Additional Tasks * Place a check next to Remove Useless JRE Files and click Go * Exit JavaRa * Delete the JavaRa files from the Desktop Additional Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. To disable the JQS service if you don't want to use it, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer. ---------- Update your Adobe Reader. http://get.adobe.com/reader/ Be sure to uncheck the Free McAfee Security Scan so it isn't installed. ---------- Use the Secunia Software Inspector to check for out of date software. Click Start Now Check the box next to Enable thorough system inspection. Click Start Allow the scan to finish and scroll down to see if any updates are needed. Update anything listed. . ---------- Now restart the computer and try updating again. .Well I have been working on the updates recommended from the Secunia Software Inspector. I get a message that "Windows Malicious Software Removal Tool - September 2009 (KB890830)" was installed successfully. And that "Security Update for Jscript 5.7 for Windows XP (KB971961)" Failed to update. I have performed this update a number of times through the Windows Update site and get the same result everytime. The yellow shield is still coming back with a message that I NEED to install update KB890830. It's like something is blocking the update. Thanks again for all of the help.Try the direct download for KB890830 http://www.microsoft.com/downloads/details.aspx?familyid=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=enI am sorry for being such a pain. I tried the direct download 4 times and could never get it to install. But after I tried the direct download I clicked on the yellow shield and got the message "installation complete". I did this twice and rebooted each time and the yellow shield came back with the same message - that I needed to install the update. If this is not a remnant from the virus I can live with it and leave you alone. My PC is running fine except for the annoying yellow shield. Thanks for all of your help. I HOPE that I do not need to ask for your assistance anytime soon. EF and SD have been an incredible help. I can not say thank you enough. KarenHello Karen. Could you please try this: The MRT (Malicious Software Removal tool) is located in WINDOWS\system32 and is named MRT.EXE To see if it's present on your system. Go to Start > Run > copy and paste the below into the Open: line mrt Click OK or press Enter Wait a little while and the tool should open Click the Next button Put a mark next to 'Full Scan',click Next, and do a full scan Please let me know what happens.SD, I am not sure what you want me to copy and paste, I tried "mrt" and got the following message: "Windows cannot access the specified device, PATH or file. You may not have the appropriate PERMISSIONS to access the item." Am I missing something?That's what I wanted to know. Apparently, the download is not completing itself. Mrt should have triggered the program to run if it was there. When you download the file do you save it then install it or do you install it right away?Did you try mrt.exe ?Yes, I tried MRT.EXE - same error message. SD, I have tried both ways. I have saved and then installed. And I have installed right away.Hello Karan. We are quite sure that the problem you're experiencing with the MRT update from MS is not caused by an infection. Your computer appears to be clean. Perhaps you could contact MS Updates to see if they can help with the MRT update problem. NOTE: Some of these you have already done. Use the Secunia Software Inspector to check for out of date software. •Click Start Now •Check the box next to Enable thorough system inspection. •Click Start •Allow the scan to finish and scroll down to see if any updates are needed. •Update anything listed. . ---------- Go to Microsoft Windows Update and get all critical updates. ---------- I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free. SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox. * Using SpywareBlaster to protect your computer from Spyware and Malware * If you don't know what ActiveX controls are, see here Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the LATEST Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future. Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smooth. Safe SurfingThanks for all of your help!

1755.	Solve : spyware.ietoolbar?
Answer» Hi there I use Norton internet security Regularly I get the message: malware found : spyware.ietoolbar. It is automatically REMOVED from the PC by Norton. Sofar sogood. But this comes up daily. How can i AVOID it? MAYBE can I block some internet address in my browser?

1757.	Solve : a new virus ??
Answer» If SOMETHING is corrupted in this profile a new ONE will normally fix it. To create a new user profileOk, I TRIED a new profile and it didn't fix anything.I'm out of ideas. If you don't want to go through the reformat then you might TRY a Startup Repair. Startup Repair: frequently asked questions

1758.	Solve : Bad Image error on laptop?
Answer» On my laptop I am receiving several pop-up boxes when I try to log on that have different title messages but the same error message within the pop-up. These occur before I choose a user to log on under and then throughout the log on process which never finishes: services.exe - Bad Image lsass.exe bcmwltry.exe userinit.exe explorer.exe verclsid.exe rundll32.exe QTTask.exe The application or DLL C:\WINDOWS\system32\dafonole.dll is not valid Windows image. Please check this against your installation diskette. Eventually it just times out. Can anybody help me with this? Are you able to log on? Download DDS from \|HERE\| or \|HERE\| or \|HERE\| and save it to your desktop. Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it) * XP users Double click on dds to run it. * If your antivirus or firewall try to block DDS then please allow it to run. * When finished DDS will open two (2) logs. 1) DDS.txt 2) Attach.txt * Save both logs to your desktop. * Please copy and paste the entire contents of both logs in your next reply. Note: DDS will instruct you to post the Attach.txt log as an attachment. Please just post it as you would any other log by copy and pasting it into the reply.But I can't log on the laptop, I am posting from another one now. Is there anyway to download the file onto my laptop without logging on, the operating system is XP and I have tried safemode but it just locks upNo you have to log in. Instead of safe mode have you tried 'Last known good configuration' How to start your computer by using the Last Known Good Configuration feature in Windows XPOK I will try that now.I was unable to run the dds file, far too many pop-ups that never seemed to end and no log files were ever generated. It did get to the spash screen that explained about dds but that was it, so I tried an hijackthis and it worked so I am including the log file here. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:50:38 PM, on 10/15/2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Safe mode Running PROCESSES: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\taskmgr.exe E:\PC Repairs\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=5061206 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll O4 - HKLM\..\Run: [DLCICATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCItime.dll,[emailprotected] O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [6423934b] rundll32.exe "C:\WINDOWS\system32\whiviakn.dll",b O4 - HKLM\..\Run: [wizoguruba] Rundll32.exe "C:\WINDOWS\system32\pasagami.dll",s O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 14\TMAS_OE\TMAS_OEMon.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user') O4 - Global Startup: Dell Network Assistant.lnk = ? O8 - Extra context MENU item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL hefpex.dll gygrhi.dll pqgugu.dll axcatz.dll uolvqo.dll ctyvfq.dll cgtcdz.dll,C:\WINDOWS\system32\dafanole.dll,C:\WINDOWS\system32\telopezo.dll O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: dlci_device - - C:\WINDOWS\system32\dlcicoms.exe O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Advanced Networking Service (hnmsvc) - SingleClick Systems - C:\Program Files\Dell Network Assistant\hnm_svc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5664 bytes I don't know if there is anything else I can try, I will see if I can run any of the programs suggested in the forum for malware/viruses. Maybe I can download them now as the lock ups don't seem to be as bad.If you already have ComboFix be sure to delete it and download a new copy. Download ComboFix© by sUBs from one of the below links. Be sure top save it to the Desktop. Link #1 Link #2 Note: It is IMPORTANT that it is saved directly to your Desktop Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix. Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them. Double click combofix.exe & follow the prompts. Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it) When finished ComboFix will produce a log for you. Post the ComboFix log in your next reply. Important:** Do not mouseclick ComboFix's window while it is running. That may cause it to stall. Remember to re-enable your antivirus and antispyware protection when ComboFix is complete. If you have problems with ComboFix usage, see How to use ComboFix

1759.	Solve : Problem still ongoing - Malware infection Unknown type NEW INFORMATION Post#13?
Answer» Have done so with REGARDS to Avira. I hope SOMEONE else can help me with my other problem. As I said, the slow down seems to start only be after I open the internet and start to browse but when it does, it effectively SLOWS down the whole netbook, not just the internet browser. http://www.avg.com/gb-en/download-tools go to above to complete the removal of avg sorry i cannot help you with the above , harryOK, if no one has an idea as to what may help this problem, I guess I will just reinstall windows. I just hated to something time consuming if I could fix it another way. Edit: Oct. 19, 2009: Done so and COMPUTER RUNS just fine now. This can be closed.

1760.	Solve : key board shortcuts are automatically invoking?
Answer» actually i asked the reply FRM the remaining people.Not for you Mr.Allan.If u think wrong i m sorry. Even i am logging from DIFFERENT user i am GETTING the same problem.I want to know exactly WHATS the problem its bcoz of a virus or any hardware problem.

1765.	Solve : Intemap mephisrnet explorer??
Answer» Lots of problems... Let's start with one obvious one. I believe I have a virus. I would normally just run Norton Antivirus, but that's not available to me at the moment, and I'm not having luck with online scans. One odd thing is that my Internet Explorer (6.0) has been renamed Intemap memphisrnet explorer. Other info is that I'm running Win98. Anyone know what this is?smirks......do you have any idea which virus you might have .......go to http://securityresponse.symantec.com/ there a number of removal tools there to use....... It might also be a good idea to D/L .....Zone Alarm (free fireawll) ....you MAY then be able to catch the virus attempting to send out its bugs to other computers http://www.zonelabs.com/store/content/home.jsp let us know how you make out. dl65 On my 11TH attempt, I finally managed to run Norton's online virus scanner all the way without my computer crashing. Only one trojan, W32.HLLW.Chemsvy, from a file I downloaded the other day...after the onset of my computer problems. From what I've read, it's pretty benign, so I doubt it was the source of my problems. I guess I'll have to look at software and hardware issues now. Thanks for your help smirks.....did you manage to get rid of the trojan? Download and run trojan remover.....it works great , but is an evaluation copy ...only good for 30 days . http://www.simplysup.com/tremover/download.html Does your p/c shutdown on fairly regular time frames.... because you have virus in there as well that causing that , unless you have software conficts which are causing this. let us know , dl65 Oh, getting rid of that particular trojan was easy. It's just a matter of deleting the infected files. I'll KEEP that program in mind though. I think my pc problems are unrelated to the virus. I've been having SEVERAL weird Windows problems...my quick launch toobar will disappear, or I'll start getting messages that my pc is low on resources when I'm not running a lot of programs. And for some reason, installing the new Windows update makes Explorer crash. Maybe I have a corrupted windows file or two. Bleh. get rid of ie 6 it the root of your problems if you have not got a zombie/worm download EITHER firefox or avant browser..forget ie6 and try shredder to keep the spys at bay>http://www.spywareinfo.com/~merijn/downloads.html and keep it on your desktop for more use if needed?Thanks for your reply. I uninstalled and reinstalled IE6. This seems to have gotten rid of the problem. (For now...) I downloaded CWShredder and everything looks okay. I was negative for trojans or worms on the online scan above and Norton AV.

1766.	Solve : help with, i think a tojan?
Answer» ok i cant connect to the internet and i got this message when i try to start up explorer, somethign msg.121.cpy.dll, so i looked on the internet and tried to fix it it says its sometihng from spyware or something well i dont understand how to fix it so can SOMEONE here PLEASE tell me how to do it, thank you so muchHi NoHate,try running Ad-Aware to detect this,also try PANDA software's free ONLINE scan.This seems to catch most Trojans & viruses.thanks, but i'v got it already.www.trojanscan.com try Spy-Sweeper http://download.com.com/3001-8022-10267571.htmlnohate....this may be a stupid question ......but if you can't connect ....how are you able to post here ....are you using another computer ? Please let us know dl65 oh well if i unistall then install the internet (that STUFF on the disk) it will work untill i restart the computer, but i fixed this whole tihng a while ago.Well i would look for a good trojan remover or a ANTIVIRUS like Nortan or go on a site like they said above. Hope it goes away

1767.	Solve : Re: manipulatingtheicesurface.com?
Answer» help me ....Are all the utility programs you listed up to date with the latest updates ......for example are you running Ad-Aware Ver 6 build 181 .....Go to Symantec site... http://www.symantec.com/index.htm go to the Download part and select security check ......run both Security scan and VIRUS scan.....Then I would D/l Zone Alarm ( the free version) http://www.zonelabs.com/store/content/company/products/znalm/freeDownload.jsp?lid=zadb_zadown When you setup Zone Alarm ........you POPUPS will probably ask for permission to access the internet ...answer no ...... After doing the scans I would do a search using the search function in Win XP . ( but first go into the control panel ......folder options and tick " show hidden files" and untick " hide hidden operating system files ") Search all files and folders for whatever the search bar is your trying to get rid of and delete it . One more thing .....go up to the "View" button up top on your explorer and click on it ...select toolbars and see it its shows up there ....if it does make sur its not ticked let us know how you make out , dl65 didnt helpmy temp internet files get deleted everyother dayand i have deleted my cookieshelp me....Is the manipulatingtheicesurface.com still showing up as your browser or is it just the pop ups. Can you right click on the popup and see if theres any info . There has to be some referance to those things somewhere on your puter. I havent been to that site... did you get attached by simply going to the home page or did you click on something. let me know because I would like to see where its coming from . When you search for it ....what perameters are you using? DL 65 help me .....If this is a site you frequent often and dont want the pop ups ......use a pop up blocker. ......... Am I missing something ? let me know..... dl65 ive never visited this site i never heard of it till i got these pop-ups one day and i dont want a pop-up blocker i need something that'll remove the program

