February 25th, 2004 13:00

First...you've got the Peper trojan............Please run this uninstaller:

Remain online & connected to the internet when you do.

http://www.memorywatcher.com/uninst.exe

Then....move HijackThis into a folder..close all other windows & with only HijackThis running..check the box next to:

R3 - URLSearchHook: (no name) - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {01C5BF6C-E699-4CD7-BEA1-786FA05C83AB} - C:\Program Files\AproposClient\plg0\AproposPlugin.dll
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)
O2 - BHO: (no name) - {B65D4A7C-BA00-4949-A204-512CFBD09EBE} - C:\WINDOWS\System32\detvmgr.dll
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [updater] C:\Program Files\Common files\updater\wupdater.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKCU\..\Run: [Toco] C:\Documents and Settings\Bob Smith\Application Data\hsse.exe

O16 - DPF: {F57D17AE-CE37-4BC8-B232-EA57747BE5E7} - http://66.230.146.53/EPlugin.cab

Then click "Fix Checked"...reboot

 

After you reboot..go to.........

C:\Program Files and delete the AproposClient folder

C:\Program Files\Common files and delete the updater folder

C:\WINDOWS\system32 and delete the pcs folder

C:\Documents and Settings\Bob Smith\Application Data and delete hsse.exe

Then..rescan & post your new log.


 

3.9K Posts

February 25th, 2004 19:00

BTW when clean you need to visit the windows update site, your system is very out of date.

3.9K Posts

February 25th, 2004 19:00

Very good first post at DellTalk Boardwalk_Angel,

Welcome to DellTalk. - please look at the private messages beside your name at the top of this forum.
BTW they will not work if popups are blocked for the site.
----------------------------------------------------------------------------
Bearver 1998

Yes do as Boardwalk_angel posted, But ...................

The memorywatcher download will not work unless you have internet connection active when you run it.
And I normally advise to run it twice, as the first time often does not clear it all.

Please post a new hijackthis log for us to check after you have done all that.

No Events found!

Top