Unable to update

Step#1:Restore Deleted System Files

Now we need to see if we need to restore some deleted files:Please check for the following files using the Windows Search Engine:

• control.exe
• rundll32.exe
• wmplayer.exe
• msconfig.exe
• notepad.exe
• shell.dll
• SDHelper.dll

If any are missing or not working properly then you can download new copies from
Merijn's Files and following the instructions at that site to have them where they belong for your OS.

• If you are having any difficulty with Notepad, please go to Merijn's Files and choose 'Windows Files' from the menu on the left hand side of the page. Then choose 'Notepad' from the list and download it to C:\Windows and C:\Windows\System32
  
• Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
  
• This infection often deletes some system files that need to be replaced. The most frequent one it deletes is shell.dll in Win2K or XP. In XP there are two copies of this file, one in Windows (WINNT) and one in Windows\System32. It does not delete the one in Windows\System so it does not affect Win9x/ME. If you find it missing, please copy the shell.dll from c:\windows\system32\dllcache into both \Windows (WINNT) and Windows\System32 .
  
• The other system file which is most frequently deleted is control.exe. Please check to make sure that you have this file and it is the correct size. If not Please check for the existence of this file by going to to Merijn's Files (sdhelper) and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to the information at this website. The control.exe is more often deleted in Win9x/ME.
  
• If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button

Step#2:Download CCleaner

• Download Ccleaner to clean temp files from your computer.
• Double click on Ccleaner to install the program, with its default settings, selecting language and agreeing to the license agreement.
• Double click the CCleaner shortcut on the desktop to start the program.
• Click Options > Advanced and uncheck "Only delete files in Windows Temp folders older than 48 hours".
  
  
  
  Step#3:Complete An Online AntiVirus Scan
  
  Run an online antivirus scan at:
  
  Trend Micro-Housecall Online AV
  
  Reboot
  
  
  
  Step#4:Find the Infected Files On Your Hard Drive
  
  • Navigate to C:\Windows
  • look for files that were created at the approximate time and date as the infection occurred.
  • look for those that end in exe, DAT and DLL and if found, right click on the file and check properties. Legitimate files should be copyrighted by Microsoft
  • if you determine they are bad files, right click on them and choose delete
    
  • Navigate to C:\Windows\System or C:\Windows\System32 (depending on the OS) and repeat each of the above steps to check for those ending in exe, DAT and/or DLL
    
  • if the above files will not delete, then make a new folder on your desktop by right clicking on the desktop and choosing New > Folder. Name the folder CWS Files.
  • Move the files from C:\Windows or C:\Windows\System or C:\Windows\system32
    to the new folder CWS Files.
  Step#5:Using your Windows CD to replace System Files
  
  ** In cases where many system files are missing you have no alternative but to have them insert their Windows OS disk and run sfc /scannow from the Run box if able or from Recovery Console if not able to get into windows
  
  
  
  Step#6:Scan And Post a New HijackThis Log
  
  1. Scan again with HijackThis
  
  2. POST your log file using Add Reply to see what is left to fix.

Thanks again for your help & patience. I have a question regarding step 1 of the latest fix. Using my Windows search engine I found: For control.exe: I have control (without the .exe) and control.exe-24fbf8b3.pf. Same for rundll32.exe and wmplayer.exe. (the name without .exe, AND rundll32.exe & wmplayer.exe with numbers.pf) Notepad.exe and msconfig.exe are both present, though again the .exe is NOT included with the name. Notepad seems to work ok. So these files have NOT been deleted? Or does the name HAVE to include the .exe part?? There were 3 shell.dll files, and the SDHelper.dll was present as well.

Those files that you are not sure of scan them here


>>>>> http://virusscan.jotti.org/

They will let you know if they are bad. Other than that how is it running? Can I see a new hijacxkthis log please.

Well the nasty hijack is gone Lets look a bit deeper

Download MicroWorld virus scan here >>> Micro World http://www.mwti.net/antivirus/free_utilities.asp

To run the virus scan make sure you click the following

memory, registry, startup folders, system folders, services, drive (all drives will be added) then click on scan clean. When the scan is complete hilight all the files in the LOWER box. Then ctrl + c and paste them into the thread ctrl + v.

I warn you the scan will take a long time to run and will not fix anything just identifies bad files.

Well, I'm encouraged that we're making some progress - thanks very much! Here's the log from the MicroWorld scan: Object "cws.therealsearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "dealhelper Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "funweb Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "funweb Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "funwebproducts Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "isearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "mwsoemon Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "mywebsearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\SNDefs.dat". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Hewlett-Packard\Digital Imaging\hpis\temp\Install.wse.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Hewlett-Packard\Digital Imaging\hpis\temp\config.ini". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Hewlett-Packard\Digital Imaging\hpis\temp\templates.zip". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\msxml3a.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\retro64_loader.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\AppsInstalled.htm". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\zlib.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\System32\cpuinf32.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaPassX.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{030CD4FD-3EC2-4D16-BCCA-45186B8E7497}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\WEBSER~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0AD31460-EF0E-402B-93CB-D92615A5C2E1}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\AOLCON~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{0D4AE5B1-CB51-420F-BDC9-2CA217A4DA36}" refers to invalid object "C:\PROGRA~1\Arcsoft\Showbiz\MPEGWriter.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{11405E5B-9008-4121-B33C-7F6C5692F862}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\ADDRES~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1F22CD29-E3DB-11D3-BC4E-0010833594F0}" refers to invalid object "C:\Program Files\America Online 7.0\ebrowser.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{22803C10-1FD3-11D5-BE64-001083023C0D}" refers to invalid object "C:\Program Files\America Online 7.0\g2p.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78d3-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78d4-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78d6-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78d8-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78d9-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78db-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78dc-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78dd-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78de-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e3-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e4-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e5-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e6-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e7-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e8-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78e9-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78ea-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{229b78eb-38f5-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{250B0184-3052-4EFB-AAA7-24429B8C0627}" refers to invalid object "C:\Program Files\America Online 7.0\CTABridge.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{288C5F13-7E52-4ADA-A32E-F5BF9D125F98}" refers to invalid object "C:\WINDOWS\Downloaded Program Files\retro64_loader.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{307A6C42-0000-0010-8000-00AA00389B71}" refers to invalid object "c:\program files\warcraft iii\blizzard.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{35FE0D30-27F3-4E6A-82AE-784EF9B43D83}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\Alerts.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{399CB6C4-7312-11D2-B4D9-00105A0422DF}" refers to invalid object "C:\PROGRA~1\MUSICM~1\MUSICM~1\HHACTI~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{40AF8200-4E6E-11D4-878D-00C0F6B0D1A7}" refers to invalid object "C:\Program Files\ArcSoft\Software Suite\photoimpression\ezrgb24.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{40AF8201-4E6E-11D4-878D-00C0F6B0D1A7}" refers to invalid object "C:\Program Files\ArcSoft\Software Suite\photoimpression\ezrgb24.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4493EDDC-F245-479B-B256-09296B14C5B8}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\Mail.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{4EDDDDBC-3528-41AA-AA6E-237AA8092C08}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\Buddy.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{5696744A-F3BD-11D4-8A1D-001083023C0D}" refers to invalid object "C:\Program Files\America Online 7.0\IE_NDS.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{664F4D53-9E3C-4140-964C-33D9D6F81B29}" refers to invalid object "C:\PROGRA~1\Arcsoft\Showbiz\MPEGWriter.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6833E5F0-F6D8-11D4-8A1F-001083023C0D}" refers to invalid object "C:\Program Files\America Online 7.0\IE_NDS.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{6EDA439D-F7C7-11d4-8A20-001083023C0D}" refers to invalid object "C:\Program Files\America Online 7.0\IE_NDS.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{7F0D2335-29AE-4B27-8014-4274C6D56F69}" refers to invalid object "C:\PROGRA~1\Arcsoft\Showbiz\MPEGWriter.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{823FA5B2-FD5A-4EA5-BCF9-18FCCC9884D2}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\PUBLIS~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}" refers to invalid object "fde.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{8DA5DF2C-798A-4CAB-8BB7-672C53DDDE94}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\FAVORI~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{959F94FD-DD1E-11D2-B559-00105A0422DF}" refers to invalid object "C:\PROGRA~1\MUSICM~1\MUSICM~1\HHACTI~1.DLL". Action Taken: No Action Taken. Entry "HKCR\CLSID\{A0B65408-65FF-4FDF-9CF0-3763C3CA29C4}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\IMs.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}" refers to invalid object "CaPlgin.ax". Action Taken: No Action Taken. Entry "HKCR\CLSID\{bc8a96c0-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{bc8a96c1-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{bc8a96c2-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{bc8a96c3-3909-11d5-9001-00c04f4c3b9f}" refers to invalid object "C:\Program Files\America Online 7.0\Media\CDDBControl.