1756.	Solve : Unable to access Windows Normal Mode?
Answer» My brothers computer has started to screw around [again] and, this time, I'm unable to do anything about it. I've identified the virus : PMROPN.exe. Anyways, I've got the logs here. Thanks. Code: [Select]Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:24:42 PM, on 10/17/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Safe mode with network support Running processes: C:\windows\System32\smss.exe C:\windows\system32\winlogon.exe C:\windows\system32\services.exe C:\windows\system32\lsass.exe C:\windows\system32\svchost.exe C:\windows\system32\svchost.exe C:\Program Files\PremierOpinion\pmropn.exe C:\windows\Explorer.EXE C:\WINDOWS\system32\wbem\unsecapp.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Mozilla Firefox\firefox.exe O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: DriveLetterAccess - {5ca3d70e-1895-11cf-8e15-001234567890} - C:\windows\System32\DLA\DLASHX_W.DLL O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\IPSBHO.DLL O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [DLA] C:\windows\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\windows\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - Startup: [emailprotected] = %APPDATA%\Microsoft\Installer\{6B755EC3-C709-4F5C-BC58-BC0D3967B6B6}\_2377D972A0372FCB34E3F7.exe O4 - Startup: UltraVNC Server.lnk = C:\Program Files\UltraVNC\winvnc.exe O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJxdm378YYHK O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe O15 - ESC Trusted Zone: http://*.update.microsoft.com O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1242976504280 O16 - DPF: {c3f79a2b-b9b4-4a66-b012-3ee46475b072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O18 - Protocol: about - {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\windows\system32\mshtml.dll O18 - Protocol: cdl - {3DD53D40-7B8B-11D0-B013-00AA0059CE02} - C:\windows\system32\urlmon.dll O18 - Protocol: dvd - {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: file - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\windows\system32\urlmon.dll O18 - Protocol: ftp - {79EAC9E3-BAF9-11CE-8C82-00AA004BA90B} - C:\windows\system32\urlmon.dll O18 - Protocol: gopher - {79EAC9E4-BAF9-11CE-8C82-00AA004BA90B} - C:\WINDOWS\system32\urlmon.dll O18 - Protocol: http - {79EAC9E2-BAF9-11CE-8C82-00AA004BA90B} - C:\windows\system32\urlmon.dll O18 - Protocol: https - {79EAC9E5-BAF9-11CE-8C82-00AA004BA90B} - C:\windows\system32\urlmon.dll O18 - Protocol: ipp - (no CLSID) - (no file) O18 - Protocol: its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: javascript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\windows\system32\mshtml.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: local - {79EAC9E7-BAF9-11CE-8C82-00AA004BA90B} - C:\windows\system32\urlmon.dll O18 - Protocol: mailto - {3050F3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\windows\system32\mshtml.dll O18 - Protocol: mhtml - {05300401-BCBC-11D0-85E3-00C04FD85AB4} - C:\windows\system32\inetcomm.dll O18 - Protocol: mk - {79EAC9E6-BAF9-11CE-8C82-00AA004BA90B} - C:\windows\system32\urlmon.dll O18 - Protocol: ms-its - {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll O18 - Protocol: msdaipp - (no CLSID) - (no file) O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL O18 - Protocol: res - {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\windows\system32\mshtml.dll O18 - Protocol: sysimage - {76E67A63-06E9-11D2-A840-006008059382} - C:\windows\system32\mshtml.dll O18 - Protocol: tv - {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll O18 - Protocol: vbscript - {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\windows\system32\mshtml.dll O18 - Protocol: wia - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll O20 - Winlogon Notify: premieropinion - C:\Program Files\PremierOpinion\pmls.dll O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\windows\ O23 - Service: Google Update Service (gupdate1ca2c76caf90b44) (gupdate1ca2c76caf90b44) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PLFlash DeviceIoControl Service - PROLIFIC TECHNOLOGY Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: PnkBstrA (pnkbstra) - Unknown owner - C:\windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB (pnkbstrb) - Unknown owner - C:\windows\system32\PnkBstrB.exe O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\windows\ -- End of file - 7692 bytes Unable to get SAS to install. MBAM log: Code: [Select]Malwarebytes' Anti-Malware 1.41 Database version: 2973 Windows 5.1.2600 Service Pack 3 (Safe Mode) 10/17/2009 12:35:02 PM mbam-log-2009-10-17 (12-35-02).txt Scan type: Quick Scan Objects scanned: 95658 Time elapsed: 3 minute(s), 2 second(s) MEMORY Processes Infected: 1 Memory Modules Infected: 2 Registry Keys Infected: 140 Registry Values Infected: 3 Registry Data Items Infected: 2 Folders Infected: 19 Files Infected: 93 Memory Processes Infected: C:\Program Files\PremierOpinion\pmropn.exe (Trojan.Agent) -> Unloaded PROCESS successfully. Memory Modules Infected: C:\Program Files\PremierOpinion\pmls.dll (Trojan.Agent) -> Delete on reboot. C:\Program Files\PremierOpinion\components\pmxg.dll (Trojan.Agent) -> Delete on reboot. Registry Keys Infected: HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\TypeLib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea1-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{eeb86aef-4a5d-4b75-9d74-f16d438fc286} (Adware.PremierOpinion) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\2e1117ed (Rootkit.Rustock) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\2e1117ed (Rootkit.Rustock) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\2e1117ed (Rootkit.Rustock) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\premieropinion (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BITS\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemRoot%\system32\svchost.exe -k netsvcs) GOOD: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\wuauserv\ImagePath (Hijack.WindowsUpdates) -> Bad: (%fystemroot%\system32\svchost.exe -k netsvcs) Good: (%SystemRoot%\System32\svchost.exe -k netsvcs) -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\Shared\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\premieropinion (Trojan.Agent) -> Delete on reboot. C:\Program Files\premieropinion\components (Trojan.Agent) -> Delete on reboot. C:\Documents and Settings\All Users\Start Menu\Programs\PremierOpinion (Adware.PremierOpinion) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\2e1117ed.sys (Rootkit.Rustock) -> Quarantined and deleted successfully. C:\Documents and Settings\user\Local Settings\Temp\7zS3205.tmp\patch.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3HKSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3REGHK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\FWPBUDDY.PNG (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D5091 (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D5F57 (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D62F0.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D65CF.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D6801.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D6A34.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\000D6C57.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\History\search3 (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\chrome.manifest (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\install.rdf (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\pmls.dll (Trojan.Agent) -> Delete on reboot. C:\Program Files\premieropinion\pmoci.bin (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\pmph.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\pmropn.exe (Trojan.Agent) -> Delete on reboot. C:\Program Files\premieropinion\pmservice.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\pmxf.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\premieropinion\components\pmxg.dll (Trojan.Agent) -> Delete on reboot. C:\Documents and Settings\All Users\Start Menu\Programs\PremierOpinion\About PremierOpinion.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\PremierOpinion\Privacy Policy and User License Agreement.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\PremierOpinion\Support.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully. C:\Documents and Settings\All Users\Start Menu\Programs\PremierOpinion\Uninstall Instructions.lnk (Adware.PremierOpinion) -> Quarantined and deleted successfully. C:\Documents and Settings\user\Desktop\Download 100,000 Emoticons!.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\user\Desktop\Sherv.NET - Animated Emoticons, Winks, Display Pics, plus more!.url (Rogue.Link) -> Quarantined and deleted successfully.

