coltm4carbine

in my opinion i think norton is not the best you can get. i thought everyone was entitled to their own opinion on this forum. yeh, personally thats the only thing i agree with. I mean norton can detect new viruses but, for example, if i put the cascade in a brand new computer with norton it won't detect it until loads of scans. I am not sure about the 06 version of it but it happened on the 05 version.

... i thought this update was from september (this year)... btw i think i get a bit of it. Security update 886903 Security update 886903 is for the .NET Framework 1.1 Service Pack 1 for the following operating systems: ÃÆââââ¬Å¡Ã¬Ãââ Windows 2000 Service Pack 3 or Windows 2000 Service Pack 4 ÃÆââââ¬Å¡Ã¬Ãââ Windows XP Service Pack 1 or Windows XP Service Pack 2 ÃÆââââ¬Å¡Ã¬Ãââ Windows XP Tablet PC Edition ÃÆââââ¬Å¡Ã¬Ãââ Windows XP Media Center Edition ÃÆââââ¬Å¡Ã¬Ãââ Windows Server 2003

go offline and fix these: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75 <-fix it unless you know what it is R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = O2 - BHO: (no name) - {095B4D98-8F5A-AFAA-2E82-A5F8FF92CFC6} - C:\WINDOWS\system32\oggv.dll (file missing) O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon[Caution: ExecutableFile] O4 - HKLM\..\Run: [MsMovies] C:\Program Files\MsMovies\MsMovies[Caution: ExecutableFile] /auto <- trojan O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon[Caution: ExecutableFile] O4 - HKCU\..\Run: [sen] "C:\Program Files\bama\tlii[Caution: ExecutableFile]" -vt mtx <- virus O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - ]http://www.pacimedia.com/install/pcs_0012[Caution: ExecutableFile] <- fix it boot into safemode and go to add/remove programs. uninstall these: My Web Search My Way Speedbar Search Assistant - My Way while in safemode find and delete these: C:\Program Files\MsMovies C:\PROGRA~1\MYWEBS~1 C:\Program Files\bama also one antivirus will be enough if it's updated. I decided not to fix limewire cos everyone seems to be using it so theres no point if your gonna download it again. get ad-aware and spybot do a scan with them to clean up the left overs.

do this start-> run-> winver that should tell you what os you have (and to help others to help you)

k, if you have any more problem you might want to start a new post because I might get too confused. glad it worked out. :D

if you did it would make sure your system is cleaner. Download and install ]CleanUp! Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: Click "Options..." Move the arrow down to "Custom CleanUp!" Put a check next to the following (Make sure nothing else is checked!): [*:1gvguc0l]Empty Recycle Bins [*:1gvguc0l]Delete Cookies [*:1gvguc0l]Delete Prefetch files [*:1gvguc0l]Cleanup! All UsersClick OK Press the CleanUp! button to start the program. It may ask you to reboot at the end, click Yes. Note: For 98 and ME users Under Options put a check next to the following [*:1gvguc0l]Empty Recycle Bins [*:1gvguc0l]Delete Cookies [*:1gvguc0l]Scan local drives for temporary files [*:1gvguc0l]Cleanup! All Users Click OK Press the CleanUp! button to start the program. It may ask you to reboot at the end, click Yes.

i still can use the rs windows client to play rs even if i have firefox right? I think rs client is designed for ie. can i check my hotmail with it? no problem here it erases IE or it just replaces it? neither just another optional browser. i can still use IE if i want.

having a wild guess- do you have enough memory?

In the event that you lose Internet access after removing New.Net, please double-click LSPFix[Caution: ExecutableFile] that you downloaded earlier. You will see 2 panels. If there is any file listed in the "Remove" panel on the right-side, leave it as is and just click "Finish>>" then reboot your computer and you should now have access to the Internet. ^ nicked from my canned speech- tells you how to use lspfix. why google toolbar? i actually recommend it in my prevention speech on another forum. as for messenger plus it should be ok unless there is a sign of a lop.com infection. btw bad luck on the ccleaner forums. I think rridgely was a bit too harsh at you.