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C31746DC-4BF9-4DC8-A299-B0F09AFACFB4}" refers to invalid object "C:\Program Files\America Online 7.0\AMH.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C627B4C0-01AF-41BB-A4CF-EC0DEF91ADAF}" refers to invalid object "C:\Program Files\America Online 7.0\AMH.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{DF0E9111-01DF-11D5-BA23-001083780941}" refers to invalid object "C:\Program Files\America Online 7.0\CalPrinting.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{E5151CBE-F61D-11D4-BA21-001083780941}" refers to invalid object "C:\Program Files\America Online 7.0\CalPrinting.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{EB6BEA6B-F489-4846-902B-4CA285EA2311}" refers to invalid object "C:\Program Files\America Online 7.0\AMH.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F0FDBF9F-63BF-4BFB-A3DB-E7B7FCF3F7DE}" refers to invalid object "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\directorps.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{F3206ECF-B7F9-4E61-9D15-ACC0627E2C59}" refers to invalid object "C:\PROGRA~1\AOLCOM~1\WEBSER~1.DLL". Action Taken: No Action Taken. Entry "HKCR\AOLTB.AOLToolBand" refers to invalid object "{DE9C389F-3316-41A7-809B-AA305ED9D922}". Action Taken: No Action Taken. Entry "HKCR\AOLTB.AOLToolBand.1" refers to invalid object "{DE9C389F-3316-41A7-809B-AA305ED9D922}". Action Taken: No Action Taken. Entry "HKCR\LoaderX.Installer" refers to invalid object "{1E5E0D38-214B-4085-AD2A-D2290E6A2D2C}". Action Taken: No Action Taken. Entry "HKCR\LoaderX.Installer.1" refers to invalid object "{1E5E0D38-214B-4085-AD2A-D2290E6A2D2C}". Action Taken: No Action Taken. Entry "HKCR\MediaPassX.Installer" refers to invalid object "{15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\SNDSrvc.LocationAwareness" refers to invalid object "{5705911C-A065-4568-9B45-E88F240963D9}". Action Taken: No Action Taken. Entry "HKCR\SNDSrvc.LocationAwareness.1" refers to invalid object "{5705911C-A065-4568-9B45-E88F240963D9}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMPPublsihCntr.WMPPublsihCntr.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. File C:\Documents and Settings\All Users\Application Data\AOL Downloads\lpitunes_setupSTUS\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\All Users\Documents\AOL Downloads\aolsetup90\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\hp\drivers\audio\Creative\Audio\Drivers\COMMON\killapps.exe tagged as not-a-virus:Tool.Win32.KillApp.b. No Action Taken. File C:\Program Files\America Online 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0a\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0b\backup\restore\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Program Files\America Online 9.0b\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP672\A0183691.exe tagged as "not-a-virus:AdWare.DealHelper.s". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP672\A0183693.dll tagged as "not-a-virus:AdWare.DealHelper.j". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP672\A0183697.exe tagged as "not-a-virus:AdWare.BargainBuddy.y". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184359.EXE tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184391.exe tagged as "not-a-virus:AdWare.WinAD.ac". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184392.dll tagged as "not-a-virus:AdWare.WinAD.ac". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184393.exe tagged as "not-a-virus:AdWare.WinAD.ab". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184411.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184412.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184413.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184414.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184415.SCR tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184416.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184417.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184418.EXE tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184419.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184420.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184421.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184422.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184423.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184424.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184425.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184431.exe tagged as "not-a-virus:AdWare.NewDotNet". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184434.dll tagged as "not-a-virus:AdWare.F1Organizer.a". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184436.dll infected by "Trojan-Dropper.Win32.Agent.of" Virus! Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184437.scr tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184445.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP676\A0184446.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP678\A0184619.DLL tagged as "not-a-virus:AdWare.ToolBar.MyWebSearch". Action Taken: No Action Taken. File C:\System Volume Information\_restore{B762F5BE-1DFD-40DA-9793-F321C2185D05}\RP683\A0185173.exe infected by "Trojan-Clicker.Win32.Exploider.b" Virus! Action Taken: No Action Taken.

Go to add/remove programs and look for MediaPass and remove if present. Boot to safe mode Then search for and delete this file C:\WINDOWS\Downloaded Program Files\MediaPassX.dll Next scan with ewido again. Then a new log please. How is it running?

Do you have 2 anti virus programs running?

I've got McAfee running, I used to have Norton antivirus - but I think I removed it awhile back when we got McAfee. I checked and the folder for Norton is empty - however I do get a message to renew the subscription every day or so. So to answer your question, I think only McAfee is running.

What version of Norton was it. There are still all kinds of fiels in your system. They have an uninstall tool to remove all the lost files but I need to know what version.

I think it's Norton Antivirus 2002.

Woo-hoo! That did it! Everything works! Thank you so much, I will definitely be contributing to this awesome site. One last question: McAfee VirusScan & Firewall are running, and the trial version of Ewido is still on here. I know the Ewido will expire soon, but what about the other two? Is that enough? (Along with frequent Spybot & Adaware scans?) Thanks again, you saved the day!

There is a free version of Ediwo that you can download and use as an on demand scanner.

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. In my signature below is also a tutorial on how to harden IE, a good read and very helpful to stop these things in the future. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on.

Safe Surfing.


If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.