Virus help

This thread has been Locked and is not open to further replies. The original thread starter may use the Report button to request it be reopened but anyone else with a similar issue should start a New Thread. Watch our Welcome Guide to learn how to use this site.


Thread Starter
Apr 1, 2002
Hi. Before I go any further please, pretend that you are talking to a 4 year old. I'm really slow when it comes to fixing things on this dang computer.

I've got a Dell, with windows ME and IE 6.0. I've just discovered, last nite, that I have a Trojan horse virus on my computer, and, according to a free download of SpyHunter (just to find out) I have 87 different parasites roaming around on my system. Two in memory, 11 in registry and 74 in my cookies. Sounds like fun. NOT. Probably why my computer shuts off my itself, resizes my desktop, erases things, S L O W, and a ton of other things.

My current antivirus is AVG and apparently it won't look after this virus. It tells me that I should move this virus to the virus vault and when I press the key to do that it says...that file cannot be removed. File is..C:\ _ RESTORE\TEMP\A0247544.CPY

I'm assuming that because all of this stuff is floating around on my computer that, that is the reason my AVG only works sporadically. It's supposed to update automatically, but only does it once in a while. It's also supposed to scan every morning at a certain time..sometimes it does, sometimes it doesn't do that for a few days. Because it's supposed to do it automatically I don't always remember to check on it.

Can someone with patience help me out? Thanx a bunch :)


Malware Specialist Coordinator
Aug 27, 2003
Please download and run the following programs.


Go here:
and download Ad-Aware 6 Build 181

Install the program and launch it.

First in the main window look in the bottom right-hand corner and click on Check for updates now and download the latest reference files.

Make sure the following settings are made and on -------ON=GREEN

From main window: Click Start then Activate in-depth scan (recommended)

Click Use custom scanning options then click Customize and have these options selected: Under Drives and Folders put a check by Scan within archives and below that under Memory and Registry put a check by all the options there.

Now click on the Tweak button in that same window. Under Scanning engine select Unload recognized processes during scanning and under Cleaning Engine select Let windows remove files in use at next reboot

Click proceed to save your settings.

Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it. (Right click the window and choose select all from the drop down menu and click Next)

Restart your computer

Download and run: SPYBOT SEARCH & DESTROY, here:

Open Spybot Search & Destroy (Click Start, Programs, Spybot S&D (Advanced Mode). Click online, Search for updates, Download all available updates. Close all Browser windows, Click ''Check for Problems'', Put a check in every entry Spybot Search & Destroy flags with a red exclamation mark and click ''Fix Selected Problems'' , Then restart your computer.

Download both of these for added protection: SPYWAREBLASTER & SPYWAREGUARD, here:

Once you've done all that, download HIJACK THIS, scan and post the saved log here for an expert to take a look at as I’m not qualified to analyze the log.

Please do this. Click here: to download Hijack This. Save it to it’s own folder (not temporary files or the desktop).

Close all open windows and open HIJACK THIS. Click “Scan”. When the scan is finished (it only takes a second), the scan button will change to “Save Log”. Click on “Save Log” and save it to NotePad. Copy the entire log and paste it here.

DO NOT FIX ANYTHING YET, most items that appear in the log are harmless or even needed. Wait for someone to analyze the scan and advise.



Thread Starter
Apr 1, 2002
Thanx for the help so far cookiegal. Here is what I have for you guys.