ok forget the scan. i am getting you to try this spysheriff and smitfraud fix. donno will it work but it might solve your desktop hijacking problem. Download smitRem.zip and save the file to your desktop. Right click on the file and extract it to it's own folder on the desktop. Place a shortcut to Panda ActiveScan on your desktop. Please download the trial version of Ewido Security Suite here: http://www.ewido.net/en/download/ Install it, and update the definitions to the newest files. Do NOT run a scan yet. If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates: Don't run it yet! Next, please reboot your computer in SafeMode by doing the following: [*:3ef6htf0]Restart your computer [*:3ef6htf0]After hearing your computer beep once during startup, but before the Windows icon appears, press F8. [*:3ef6htf0]Instead of Windows loading as normal, a menu should appear [*:3ef6htf0]Select the first option, to run Windows in Safe Mode. Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen. Wait for the tool to complete and disk cleanup to finish. Open Ad-aware and do a full scan. Remove all it finds. Now open Ewido Security Suite [*:3ef6htf0]Click on scanner [*:3ef6htf0]Make sure the following boxes are checked before scanning: [*:3ef6htf0]Binder [*:3ef6htf0]Crypter [*:3ef6htf0]Archives [*:3ef6htf0]Click on Start Scan [*:3ef6htf0]Let the program scan the machine While the scan is in progress you will be prompted to clean files, click OK Once the scan has completed, there will be a button located on the bottom of the screen named Save report [*:3ef6htf0]Click Save Report [*:3ef6htf0]Save the report to your desktopClose Ewido Next go to Control Panel click Display > Desktop > Customize Desktop > Website > Uncheck "Security Info" if present. Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked! Save the scan log and post it along with a new HijackThis Log and the Ewido Log by using Add Reply. grrr... i hate it when i forget to click the submit ubtton :S.

could try this: http://support.microsoft.com/default.aspx?scid=kb;en-us;894391 similar problem but different scenerios.

You may wish to print out a copy of these instructions to follow while you complete this procedure. Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items (if found), then click fix checked. O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu). Be sure you're able to view hidden files, and remove the following files in bold (if found): C:\Program Files\Viewpoint +++++++++++++ O17 - HKLM\System\CCS\Services\Tcpip\..\{F76BD77B-A450-4FC7-B96D-650B12CD06EA}: NameServer = 205.152.132.235 205.152.37.254 O9 - Extra button: (no name) - {F2570A0D-001D-477D-93D1-D05EF5EB95CD} - (no file) the one in Green are Legit. Don't fix them.

ok i think you mean it's inside the system restore. 1) go into safemode 2)disable system restore 3) run an antivirus 4) reenable system restore again. that should sort it out.

grrr... the o23 won't go away. try this: Click Start>Run and type in: services.msc Click OK In the Services window find: Security Agent Select/highlight and right click the entry, and choose: Properties On the General tab, under Service Status click the Stop button Beside: Startup Type, in the drop menu, select: Disabled Click Apply, then OK find and delete this: C:\WINDOWS\system32\scagent[Caution: ExecutableFile] <-- (the scagent) Open HJT and click config > misc tools > ÃÆââââ¬Å¡Ã¬Ãâ¦Ã¢â¬Ådelete an NT serviceÃÆââââ¬Å¡Ã¬ÃâÃ

ok lets try again. You may wish to print out a copy of these instructions to follow while you complete this procedure. Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items (if found), then click fix checked. O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent.e3e (CAUTION - executable file) " start (file missing) Reboot your PC. Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu). Be sure you're able to view hidden files, and remove the following files in bold (if found): C:\WINDOWS\system32\scagent.e3e If you would please, rescan with HijackThis and post a fresh log in this same topic, and let us know how your system's working.

ok go offline, close all open browsers and run HJT. fix this: O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent[Caution: ExecutableFile] " start (file missing) reboot into safemode. find this and delete the folder. C:\WINDOWS\system32\scagent[Caution: ExecutableFile] now rescan with HJT and post the log.

don't use the aol one. i can see 2 viruses/ trojans. run mcafee (in safemode) and it should get rid of them. after that post a new HJT log in normal mode. dj wanna take over? i will need to sleep in a few hours.

ok did u try and fix it? after fixing it you should of deleted the file (in safemode) . if not fix it again- it should go away.

