Welcome to DellTalk. - please look at the private messages beside your name at the top of this forum. BTW they will not work if popups are blocked for the site. ---------------------------------------------------------------------------- Bearver 1998
Yes do as Boardwalk_angel posted, But ...................
The memorywatcher download will not work unless you have internet connection active when you run it. And I normally advise to run it twice, as the first time often does not clear it all.
Please post a new hijackthis log for us to check after you have done all that.
Boardwalk_Angel
3 Posts
0
February 25th, 2004 13:00
First...you've got the Peper trojan............Please run this uninstaller:
Remain online & connected to the internet when you do.
http://www.memorywatcher.com/uninst.exe
Then....move HijackThis into a folder..close all other windows & with only HijackThis running..check the box next to:
R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\AproposClient\plg0\AproposPlugin.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {B65D4A7C-BA00-4949-A204-512CFBD09EBE} - C:\WINDOWS\System32\detvmgr.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKCU\..\Run: [Toco] C:\Documents and Settings\Bob Smith\Application Data\hsse.exe
O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab
Then click "Fix Checked"...reboot
After you reboot..go to.........
C:\Program Files and delete the AproposClient folder
C:\Program Files\Common files and delete the updater folder
C:\WINDOWS\system32 and delete the pcs folder
C:\Documents and Settings\Bob Smith\Application Data and delete hsse.exe
Then..rescan & post your new log.
ChrisRLG
3.9K Posts
0
February 25th, 2004 19:00
ChrisRLG
3.9K Posts
0
February 25th, 2004 19:00
Very good first post at DellTalk Boardwalk_Angel,
Welcome to DellTalk. - please look at the private messages beside your name at the top of this forum.
BTW they will not work if popups are blocked for the site.
----------------------------------------------------------------------------
Bearver 1998
Yes do as Boardwalk_angel posted, But ...................
The memorywatcher download will not work unless you have internet connection active when you run it.
And I normally advise to run it twice, as the first time often does not clear it all.
Please post a new hijackthis log for us to check after you have done all that.