TROJAN HORSEVIRUS

Question

I recently loaded the Norton Antivirus 2004 on my Dell Demension XPS T700r and it found and quarantined a Trojan Horse virus. Couldn't repair it so I deleted it. The next day somebody else in my family opened some sort of message while in WORD and ever since my pc has been hosed! Can't open word and some other Microsoft applications, the URL dialog window on IE 6 is gone so I can't type in www address. Sometimes I can't log on to the Internet, other times it is extremely slow. When I scan now with both scandisk and Norton it says I'm clean- no viruses found. I tried using the Resource disk that came with my system but it doesn't recognize the drive or the factory disk was ng. Any thoughts greatly appreciated, Also any thought on how to format my hard drive. The thought is to clean everything off and attempt to reload. Don't want to overkill but not sure what to do next.

HELP! Thanks!

fiveoh

Texruss · Answer

Same response as to last poster. Formatting the hard drive is a last resort and most of the time is not necessary.

We need you to download and install an analysis and repair tool called Hijackthis.

Go here and download the file: http://tomcoyote.com/hjt

Please unzip Hijackthis.zip into a new folder you create in the root level of the C: drive. Name this folder C:\HJT for best and safest results. (don't put in a temp folder, or the desktop, etc...as it needs a safe folder to keep backup logs). Also when people post here and place it on the Desktop the log usually shows their full name since their Windows user profile is commonly named with their full name. We try not to disturb your privacy. *;-)

See this link for graphical instruction: http://russelltexas.com/spywareinfo/createhjtfolder.htm

Run Hijackthis, click on the 'scan' button and then 'save log' button. Copy and paste the contents of the text file you save into a reply to this message. A lot of posters make mistakes here in copying and pasting so reread the left info sidebar called Copy and Paste at http://www.tomcoyote.com/hjt

Stay in this thread for continuity. Reply to this message.

HTH (Hope that Helps)

Texruss

fiveoh · Answer

I think this is the scan log from Hijack this... Let me know what you think.

Logfile of HijackThis v1.97.7
Scan saved at 9:28:36 PM, on 4/20/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\MSWHEEL.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\CTSYSVOL.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\WINDOWS\TEMP\MSBB.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\INTERNET OPTIMIZER\OPTIMIZE.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUNOTIFY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\GAME CONTROLLERS\SWTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\HPZSTATX.EXE
C:\UNZIPPED\HIJACKTHIS[1]\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hkcu
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.lycos.com/srch/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.snet.net/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homepage-network.com/start.cgi?hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.smartbotpro.net/7search/?hklm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SNET Internet
F1 - win.ini: run=hpfsched
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\BRIDGE.DLL
O2 - BHO: (no name) - {000006B1-19B5-414A-849F-2A3C64AE6939} - C:\WINDOWS\BI.DLL
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O2 - BHO: (no name) - {00000762-3965-4A1A-98CE-3D4BF457D4C8} - C:\PROGRAM FILES\LYCOS\SIDESEARCH\SIDESEARCH13218.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [POINTER] C:\PROGRA~1\MSHARD~1\point32.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\CTSYSVOL.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Creative Launcher] C:\PROGRAM FILES\CREATIVE\LAUNCHER\CTLAUNCHER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\Run: [systray] C:\WINDOWS\SYSTEM\A.EXE
O4 - HKLM\..\Run: [msbb] c:\windows\temp\msbb.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [ccProxy] c:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.EXE
O4 - HKCU\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: SwTray.lnk = C:\Program Files\Microsoft Hardware\Game Controllers\SWTRAY.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Sidesearch (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir8d196.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {C3EF17D6-2201-11D4-9F0E-00B0D011B1AE} (Communities.com Passport) - http://cartoonorbit.cartoonnetwork.com/orbiter11020/winorbiter.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/wtgeneric/lilostitchpinball/install.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38013.7007175926
O16 - DPF: {ED3ADB6E-5AA9-41B0-9DDC-6F31A34552BE} - http://www.free-scratch-cards.com/install.exe
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {9C691A33-7DDA-4C2F-BE4C-C176083F35CF} (brdg Class) - http://www2.flingstone.com/cab/98ME/new/bridge.cab
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab

Texruss · Answer

Quite a few parasites.Download CW Shredder 1.56.2 at:http://www.zerosrealm.com/downloads.phpRead running directions here:http://www.bleepingcomputer.com/forums/index.php?showtutorial=47At bleepingcomputer.com start at the section that says:Step 2: Starting CWShredder (Note...we have noticed recently some CWS variants are harder to remove unless the shredder is run in Safe Mode...hit F8 while booting to enter Safe Mode and run the shredder.)Boot into Safe Mode to run CW Shredder:http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_namAfter cleaning with the shredder in Safe Mode do this:Download and run these two programs (Spybot S&D and Adaware). Use Spybot first. Follow the directions completely at:http://www.cjwd.demon.co.uk/spybot-adaware.htmlReboot if asked by either program and let it complete any cleanup. Then reboot a final time after running both and run Windows Disk Cleanup: Start/Run/ type: cleanmgr I select all the junk to be deleted here.Post back with a new log as a reply to this message (stay in this message posting thread for continuity).HTH,Texruss

fiveoh · Answer

here is the second half - help thanks fiveoh :

FileVersion        : 4.71.1972.1
    ProductVersion     : 4.71.1972.1
    Copyright          : Copyright (C) Microsoft Corp. 2000
    CompanyName        : Microsoft Corporation
    FileDescription    : Task Scheduler Engine
    InternalName       : TaskScheduler
    OriginalFilename   : mstask.exe
    ProductName        : Microsoft
    Created on         : 6/18/01 4:33:20 PM
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 6/18/01 4:33:20 PM

#:6 [ccevtmgr.exe]
    FilePath           : C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\
    ProcessID          : 4294956237
    Threads            : 23
    Priority           : Normal
    FileSize           : 249 KB
    FileVersion        : 2.1.0.610
    ProductVersion     : 2.1.0.610
    Copyright          : Copyright (c) 2000-2003 Symantec Corporation. All rights reserved.
    CompanyName        : Symantec Corporation
    FileDescription    : Common Client Event Manager Service
    InternalName       : ccEvtMgr
    OriginalFilename   : ccEvtMgr.exe
    ProductName        : Common Client
    Created on         : 11/10/03 6:25:34 PM
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 11/10/03 5:30:04 PM

#:7 [ccsetmgr.exe]
    FilePath           : C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\
    ProcessID          : 4294951037
    Threads            : 14
    Priority           : Normal
    FileSize           : 229 KB
    FileVersion        : 2.1.0.610
    ProductVersion     : 2.1.0.610
    Copyright          : Copyright (c) 2000-2003 Symantec Corporation. All rights reserved.
    CompanyName        : Symantec Corporation
    FileDescription    : Common Client Settings Manager Service
    InternalName       : ccSetMgr
    OriginalFilename   : ccSetMgr.exe
    ProductName        : Common Client
    Created on         : 11/10/03 6:25:34 PM
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 11/10/03 5:30:12 PM

#:8 [ccproxy.exe]
    FilePath           : C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\
    ProcessID          : 4294849793
    Threads            : 20
    Priority           : Normal
    FileSize           : 213 KB
    FileVersion        : 2.1.2.800
    ProductVersion     : 2.1.2.800
    Copyright          : Copyright (c) 2000-2003 Symantec Corporation. All rights reserved.
    CompanyName        : Symantec Corporation
    FileDescription    : Common Client Network Proxy Service
    InternalName       : ccProxy
    OriginalFilename   : ccProxy.exe
    ProductName        : Common Client
    Created on         : 2/3/04 6:58:20 PM
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 1/27/04 11:06:54 PM

#:9 [sndsrvc.exe]
    FilePath           : C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\
    ProcessID          : 4294841717
    Threads            : 16
    Priority           : Normal
    FileSize           : 189 KB
    FileVersion        : 5.3.0.46
    ProductVersion     : 5.3
    Copyright          : Copyright 2002, 2003 Symantec Corporation
    CompanyName        : Symantec Corporation
    FileDescription    : Network Driver Service
    InternalName       : SndSrvc
    OriginalFilename   : SndSrvc.exe
    ProductName        : Symantec Security Drivers
    Created on         : 3/11/04 6:58:32 PM
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 3/11/04 6:58:32 PM