Logfile of HijackThis v1.97.7
Scan saved at 4:39:24 PM, on 14/04/2004
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =*
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =*
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWAY\SEARCHAT\2.BIN\MWSSRCAS.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1501.0\EN-CA\MSNTB.DLL
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG_CC] C:\PROGRAM FILES\GRISOFT\AVG6\avgcc32.exe /startup
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O9 - Extra button: Encarta Encyclopedia (HKLM)
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia (HKLM)
O9 - Extra button: Define (HKLM)
O9 - Extra 'Tools' menuitem: Define (HKLM)
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: MSN Messenger Service (HKLM)
O9 - Extra button: AOL Instant Messenger (TM) (HKLM)
O12 - Plugin for .pdf: C:\PROGRA~1\INTERN~1\PLUGINS\nppdf32.dll
O12 - Plugin for .mov: C:\PROGRA~1\INTERN~1\PLUGINS\npqtplugin.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
O16 - DPF: Yahoo! Tic-Tac-Toe -
O16 - DPF: Yahoo! Dots -
O16 - DPF: Yahoo! Checkers -
O16 - DPF: Yahoo! Dominoes -
O16 - DPF: {6D5FCFCB-FA6C-4CFB-9918-5F0A9F7365F2} (GigexCtrl ActiveX) -
O16 - DPF: Yahoo! Chess -
O16 - DPF: Yahoo! Go Fish -
O16 - DPF: Yahoo! Chinese Checkers -
O16 - DPF: {AE1C01E3-0283-11D3-9B3F-00C04F8EF466} (HeartbeatCtl Class) -
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (sys Class) -
O16 - DPF: ChatSpace Java Client -
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) -
O16 - DPF: {CD17FAAA-17B4-4736-AAEF-436EDC304C8C} (ContentAuditX Control) -
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) -
O16 - DPF: LiveWorld EZTalk 3.0 -
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) -
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
Oct 9, 2001
Turn off System restore......
1. Right click the My Computer icon on the Desktop and click on Properties.
2. Click on the Performance tab.
3. Click on the File System button.
4. Click on the Troubleshooting tab.
5. Put a check mark next to 'Disable System Restore'.

Run hijackthis again and put a checkmark against these entries....double check
in case you miss anything....
.....then,close all browser and outlook windowsincluding this one and "fix checked"

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWAY\SEARCHAT\2.BIN\MWSSRCAS.DLL

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[This is the realplayer updater,which is not needed and is intrusive]

Re-boot and delete:

Your log is clean apart from the yourself a favour.......remove SpyHunter...its next to useless.

Now re-enable system restore......and when you know everything is running ok set a new restore point.



Thread Starter
Apr 1, 2002
Thanx a bunch $teve, but I just have a couple of questions first. The things that I am checking off on HJT means that I am deleting them from my computer right?? If that is the case, can I delete another one, as I have no idea what it is. It's this one..016-DPF:LiveworldEZTalk3.0-http://bizchat........

How do I even find that C:/PROGRAM FILES/MYWAY?? Told ya, I'm slow :)

Oh, and about that msn pop up blocker toolbar that the kids downloaded and is currently sitting underneath my address bar....can I leave that or lose it? I don't know if it's bringing anything I don't need to the computer but it sure is doing a good job of blocking those dang pop-ups. But, if it's not a good idea, please tell me and I'll lose it, no problem.

Thanx again.
Oct 9, 2001
When you check and fix the entries with HijackThis all it does is stop the item from running,it wont delete anything except a few.dll`s from the o1/o2`s.
Any of the o16`s can be fixed,even if its needed you will be asked to re-download it the next time you visit the page.....The MSN toolbar is ok to leave.

Double click "My Computer"......Navigate to C:/PROGRAM FILES/MYWAY and delete the folder.



Thread Starter
Apr 1, 2002
Thanx for being so patient $teve. You've been :cool: Just one more question. Oh, no. Not another question. Please make her stop. :p

It's about setting a new restore you said earlier. It won't. When I get to the restore point page, this is what happens. Create a restore point description..did that (I'm assuming, for example, if you wanted to call your restore point Fred, that's ok) pressed NEXT...then it tells me "system restore is not able to create a restore point. Please restart the computer, and then run system restore again" Did that, and the same messages repeated themselves. Going in a circle, basically.
This thread has been Locked and is not open to further replies. The original thread starter may use the Report button to request it be reopened but anyone else with a similar issue should start a New Thread. Watch our Welcome Guide to learn how to use this site.

Users Who Are Viewing This Thread (Users: 0, Guests: 1)

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 807,865 other people just like you!

Latest posts

Staff online