msn virus

This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.


Thread Starter
Feb 5, 2007
I believe I've got the same virus that Fordette is describing. (I've got grandkids using the machine that are constantly using MSN Messenger so suspect that's where it came in).

After a recent reboot, I noticed an unusual WINDOWS window pop-up saying something like ... 2 files had been replaced ... and system was unstable. (If I can get the virus off, I'll still need to figure out what files got replaced).

I'm interested in seeing if you have any luck with this thread. I'm just posting some info that may be of use ... if not simply ignore.


1. The "hoster" tool you mentioned in this thread, let's me temporarily correct my "hosts" file so that when in NORMAL mode, it doesn't point references to most security related web sites (e.g. Symantec etc.) to the address, but after a reboot it's back to being "invisible" to a WINDOWS "search" + corrupted.

In NORMAL mode as well, System Restore has been turned off, regedit, msconfig don't run etc.

2. However, in SAFE mode, I'm still able to use regedit, msconfig etc. which seems different than what Fordette says.

3. One thing however is that after "hoster" let me get "Norton Internet Security" to run (I had just bought it to try to clean the problem I realized I had), it did find one thing that it said it couldn't fix, but it at least pointed me at C:\RECYCLER\S-1-5-21-57989841-1935655697-1343024091-1004\dc1.exe.

4. I deleted as many of the C:\RECYCLER files as I could manually, but it kept saying that one of the folders ... the ...1004 one, was in use and I couldn't delete it. However, after the next normal boot, I was at least able to turn System Restore back on and create a restore point (before this I wasn't able to).

5. Also, when I boot in SAFE mode, I use regedit I can find the same thing (S-1-5-21-57989841-1935655697-1343024091-1004) as a key in HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\PROTECTED STORAGE\SYSTEM PROVIDER\ and other places.


Retired Moderator
Apr 16, 2002
Hi Welcome to TSG!!

I've moved you to a thread of your own so please reply here.

Click here to download HJTsetup.exe
Save HJTsetup.exe to your desktop.

Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.
This thread has been Locked and is not open to further replies. Please start a New Thread if you're having a similar issue. View our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Members online