This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Annoying Pop ups,Bloodhound.32.EP & MediaAccK.exe

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Your welcome. Glad to be able to help out.

Just one step remaining. Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.
4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.
As this topic has been resolved, the thread will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link:
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.
Topic reopened at user's request.

Dear Sir,
As we tried to play some CDs ,we get to know we can't play/run any CD.We are getting this mesasge:
16 Bit Windows Subsystem
D:\Windows\System32\Autoexec.Nt.The System file is not suitable for running MS_DOS and Microsoft Windows applications."
The same mesage I get while trying to run Memtest link you have provided.
Any suggestions pls–

Thanks


You will need your Windows XP install disc for this operation. If you do not have an install disc but have the factory restore discs then you will need to find the I386 folder on the disc (i386 if the I is lower case).
Once you have inserted the disc in the drive and closed any windows it opened then:Go to start > Run and type sfc /scannow into the box. There is one space between the c and the /.
Click Ok
A progress bar will appear as the scan is being done.
If a dialog comes up asking you to insert the Windows CD click browse and browse to the folder on the CD that contains the I386 folder. Do not include the I386 folder in the path. For example if the full path to the I386 folder is F:\windows\setup\I386 you would only use F:\windows\setup.
Click ok and allow the scan to finish.
Reboot and see how your system works
Post back here with results or questions.
yesterday I applied some operations searched from Google 24 Hr Helpdesk.As a preventive maintenance I have conducted operation as u described.
I forget to take out Windows CD,so while pressing F8,computer CD rebooted for Windows setup
————————-
Setup is installing—-
Later I quit from Windows XP Professional Setup as I thought,it's better to analyze system after Google and Your operations.

(1)I am getting Windows banner after some moments of Startup.
(2)Letter and Button Sizes are excessively larger,but after some browsing it restore to it's specified size.
(3)We are unable to go ahead after signing
on:https://blrscr3.egs-seg.gc.ca/TruePassApp/
TruePassFrameset_e.jsp?visibleFrameURL=
/gol-ged/gov/AuthenticateUserInputRoamingEPF_e.html

(4)Normally get Script error after restart/reboot.
(5)While recalling BellSympatico e-mail,allways get Outlook Express errors:
Your server has unexpectedly terminated the connection. Possible causes for this include server problems, network problems, or a long period of inactivity. Account: 'pophm.sympatico.ca', Server: 'pophm.sympatico.ca', Protocol: POP3, Port: 110, Secure(SSL): No, Error Number: 0x800CCC0F
(6)IE error:Line229,Char 1,Error"Object does not support this property or method,Code0,URL:res://D:\Program Files\Outlook Express\msoeres.dll/frntpage.htm
Please note that now CDs were allready able to play/install after Google 24 hr help by search and following specified methods.

Thanking you Sir
Added line breaks to excessively long lines that were blowing out the thread width - rand1038
What other repairs have you attempted besides those I recommended in this thread? Do you have links to the pages where the advice you followed is posted? I need to see that to get an idea of what may have gone wrong. Running the system file checker should not cause those types of errors nor should a declined install.
When this thread was locked,I just get some posts from Google 24 hr helpdesk,I saved these in Notebook,here is detail:

Put your windows XP CD in your CD drive,  for the rest of this post it will
be referred to as D: drive.

ok, click on Start > Run type in: cmd


type in the following hitting enter after each line (dont forget to replace
D: with the drive letter of the drive that contains your XP CD).


expand D:\i386\config.nt_ c:\windows\system32\config.nt
expand D:\i386\autoexec.nt_ c:\windows\system32\autoexec.n­t
expand D:\i386\command.co_ c:\windows\system32\command.co­m


install your program


—————————–

Certain malware can cause this issue.  Try this fix, courtesy of
MVP Kelly Theiriot:


"This installaton program will reinstall the missing or corrupt Windows XP
system files command.com, autoexec.nt and config.nt. The absence or
corruption of one or more of these files causes a "16 Bit Subsystem" error.