Create a folder on the C: drive called C:\HJT. You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it hjt Move HJT into this new folder please, This is important so please do this prior to anything else please then run ur antivirus. then clean out temp. go offline then reboot and fix these if present: O4 - HKCU\..\Run: [innhi] C:\WINDOWS\system32\??chost[Caution: ExecutableFile] O23 - Service: Security Agent (scagent) - Unknown owner - C:\WINDOWS\system32\scagent[Caution: ExecutableFile] " start (file missing) reboot into safemode and find and delete these files: C:\WINDOWS\system32\??chost[Caution: ExecutableFile] C:\WINDOWS\system32\scagent[Caution: ExecutableFile] reboot into normal mode and post a new log.

hi, first: Create a folder on the C: drive called C:\HJT. You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it hjt Move HJT into this new folder please, This is important so please do this prior to anything else please You may wish to print out a copy of these instructions to follow while you complete this procedure. Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items (if found), then click fix checked. O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save[Caution: ExecutableFile] " O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML <- this would have been installed without your permission- suggest u remove it. then: Reboot into Safe Mode: please see here if you are not sure how to do this. Using Windows Explorer, locate the following files/folders, and delete them: C:\Program Files\Save C:\Program Files\Viewpoint <- delete this folder if you have deleted the viewpoint entry above. reboot and post a new log.

if you have setted it like that then it's ok. IF not then: Download CWShredder ]here to its own folder. Update CWShredder * Open CWShredder and click I AGREE * Click Check For Update * Close CWShredder Boot into Safe Mode: Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about. Reboot your computer into normal windows.

or you can do this: If you chose to clean your computer from what Ad-aware found, please follow these instructions belowÃÆââââ¬Å¡Ã¬Ãâæ Please make sure that you are using the *latest* definition file. If not, run webupdate - feature. Launch Ad-Aware SE and click on the gear to access the Configuration menu. Please make sure that this setting is applied; Click on Tweak => Cleaning engine => UNcheck "Always try to unload modules before deletion". Disconnect from the internet (for broadband/cable users, it is recommended that you disconnect the cable connection) and close all open browsers or other programs you have running. Then please boot into Safe Mode To clean your machine, it is highly recommended that you clean the following directory contents (but not the directory folder); Run CCleaner to help in this process. Download CCleaner (Setup: go to >options > settings > Uncheck "Only delete files in Windows Temp folders older than 48 hours" for cleaning malware files!) * C:\Windows\Temp\ * C:\Documents and Settings\\Local Settings\Temporary Internet Files\ <- This will delete all your cached internet content including cookies. * C:\Documents and Settings\\Local Settings\Temp\ * C:\Documents and Settings\\Local Settings\Temporary Internet Files\ * C:\Documents and Settings\\Local Settings\Temp\ * Empty your "Recycle Bin". Run Ad-Aware SE from the command lines shown in the instructions shown below. Click "Start" > select "Run" > type the text shown bolded below (including the quotation marks and with the same spacing as shown) "C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware[Caution: ExecutableFile]" +procnuke Click Ok. Note; the path above is of the default installation location for Ad-aware SE, if this is different, adjust it to the location that you have installed it to. When the scan has completed, select next. In the Scanning Results window, select the "Scan Summary"- tab. Check the box next to any objects you wish to remove. Click next, Click Ok. Please reboot your computer after removal, run a new "full system scan" and post the results as a reply (When you are selecting the scan mode, uncheck "Search for negligible risk entries"). Please don't launch any programs or connect to the internet at this time. Then, please copy & paste the complete log file here. Don't quarantine or remove anything at this time, just post a complete logfile. This can sometimes takes 2-3 posts to get it all posted, once the "Summary of this scan" information is shown, you have posted all of your logfile.

a hjt log won't help too much- when we already know a trojan/virus is running on the pc.

*hint* if he did have a browser hijacker it would of been cws. *hint* i won't go into too much detail incase it ends up like last time.

hi dj, aint seen u posting on the ccleaner forums for a while. lol. uninstall avg if your norton is a paid one and if it's up-to-date.