1775.	Solve : Pop Up Blocker?
Answer» Been having TROUBLE lately with pop-up ..have run ad-aware and am STILL getting them.. I have HEARD that the GOOGLE tool bar is good for getting rid of these. Has anyone every used it and if so does it seem to help? Thanks alot!Use Firefox as a BROWSER rather than Internet Explorer: Mozilla Firefox google toolbar is good. MSN Tool bar also works. Also Popup stopper from Panicwaremy favorite is this one>http://www.secretmaker.com/

1785.	Solve : lsess.exe?
Answer» can anyone tell me what this PROGRAM is...You probably MEAN lsass.exe, correct? Lsass.exe is a FILE that can be infected by the Sasser worm. What You Should KNOW About the Sasser Worm

1768.	Solve : Need to remove Searchbar?
Answer» Hi, ONE computer in the office has downloaded an evil tool called "searchbar". This happened a few weeks ago. All it has done is changed the home page of IE, and given SPYBOT some FITS. The computer is an old piece of junk running on a Pentium 1 @ 300mhz making installing things like firewalls impossible. OS is Windows 98. Spybot finds files and "fixes" them but never gets rid of the "searchbar". Does anyone have any "Free" ideas? (Besides throwing the old thing out the window and GETTING a new one) Thanks in advance. wizardmaster.....the search bar thing must be going around right now .......try this Trojan remover go to http://www.simplysup.com/tremover/download.html Its a full working evaluation prog ( 30 days ) give it a try. laso give this a try if the above doesnt help .. http://securityresponse.symantec.com/avcenter/venc/data/trojan.qhosts.html this sounds like whats happening on your p/c Let us know dl65 .............. this happened to me too. Go to one of the site he says and it should help.The first link's program didn't do anything. I don't think it's a trojan...but I'm not an expert so I'll just keep my mouth shut. I APPRICATE the help, I'll try the second one tomorrow. I'm late for a meeting so I can't do it today. errr I hate this "searchbar" if you run across any other ideas please let me know them. thanks, wmeither download shredder>http://www.spywareinfo.com/~merijn/downloads.html or spysweeper from webroot.com and this if you wish>http://www.wilderssecurity.net/bhblaster.html[glb]shredder[/glb] did it! Appreciate it! Thanks, [glb][glb]wm[/glb][/glb]

1769.	Solve : Re: My computer restarts for no reason!?
Answer» its the sasser WORM its a product of the m$blaster worm TRY this >http://vil.nai.com/vil/stinger/ more info here>http://www.microsoft.com/security/incident/sasser.aspHi .....GO to http://securityresponse.symantec.com/avcenter/tools.list.html this tool will get rid of the Sasser........you may have to use another computer to get this tool as yours will keep shutting down......Download it to a disk and the install it in your computer.....It works ....I had to do that for a friend YESTERDAY .. DL65

1770.	Solve : help! AIM virus. weird away message !!?
Answer» please help me?!!? I have this AIM virus and what it does is that it pops up a away message saying that OMFG LOOK http://pics99.blogsite.org/friends.scr !!!!! or something similiar like that. The away message pops up like every one MINUTE so its REALLY really annoying. It all started when I went to that website and when a download window came up, I clicked open. I'm not 100% sure but i think when the download was completed, MS-DOS window came up for a second. So im guessing that now that thing I downloaded is running on my computer. I TRIED to shut off that program but going to Task Manager and clicking End Task, but it didnt let me. It didnt even let me open the Task Manager window. When I go to Task Manager, it would STAY on for a second or not even and go off, without giving me any chance to shut off any program. PLEASE HELP ME THIS IS SO ANNOYING!Please Read This First - Viruses & Spyware Install the programs recommended to scan for viruses, trojans and spyware.

1772.	Solve : randomly rebooting virus?
Answer» hey guys. I am having a PROBLEM with a virus of some sort. My comp is randomly rebooting, sometimes i'm online and sometimes it's just on the desktop with the screen saver on. Aslo it randomly freezes to a blank white screen with vertical lines. When it does this I have to reboot it and then it works fine for a little while. I've tried updating all the windows 2000 updates and everything and running Norton. When I did that Norton said I had a worm in msegri32.exe. I don't know if that's a FILE or what but I tried deleting it and it supposedly did, however I found it again when i was searching for it. I don't know how else to get it to stop. Do any of you techies have any ideas? I have the installation disk but if I reintall it will I lose all the other stuff on Windows? Thanx Chelsea Please Read This First - Viruses & Spyware Does Norton not allow you to remove the file? If it does not, I suggest you boot into safemode and scan from there. Look at the programs recommended in the sticky. They may be useful to you. You might has the virus called MSBlaster and its a little hard to remove goto microsoft.com and do a search for 'msblast' and they wiull give you a step by step walkthough of how to remove it. if that does not work, you might have a boot sector virus with you can use a WIN98 bootup disk, and run without cd-rom support and type: fdisk /mbr - which will remove your master boot record of any kind of startup issues. if you are still having the problem, (if you are running winxp, win2k) goto start > run and type 'regedit' and goto Local Machine > SOFTWARE > microsoft > Windows> Run. and see if you see anyhting unusual that runs during startup.http://support.microsoft.com/default.aspx?scid=kb;en-us;190136 reboot pc and keep tapping the f8 and chose last good config.....do you have firewall on you system...and run this >http://vil.nai.com/vil/stinger/Ok I found out that it's a Randex H worm. I follwed the instructions and downloaded IDEs and some other thing and booted it in safe mode and diid the comand prompt to scan and remove it. The thing is-- it removed the file but it was still on my comp. maybe through the registry? So now I still have this thing on my comp and there are lots of files and even folders that it has created that it won't let me delete. It either says access denied, or that it's in use. So I'm gonna try what you suggested merlin. I don't have a firewall but I did go through andmake passwords for everything. OH, and can anyone tell me what a patch is and how you know it's up to date? Thanx guys Passwords are not the same as a firewall. They are not nearly as effective. Passwords are to keep people from your system that use your keyboard. Firewalls are there for people and programs that try to connect your computer. Here is an article I suggest you read: How Firewalls Work Once you have done so, I suggest you obtain a firewall to prevent the worm from connecting the net.you can get avg antivirus free on the net and this will remove or QUARINTINE the trojan , it has also caught 2 for me when i have been online it is a very good freeware pakage there is also free updates as well.