XP_Fix.EXE by TRF Systems, Inc.
http://www.visualtour.com/downloads/xp_fix.exe


More info here:


Error Message: MS-DOS or 16-bit Windows-based program
http://www.kellys-korner-xp.com/xp_m.htm#16bit"


Then, courtesy of flrman1, here:
http://forums.techguy.org/archive/index.php/t-280212.html


"First in safe mode click on My Computer then click Tools > Folder Options.
In Folder options click on the View tab. Under Files and Folders tick "Show
hidden files and folders" then uncheck "Hide file extensions for known file
types" and uncheck "Hide protected operating system files (recommended)".
Now click "Like current folder" then "Apply" and "OK"


Now find and delete these files:


C:\WINNT\system\windupdate.exe     (added by JB:  note the spelling - the
added 'd')
C:\WINNT\system.css


Delete this folder:


c:\freescan


Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp
folder and go to Edit > Select All then Edit > Delete to delete the entire
contents of the Temp folder.


Go to Start > Run and type %temp% in the Run box. The Temp folder will open.
Click Edit > Select All then Edit > Delete to delete the entire contents of
the Temp folder.


Finally go to Control Panel > Internet Options. On the General tab under
"Temporary Internet Files" Click "Delete Files". Put a check by "Delete
Offline Content" and click OK. Click on the Programs tab then click the
"Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin"


Run the fix file again after you're done w/the above.
—————————————————



The Problems which I have listed is not due to following your specified operation,in-fact We now run and play CDs very well.But overall there are some general problems which I have listed in my earlier posts.Note that IP of http://65.36.130.231/urdu/ is changed to http://209.41.165.188/urdu/,so I can visit it easily.But other problems still persist as described earlier.
Thanks in advance.
I was happy when looking NAV finished scanning and did'nt find any virus or infected file,moments later I wonder while found a NAV Virus Alert,here is detail;
object Name: …\CAK565BO.Com%2Fmessage_board%2F%3BFORID%3A1%
Virus Name: Bloodhound.HybridCOM
Action Taken: Unable to repair this file,Access to file was denied.

Logfile of HijackThis v1.99.1
Scan saved at 8:56:16 PM, on 8/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
D:\Program Files\ewido\security suite\ewidoctrl.exe
D:\Program Files\Norton Antivirus\navapsvc.exe
D:\Program Files\Norton Internet Security\NISUM.EXE
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Norton Internet Security\SymProxySvc.exe
D:\WINDOWS\system32\WFXSVC.EXE
D:\Program Files\Symantec\WinFax\WFXMOD32.EXE
D:\Program Files\Norton Internet Security\NISSERV.EXE
D:\PROGRA~1\NORTON~2\navapw32.exe
D:\Program Files\Norton Internet Security\IAMAPP.EXE
D:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\hotfoon4.exe
D:\WINDOWS\system32\wscntfy.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\COMPROB\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://groups-beta.google.com/group/24hour….helpdesk?hl=en
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton Antivirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~2\navapw32.exe
O4 - HKLM\..\Run: [iamapp] D:\Program Files\Norton Internet Security\IAMAPP.EXE
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [HOTFOON2] C:\Program Files\hotfoon4.exe /h
O8 - Extra context menu item: &Google Search - res://d:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://d:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://d:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://d:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://d:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://d:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - D:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - D:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - D:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: D:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: TruePass EPF 7,0,100,684 - https://blrscr3.egs-seg.gc.ca/applets/entru…sapplet-epf.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O20 - Winlogon Notify: igfxcui - D:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - D:\PROGRA~1\COMMON~1\AOL\ACS\AOLACSD.EXE
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - D:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - D:\Program Files\Norton Antivirus\navapsvc.exe
O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISSERV.EXE
O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - D:\Program Files\Norton Internet Security\NISUM.EXE
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - D:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - D:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - D:\Program Files\Norton Internet Security\SymProxySvc.exe
O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - D:\WINDOWS\system32\WFXSVC.EXE



Kindly help me how to kill this virus.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI