Bractology 101...

Hello and welcome to TomCoyote. We usually remove malware here and you seem to have none, I'll see what I can do about other issues.

You have asked me to help you remove:
1. PlaxoHelper
2. C:\Program Files\Common Files\AOL\1139890338\ee\AOLSoftware.exe
3. C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe

You have indicated you do not use these items. You also have 09 items that can be trouble, rarely can you download that junk without something coming with it you do not want. I suggest you remove those two lines also.

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1139890338\ee\AOLSoftware.exe
O4 - HKLM\..\RunOnce: [Run IPH] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.9\PlaxoHelper.exe -a
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePokerMaster\EmpirePoker\RunEPoker.exe (file missing)
(next item, if you know why it is there you may leave it)
O11 - Options group: [INTERNATIONAL] International*

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Enable hidden files&folders..reverse the process when finished.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

RIGHT Click on Start then click on Explore. Locate and delete these items:

C:\Program Files\Common Files\AOL\ <<< delete that folder

C:\Program Files\Plaxo\ <<< delete that folder

C:\Windows\Prefetch\ >>> delete the contents (NOT THE FOLDER)
Prefetch info: http://www.windowsnetworking.com/articles_…refetch-XP.html

If you don't have a good cleaner, use this free one with these instructions:
Download CCleaner from this link: http://www.ccleaner.com/ Review the instructions http://www.ccleaner.com/help/tour1.asp
Run CCleaner, Windows & Applications when you run the registry cleaner (Issues) you will be prompted to backup before you can remove stuff, make sure you do.

C:\Program Files\Java\jre1.5.0_06\ <<< outdated, new version jre.5.0_07 has been released.

Restart the computer and post a new HJT log, let me know if that took care of your issues.

Thanks…pskelley
TomCoyote forum
Expert Member

Hello and thanks for returning your information. As far as Java, this is the information I have:
http://forums.spybot.info/showpost.php?p=1…amp;postcount=2
Even though the information is coming from Safer Networking (Spybot) you can see the instructions, and tashi would not post them unless they were correct. You may want to discuss it with Java (they compete with the Microsoft machine in that area)
http://java.sun.com/developer/support/

This is the first time I have heard about popups? This is the information you posted:

I get the error message: "Cannot load C: Programs\… blah, blah, blah…"; honestly I don't know it verbatim; please advise:

If all of the popups are coming from games, you can bet one of the "free" game downloads is the culprint. I will look at the log for anything I might have missed considering this new information, but if the popups are continuing we may need additional scans to find out what is causing it??

My suggestion, and you can click the links to see where these links are redirecting you is to remove these, I left the first, but it redirects to MSN home page also. You may want to remove them all and if you want MSN for a home page, set it as one in your browser. IE > Tools > Internet Options > General Tab > Home Page.

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=552…cid={SUB_CLCID}
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
(optional: may be your problem and I would remove it. I would download no games, purchase them or play online)
O4 - HKLM\..\Run: [GameDrive] "C:\Program Files\FarStone\GameDrive\GDP\gdtask.exe" /AutoRestore
(is this needed? nintendo is not above sending popups your way, you can bet that is what the eula said)
O16 - DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} (USBAPTester Class) - http://www.nintendowifi.com/troubleshooting/usbaptest.cab

Close all programs but HJT and all browser windows, then click on "Fix Checked"

Navigate to this folder and delete it: C:\Program Files\FarStone\ <<< folder

I suggest you do the above, restart and run for a bit to see if that stops the problems, let me know.

Thanks…Phil

Okay the error message is back, with every startup now… not just seldom ones. Ugh! FarStone is a VCD program I have been using for years, I doubt seriously this is the issue, I cannot delete the Farstone folder, or I lose GameDrive. I'll check my system for "Free" games, but I don't think I have any. I've been using the "Free" poker engine for years too, and I don't think it's the issue either, but I'll look into it on support forums to see if anyone else is having issues with it lately. Thanks again, I'll see what I can do.

Although I've used it for years, I'll get rid of PartyPoker.net. I keep in touch with a few of my Texas Hold`em friends via IM mostly now anyway, so I can live without it. How do I remove it, and every trace therein, from my system? Also, GameDrive 10 has no bundled software and/or spyware/adware. This has been a rock-solid program for many years and I'll continue to use it until the end of time most likely. Not even Alcohol 110% can touch this stability (which I don't own, trust me). PP.Net is all yours for the removing, what must I do?

I've looked at so many logs since I saw your last that it would help to see a new HJT Log. I have also been working them since 6 am EST so I will not view the log until morning. I would like you to post the text of the message you are receiving exactly as it is being displayed. We will give it another look. Thanks

At some point you are going to realize there is no such thing as "free". These websites can't stay in business that way. Somehow or other you are going to pay for "free". As far as old games, all it takes is a change in policy and one update for a program to start causing popups. I always suggest, if you wish to game, you purchase the software, or play the games online.

As far as the error message, Google lists 503,000 possible solutions at webpages, have at it.
http://www.google.com/search?sourceid=navc…5CProgram%27%2E

How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1139890338\ee\AOLSoftware.exe
O4 - HKLM\..\RunOnce: [Run IPH] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe
O4 - HKCU\..\Run: [PlaxoUpdate] C:\Program Files\Plaxo\2.6.2.9\PlaxoHelper.exe -a

Close all programs but HJT and all browser windows, then click on "Fix Checked"

http://www.funkytoad.com/hoster.htm <<< download this programs and then choose "Restore Microsoft's Original Hosts file"

Delete these folders:
C:\Program Files\Common Files\AOL\
C:\Program Files\Plaxo\

Now use Search Companion and search for aol and plaxo then delete any instance of them you find. Make sure you enabled files and folders, some of the stuff may be hidden. You may need safe mode:
http://www.bleepingcomputer.com/tutorials/tutorial61.html

Thanks.

Two days have gone by with no error message or Plaxo/AOL in my startup. I am weary, however, as it was a few days last time when suddenly they reappeared. I looked back and could think of no program(s) I used that would have initiated the reappearance of these either, so I am unsure what precautions I should take right now. So far, so good. Thank you for all of your help. Thank you for taking the time to work this issue and bare with me as I delayed here and there. I appreciate everything you've done. I truly hope this is the last we've seen of either of these issues. Respectively, -C

Thanks for the feedback and safe surfing

Here is some great information from Tony Klein, Texruss, ChrisRLG and Grinler to help you stay clean and safe online:
http://boards.cexx.org/viewtopic.php?t=957
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks…pskelley
TomCoyote forum
Expert Member
If you are reading this information…thank a teacher,
If you are reading it in English…thank a soldier.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php