1776.	Solve : svchost.exe... Virus????
Answer» I ran an online scan on Trend Micro and it FOUND a virus called the WORM_NACHI.DAM and the file was svchost located in the C:/Windows/System32/drivers. then i got another one only in the system32 folder. i checked properties of both and the one dat is not infected had a description of Generic Host Process for WIN32 Services, while the one infected had Unknown. should i got ahead and DELETE this? it does look suspicious being the only .exe file i got in the drivers folder.Delete or rename it and RERUN the virus scan.

1778.	Solve : Nortons not recognizing tcp/IP?
Answer» Help? Can anyone answer this? I'm running WINDOWS XP with both SP 1 and SP2. When Iboot up my computer a messageg COMES up that Nortons 2002 states that since I don't TCp/IP settings it won't scan my E mail. I have both the "Internet PROTOCOL tcp/IP and Microsoft TCP/IP ver 6 selected on the system. Also since I'm on cable they tell me I automatically have a TCP/IP setting through their modem. In the past Nortons used to scan both incoming and outgoing messages. What do I need to change?Before installing service packs you should uninstall your antivirus software. Try uninstalling Norton and reinstalling it. My wife had a similar problem and that cured it.

1781.	Solve : total shut down?
Answer» wtoolsa and wsup have my windows 98 inoperable in safe mode no icons even show up or the START button scan reg didn't help if yo have ideas with the C:/ please explain how to GET there in easy terms i'm pullin my HAIR out Sounds like you may need to repair some of the system files, which is quite easy in Win9X. Boot from the boot floppy. Once you get to the DOS PROMPT, type sys c: this will overwrite the basic system files. When it's done, REBOOT into safe mode and run Ad-aware and Spybot.Does this work for XP?

1782.	Solve : My comp sucks?
Answer» Ive run Adaware, Spysweep, Spybot S&D and windows washer yet my comp still randomly reebots and my internet explore home page is still bein changed to a website called "about:blank" how do i make my COMPUTER not suckThe random rebooting of your computer is not necessarily a software problem. First though, I would ensure your virus definitions are up-to-date and I would run a full system scan. Also, make sure that ALL of your drivers are good. If that doesn't work, CHECK the fan on your processor. If you touch it and burn your finger, you need a new fan and that should fix the problem. I have also seen BAD RAM and hard drives cause the problem. Hope that helpsJanet.........What anti virus are you running and is it current and complete with all the latest updates ?. Also ....the fact that your home page is being changed, suggests that you may have have a hijacker present. So ......D/l CW Shedder .........Ver 1.59.1 http://www.majorgeeks.com/download4086.html ... when your hompage is changed to " about blank" run Shedder and it should change it back and TELL you what changed it . If you do in fact have a hijacker ......then you will have to REMOVE it using Hijackthis...... http://www.majorgeeks.com/download3155.html .... Now if you want to know what the hijack this log is all about goto .......... http://computercops.biz/HijackThis.html http://computercops.biz/CLSID.html http://computercops.biz/StartupList.html Here's more info on the hijacker ..... http://www.richardthelionhearted.com/?url=merijn.richardthelionhearted.com Let us know how you make out . dl65

1783.	Solve : problems with dial up changing?
Answer» when ever i disconnect from the internet something happens to my dial up. when i go to connect again later my user name has changed with like an IP ADDRESS at the end and the phone number i use to dial to my ISP has change to this huge string of numbers. i have done spyware checks and run ANTIVIRUS scans but i can't find ANYTHING. its really pissing me off. please can anyone help?!?!save your username and password...delete your dial up connection and MAKE a NEW one and see if it does it again? and what operating system is this happening to?

1784.	Solve : My Computer is horrible?
Answer» My computer has deep deep issues, it all started when my internet was FROZE to one page. I call the computer company and they basically told me to run a system recovery. I did and that did not fix the problem. It deleted everything that it intended to do, but now everytime i try to do anything i get error MESSAGES like not accessible to desktop and stuff like that. I TRIED to buy and antivirus program thinking that would do the trick but the computer says (yes it talks) that i NEED 11megabytes to load the software. I try to do that and that doesn't happen. I cant even reload my isp through the cd rom this whole thing is frustrating i am hoping somewhere someone could help me. Let me know please thank you very muchSeems to me like you're better off formatting your HDD. Take proper precautions before connection to the internet and install an Adware SCANNER, Virus scanner and a Firewall. How Stuff Works - How Computer Viruses Work How Stuff Works - How Firewalls Work How Stuff Works - How Internet Cookies Work

Explore topic-wise InterviewSolutions in .

Solve : Please help me fix my computer from randomly freezing.?

Solve : Transfer avg to another computer??

Solve : Nasty virus?

Solve : Infecton I think.?

Solve : spyware.ietoolbar?

Solve : Unable to access Windows Normal Mode?

Solve : a new virus ??

Solve : Bad Image error on laptop?

Solve : Problem still ongoing - Malware infection Unknown type NEW INFORMATION Post#13?

Solve : key board shortcuts are automatically invoking?

Solve : Please check rist log/new logs?

Solve : Infected Computer According to Broni?

Solve : Help get all of "security tool" from computer.?

Solve : W32.Jeefo?

Solve : Intemap mephisrnet explorer??

Solve : help with, i think a tojan?

Solve : Re: manipulatingtheicesurface.com?

Solve : Need to remove Searchbar?

Solve : Re: My computer restarts for no reason!?

Solve : help! AIM virus. weird away message !!?

Solve : HELP!! anyone who can look at a hijackthis l?

Solve : randomly rebooting virus?

Solve : computer being used to spam email to other people?

Solve : mcsmss.exe?

Solve : Pop Up Blocker?

Solve : svchost.exe... Virus????

Solve : Filter Program out of control?

Solve : Nortons not recognizing tcp/IP?

Solve : What virus scanner do you use??

Solve : Results of Spybot Scan-- Virus?

Solve : total shut down?

Solve : My comp sucks?

Solve : problems with dial up changing?

Solve : My Computer is horrible?

Solve : lsess.exe?

Solve : www.404ads.net?

Solve : Freezing XP - Help me!!!!?

Solve : Tip of the week?

Solve : Norton AntiVirus Live Update won't complete?

Solve : Computer help.?

Solve : Norton scanning Word files....stop it??

Solve : BAsfIpM.exe?

Solve : Privacy?

Solve : AVG-NORTON ?Conflict?

Solve : I need help with a virus problem?

Solve : Can't close Internet Explorer windows?

Solve : system soap?

Solve : to Read registry to get all the application?

Solve : you guys are guna love this....?

Solve : catch.exe?

1786.	Solve : www.404ads.net?
Answer» I was getting a LOT of spyware so i downloaded spybot and ad-aware now sometimes when i try to sign on the internet i get redirected to www.404ads.net... (more there) I was wondering if anyone KNOW how to stop that.Adaware SE should offer you the OPTION to lock your BROWSER and PREVENT hijacks.

1788.	Solve : Tip of the week?
Answer» Here is a super tip - Just sort your windows system32 and drivers directory according to DATE and the most recent files are on top. simply delete the files of the last four or five DAYS and you will be surprised how all the problems vanish try this safemode only....it may help people in the fight against trojans/worms/spyware etc..AH, yes, I allready see the hordes of clueless people who delete the wrong files and ask us why we'd post such tips.you would have thought by now people the own pc have the sense by now to know what to do with it if they>?DONOT YOUR USE THOSE UPDATES silly ??...some system that is keeps needing them WHY ??the question is the system is that good why do you need updates /program/fault/bad scripting/the list could be endless nice scam...but that would be then end of all fixit forums....bring on longhorn after all winxp does keep me GOING ...thou i do have a super-nap care off m$oft > that the average person needs nine.30 mins of sleep but wixp keep me awake ..wondering if it may be like the operating systems that msoft ..marking department have tried to sell the user an infalable system wake up people ...are you being conned is the question i would like to run a poll on this issue ..you can keep winxp i will stick with winme...its weird that bill gates dumped it ...the best system besides win98se...maybe is was to good !as has for the last poster it may help them concerned.... I agree with Merlin on XP; its a total suck out. Have you ever heard of Paladium or DRM or Microsofts secure computing initiative? SP2 was just the beginning. Longhorn will be the back breaker. You won't be able to run any software that has not been "approved" to run on your machine. But don't take my word for, do your own research.There are safer ways to remove redundant files..I'm agreeing with Raptor here. Methinks BEGINNERS would be a little better off with a couple of virtual dishcloths (anti-virus, anti-spyware etc) than the "pour industrial strength bleach all over everything - that'll kill all the germs" tactic. merlin, Windows ME is four years old now (at least). It's not weird that Microsoft quit supporting it - it's good business sense. And boys, if you're so worried about all this Palladium malarky, there are hundred's of Linux distro's avaliable for free on the internet...

1790.	Solve : Computer help.?
Answer» Hi. I was wondering if someone could maybe give me some ADVICE, or help about a problem that my computer seems to have. This morning, I turned on my computer, and everything was fine for about an hour, but then there was this problem that seemed to happen. Whenever I visited a site, I WOULD get pop-up after pop-up, and even when I went to my homepage, I got numerous pop-ups. Then, my computer got really slow, and keep disconnecting from the internet. Another problem, is that my computer kept freezing up, and I've had to restart it numerous times. The first thing that came to my mind, is that maybe my computer has a virus? I use to have Norton Antivirus, but it doesn't scan anymore... I do have "maintenance wizard"... If anyone has any idea what the problem with my computer is, I would appreciate any help. My email ADDRESS is [emailprotected] Thanks.moviefan81.......What do you mean you used to have Norton Antivirus...but it doesn't scan any more......? Certainly sounds as if your pc is infected with who knows what ...... You must install and scan with Anti Virus ( one that works) and also I would suggest Ad-Aware and Spybot . I would also D/L and run stinger ...just to do a quick check for a few nasties. http://vil.nai.com/vil/stinger/ Then I would got to ..... http://www.symantec.com/index.htm scroll down to downloads......then select security check ........now do the scan for viruses. Do yourself a favour and get a good anti-virus. You can D/l Norton AV .........free for 90 days ...... let us know dl65 Trend Micro - Free Online Virus Scan Install a decent virus scanner, but first use this. Scan for Spyware as well.Thank you for the advice. Norton antivirus use to scan my computer every friday, but it stopped scanning my computer. I click on "Norton antivirus", but it doesn't do anything. Maybe I need to install Norton antivirus again. I installed "spy sweeper" and it found some "spyware" and "adware" on my computer. My computer is a bit faster today, and I'm having no problems with pop-ups, but it still disconnects from the internet every now and then. Once again, thank you for the advice. I'll keep you updated on how things go. Hopefully those links you provided will help fix my computer. Thanks.moviefan81......Have you checked Norton to be sure the "Auto Protect" feature is still ENABLED? Some viruses will disable that feature ....... Have you D/L and ran stinger ? Is your Norton up to date with the latest virus definitions and is your subscription still valid ....... let us know dl65 My computer has been running great the past two days. after scanning my computer with "Spy sweeper"... it seemed to fix my computer right up. It's running fast, and it's not disconnecting from the internet like it was last week. I'd like to thank everyone who helped me. I really appreciate all the help, and I know if I need some computer help, I'll come to this site for the help. Thanks again everyone.I suggest you use a browser such as Mozilla Firefox and configure it STRICTLY so that not even tracking cookies get through. Also run your spyware scanners on a regular basis. Same goes for virus scanners.

1791.	Solve : Norton scanning Word files....stop it??
Answer» Just installed Nortaon AV Scan 2004... How can I turn off the scan on my Word files? Every time I go to open a file, I have to wait for it to scan first. What a pain? Is this necessary??? Thanks.wonderer.....I'm not so sure thats a great idea.....but if you must ...open Norton and CLICK on options...then click miscellaneous.....and REMOVE the tick from ....enable office plugin. I think that will do it . dl65 Thanks for your reply. So, you don't think we should take it off? What is the risk on Word files? I don't use it much...just copy and paste text from the INTERNET onto Wordpad first and then Word. (to clean up format, etc.)It may scan for harmful macros. Macros should be disabeled from within Word, but ADDITIONAL security doesn't HURT.

1792.	Solve : BAsfIpM.exe?
Answer» hey all, Nothing's really WRONG with my computer, but I'd like to keep it that way and I was looking at my task manager and i NOTICED a STRANGE EXECUTABLE...BAsfIpM.exe...so I was just wondering if anyone knew what it is/does and if it's ok thanks!Perchance, is your computer a Dell? That is a driver for some SORT of card or chip from BASF. A visit to BASF web site might shed more light on the subject.

1793.	Solve : Privacy?
Answer» How can I find out if someone who I share a computer with has installed any programs that might be tracking my computer USAGE or GAINING access to my EMAILS or using any other method to gain access to my privacy?http://www.keylogger.net/or buy an external hard drive...Thanks for responding Merlin_2. I hope my question was clear. I am not LOOKING for a way to spy on someone else. What I want to do is find out if any programs such as Keylogger have been installed on my PC. I understand these type programs are deliberately hidden on a computer and can even be set up to secretly email my computer activities to someone. How can I check my computer to see if any such program has been installed? Thanks, Shad.i take it you are logged in as a user...download spysweeper from www.webroot.com...it should scan the pc for all programs which maybe tracking you..like radmin..keyloggers..etc..tojans /worms..and there is this>http://www.tooto.com/keyloggerkiller/ i post the keylogger to fight FIRE with fire if you get my drift Please Read This First - Viruses & Spyware Install the programs recommended. How Stuff Works - Security Channel How Stuff Works - Internet Channel Read the articles related to what you wish to know.

1794.	Solve : AVG-NORTON ?Conflict?
Answer» I have NORTON 2004 and AVG antivirus program INSTALLED in my computer having windows XP. I want to ask whether there will be any problem or conflict having both softwares.You should never have more than one virus scanner installed. It may cause conflicts. even it does not, you will still use more memory than you have to, resulting in poorer PERFORMANCE.

1795.	Solve : I need help with a virus problem?
Answer» I ran a virus scan with AVG 6.0 and this is a LIST of all that was found. I have tried to remove them with AVG and it says they can't be removed. I don't have a clue on how to get rid of them. I have tried to search the help sites with no luck. I have not found these virus names on any site. If someone knows how I can remove them please let me know. Thanks!! Results of Complete Test, date and time 9/28/2004 1:01:40 : Testing C:\ volume LOCAL DISK serial 3938-1B06 C:\_RESTORE\TEMP\A0043201.0 Downloader.Alchemic.A C:\_RESTORE\TEMP\A0043208.0 Downloader.Agent.2.AA C:\_RESTORE\TEMP\A0044523.0 Downloader.Istbar.4.AD C:\_RESTORE\TEMP\A0044526.0 Downloader.Alchemic.A C:\_RESTORE\TEMP\A0044527.0 Downloader.Agent.AS C:\_RESTORE\TEMP\A0044528.0 Downloader.Istbar.4.H C:\_RESTORE\TEMP\A0044868.0 Downloader.Dyfica.2.AB C:\_RESTORE\TEMP\A0044871.0 Downloader.Dyfica.2.AB C:\_RESTORE\TEMP\A0044874.CPY Downloader.Istbar.4.AM C:\_RESTORE\TEMP\A0049167.0 Downloader.Dyfica.2.AA C:\_RESTORE\TEMP\A0049168.0 Downloader.Agent.2.AA C:\_RESTORE\TEMP\A0049169.0 Downloader.Dyfica.2.AC C:\_RESTORE\TEMP\A0051764.0 Downloader.Dyfica.2.AK C:\_RESTORE\TEMP\A0051765.0 Downloader.Dyfica.2.AE C:\_RESTORE\TEMP\A0051766.0 Downloader.Dyfica.2.AE C:\WINDOWS\TEMP\HPOTDD000.log Cannot open; not checked! Test finished, duration 00:10:20.7 s 12197 objects tested, 15 found infectedtandkand3a....I do not believe the items you listed are viruses ....but rather spyware , malware , adware and possibly page hijackers. ( pests ) ISTbar is an IE toolbar, homepage- and search-hijacker provided by Integrated Search Technologies/CDT Inc. I would suggest D/L Ad-Aware SE and Spybot and then watch them run......lol Have you not looked for them in the path which your AV gave you.......because thats where they are . Have you noticed anything else odd about the way your pc is running ? You failed to mention what operating system you have . let us know dl65 My OS is Windows ME. I check and install updates on a regular basis. I also run Ad-aware SE and Spybot. Both of those scans show the computer as clean. I have tried to search for the files and can't find them on the computer. They are gone or I am not looking in the right place. I have not experienced any problems with my computer, it seems to be operating normal. Should I run Hijackthis? tandkand3a...... TROJ_ALCHEMIC.A ......trojan This memory RESIDENT Trojan is capable of downloading and installing additional applications without first notifying the user. The downloaded file may be updates to other adware programs. It may act as a Browser Helper Object (BHO), which is ABLE to monitor all Web sites visited. It may also display popup advertisements. It runs on Windows 95, 98, ME, NT, 2000, and XP. Dyfica.2.AB ....... another trojan Agent.2.AA ....... another trojan Istbar.4.AD ........ yet another trojan Try this: Remove Trojan horse Downloader.Istbar.4.H this way: Close all programs. Turn off System Restore Run AVG Complete Scan Turn on System Restore. If you can't find Trojan horse Downloader.Istbar.4.G, AVG may have moved it to the Virus Vault. Check the Virus Vault. Disabling System Restore on Windows ME In Windows Millenium there is System Restore. Windows ME creates backup copies of the essential system files so they can be restored if they get corrupted. Sometimes this makes the disinfection difficult since the backup files can get infected. In those cases Windows will copy the infected file in the place of the clean one. This feature can be disabled with the following steps 1. Right-click on the My Computer icon and select Properties 2. In the System Properties windows select the Performance tab 3. Click on File System... button 4. In the Filesystem Properties window select the Troubleshooting tab 5. Check the Disable System Restore checkbox 6. Click Apply button 7. Close the windows using the Close button 8. Click Yes when prompted for reboot The System Restore feature can be enabled again with the same steps. At step 5. you have to uncheck the Disable System Restore checkbox. If this doesnt get rid of the trojans......then run hijackthis ....but I dont think you should have to. let us know how you make out dl65 I checked the Virus Vault and it is empty. I ran AVG again and tried to remove the 15 files and they could not be removed. The system restore function is turned off. I did run Hijackthis but it will not let me post the log on here. It says that the message is to large. Both Ad-aware and spybot shows the system clean. Any ideas on how to post the log or other solutions.Run AVG in Safe mode.tandkand3a........If you post your log in 2 PIECES rather than one you should be able to post it ok. And it looks like your trojans are residing in your restore files........have you looked there ? let us know dl65 I have run AVG in Safe Mode and the results are the same. Here is part of the Hijackthis log. Logfile of HijackThis v1.97.7 Scan saved at 11:07:48 PM, on 9/29/2004 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\WINDOWS\SYSTEM\MSTASK.EXE C:\WINDOWS\SYSTEM\SSDPSRV.EXE C:\PROGRAM FILES\NORTON UTILITIES\NPROTECT.EXE C:\PROGRAM FILES\GRISOFT\AVG6\AVGSERV9.EXE C:\WINDOWS\EXPLORER.EXE C:\WINDOWS\TASKMON.EXE C:\WINDOWS\SYSTEM\TPWRTRAY.EXE C:\WINDOWS\SYSTEM\TFNCKY.EXE C:\WINDOWS\SYSTEM\TOSHIBSU.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\PROGRAM FILES\MICROSOFT HARDWARE\MOUSE\POINT32.EXE C:\PROGRAM FILES\NETGEAR\WG511\UTILITY\WG511WLU.EXE C:\PROGRAM FILES\HEWLETT-PACKARD\HP SOFTWARE UPDATE\HPWUSCHD.EXE C:\PROGRAM FILES\HEWLETT-PACKARD\DIGITAL IMAGING\BIN\HPOTDD01.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\WINDOWS\LOADQM.EXE C:\PROGRAM FILES\GRISOFT\AVG6\AVGCC32.EXE C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\WINPATROL.EXE C:\PROGRAM FILES\RAM\RAMBOOSTER.EXE C:\WINDOWS\RunDLL.exe C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\DDHELP.EXE C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE C:\WINDOWS\SYSTEM\PSTORES.EXE C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE C:\PROGRAM FILES\YAHOO!\MESSENGER\YMSGR_TRAY.EXE C:\WINDOWS\DESKTOP\PC HEALTH\HIJACKTHIS.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://centralkansas.cox.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgrhttp://my.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/http://www.yahoo.com/ext/search/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/ie/defaults/sp/ymsgr/http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgrhttp://my.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/http://www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://my.netzero.net/s/search?r=minisearch R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/ie/defaults/su/ymsgr/http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Program Files\Common Files\Microsoft Shared\Stationery\Blank.htm R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://members.cox.net/mycrosmith/ R3 - URLSearchHook: (no name) - _{37D2CDBF-2AF4-44AA-8113-BD0D2DA3C2B8} - (no file) O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_3_12_0.DLL O2 - BHO: (no name) - {08E74C67-99A6-45C7-94DA-A397A8FD8082} - C:\PROGRAM FILES\POPUP MANAGER\POPUPMGR_1.0.2.1P.DLL O2 - BHO: (no name) - {00000010-6F7D-442C-93E3-4A4827C2E4C8} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 6.0\READER\ACTIVEX\ACROIEHELPER.DLL O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\PROGRAM FILES\NETZERO\TOOLBAR.DLL O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRAM FILES\YAHOO!\COMPANION\INSTALLS\CPN0\YCOMP5_3_12_0.DLL Here is the second part of the log. O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [Tpwrtray] TPWRTRAY.EXE O4 - HKLM\..\Run: [TFncky] TFncky.exe O4 - HKLM\..\Run: [TOSHIBSU] TOSHIBSU.EXE O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [POINTER] C:\Program Files\Microsoft Hardware\Mouse\point32.exe O4 - HKLM\..\Run: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE O4 - HKLM\..\Run: [WG511WLU] C:\Program Files\NETGEAR\WG511\Utility\WG511WLU.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\SYSTEM\hpztsb08.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [LoadQM] loadqm.exe O4 - HKLM\..\Run: [AVG_CC] C:\PROGRA~1\GRISOFT\AVG6\avgcc32.exe /STARTUP O4 - HKLM\..\Run: [WinPatrol] C:\PROGRAM FILES\BILLP STUDIOS\WINPATROL\winpatrol.exe O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe O4 - HKLM\..\RunServices: [SSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe O4 - HKLM\..\RunServices: [NPROTECT] C:\Program Files\Norton Utilities\NPROTECT.EXE O4 - HKLM\..\RunServices: [Avgserv9.exe] C:\PROGRA~1\GRISOFT\AVG6\Avgserv9.exe O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O9 - Extra button: Messenger (HKLM) O9 - Extra 'Tools' menuitem: Yahoo! Messenger (HKLM) O14 - IERESET.INF: START_PAGE_URL=http://www.e4me.com/start.html O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37893.3547569444 O16 - DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} (OPUCatalog Class) - http://office.microsoft.com/productupdates/content/opuc.cab O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://download.yahoo.com/dl/installs/yinst0401.cab O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll O16 - DPF: DigiChat Applet - http://albany.digi-net.com/DigiChat/DigiClasses/Client_IE.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553542500} - http://active.macromedia.com/flash2/cabs/swflash.cab O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - http://www.apple.com/qtactivex/qtplugin.cab O16 - DPF: {DC187740-46A9-11D5-A815-00B0D0428C0C} - http://ds1.downloadtech.net/cn1060/pcpowerscan.cab forget ad-aware spy-bot try this one its beat bother of them>http://www.webroot.com spysweeper... and do you use kazza or aol..or if you really get fed up re-install winme....locate the c:\windows\options\cab folder next to the scanreg icon ....is the famous icon called setup click this will re-install winme..without losing any files and disable system restore its not needed...and dont use ie6 either...Thanks Merlin_2 your advice worked. I did re-install Windows and everything is working great now. Thanks to EVERYONE who helped me. This is a great forum!!

1796.	Solve : Can't close Internet Explorer windows?
Answer» Hey everyone. My internet explorer was working fine today. THen all of a sudden, I cant close the windows. i have to go to END task and do it and even when i go tehre it sais i have to do end now for it to close. also, when i go online my cpu usage jumps to 100%. im pretty sure its not my internet and my cpu is new its been running well for about 3 months. I can close other windows that arn't online EASILY. i think its a virus but im not sure. please help me. thanksoh yeah EVERYTHING else runs fine. i can play games and go on aim but the only problem is using internet explorer. it just wont let me close its BROWSERS and my cpu usage jumps like crazy. i ran spyware and adware programs. it detected a few but ive always had them and i dind't have problems like these. i would also delte them every DAY but today i only found about 10 of them so i dleted themScan for viruses and trojans as well.

1797.	Solve : system soap?
Answer» don't know how, but have a program called system soap running on my pc. no MATTER what i do i cannot remove it. are you familiar with this program, and if so how do i remove it? Scan for viruses, TROJANS and spyware. When and how did you obtain this particulair program?Maybe it is telling you that you need a system shower..... XDJust don't DROP that soap.put it on a rope, XDI suddenly got the vision of a prison RAP song....... blehThis page might be useful.r barnett.......system soap is a cleaner...... http://www.systemsoap.com/ this MAY help you get rid of it.... http://www.kephyr.com/spywarescanner/library/systemsoappro/index.phtml http://www.spyany.com/program/article_adw_rm_System_Soap.html Hope this helps you get rid of it ....doesnt sound like its something you want on your pc. dl65