#:10 [explorer.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 4294710401
    Threads            : 5
    Priority           : Normal
    FileSize           : 176 KB
    FileVersion        : 4.72.3110.1
    ProductVersion     : 4.72.3110.1
    Copyright          : Copyright (C) Microsoft Corp. 1981-1997
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows Explorer
    InternalName       : explorer
    OriginalFilename   : EXPLORER.EXE
    ProductName        : Microsoft(R) Windows NT(R) Operating System
    Created on         : 4/24/99 2:22:00 AM
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:11 [taskmon.exe]
    FilePath           : C:\WINDOWS\
    ProcessID          : 4294708525
    Threads            : 1
    Priority           : Normal
    FileSize           : 28 KB
    FileVersion        : 4.10.1998
    ProductVersion     : 4.10.1998
    Copyright          : Copyright (C) Microsoft Corp. 1998
    CompanyName        : Microsoft Corporation
    FileDescription    : Task Monitor
    InternalName       : TaskMon
    OriginalFilename   : TASKMON.EXE
    ProductName        : Microsoft(R) Windows(R) Operating System
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:12 [systray.exe]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4294768965
    Threads            : 2
    Priority           : Normal
    FileSize           : 32 KB
    FileVersion        : 4.10.2222
    ProductVersion     : 4.10.2222
    Copyright          : Copyright (C) Microsoft Corp. 1993-1998
    CompanyName        : Microsoft Corporation
    FileDescription    : System Tray Applet
    InternalName       : SYSTRAY
    OriginalFilename   : SYSTRAY.EXE
    ProductName        : Microsoft(R) Windows(R) Operating System
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:13 [ahqtb.exe]
    FilePath           : C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\
    ProcessID          : 4294649517
    Threads            : 1
    Priority           : Normal
    FileSize           : 198 KB
    FileVersion        : 1.0.185
    ProductVersion     : 1.0.185
    Copyright          : Copyright (c) Creative Technology Ltd. 1997-1999
    CompanyName        : Creative Technology Ltd.
    FileDescription    : Creative AudioHQ
    InternalName       : AHQTaskBar
    OriginalFilename   : AHQTb.exe
    ProductName        : AudioHQ
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/12/99 5:00:00 AM

#:14 [ctsysvol.exe]
    FilePath           : C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\
    ProcessID          : 4294640305
    Threads            : 1
    Priority           : Normal
    FileSize           : 27 KB
    FileVersion        : 1, 0, 0, 0
    ProductVersion     : 1, 1, 0, 0
    Copyright          : Copyright (c) Creative Technology Ltd 1999
    CompanyName        : Creative Technology Ltd
    FileDescription    : System Tray Volume Control
    InternalName       : CTSysVol
    OriginalFilename   : CTSysVol.exe
    ProductName        : Creative Surround Mixer
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 7/6/99 5:00:00 AM

#:15 [mswheel.exe]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4294671181
    Threads            : 1
    Priority           : Normal
    FileSize           : 24 KB
    Copyright          : Creative Surround Mixer
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 7/6/99 5:00:00 AM

fiveoh · Answer

This will take two replies. I'm still having trouble with word and the internet. Here is the first half of the log after adaware and the following reply is the second half as it is greater than the 20000 charater limit:

Lavasoft Ad-aware Personal Build 6.181
Logfile created on :Tuesday, April 27, 2004 8:59:04 PM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R298 20.04.2004
______________________________________________________

Reffile status:
=========================
Reference file loaded:
Reference Number : 01R298 20.04.2004
Internal build : 229
File location : C:\PROGRAM FILES\LAVASOFT\AD-AWARE 6
\reflist.ref
Total size : 1067557 Bytes
Signature data size : 1049356 Bytes
Reference data size : 18137 Bytes
Signatures total : 23569
Target categories : 10
Target families : 455
4-27-04 6:32:03 PM Performing Webupdate...
4-27-04 8:45:57 PM Error retrieving update

4-27-04 8:47:31 PM Error retrieving update

4-27-04 8:48:36 PM Error retrieving update

Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium III
Memory available:0 %
Total physical memory:130376 kb
Available physical memory:2820 kb
Total page file size:1966772 kb
Available on page file:1845980 kb
Total virtual memory:2093056 kb
Available virtual memory:2047168 kb
OS:Windows (98)

Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file

Extended Ad-aware Settings
=========================
Set : Unload recognized processes during scanning
Set : Include basic Ad-aware settings in logfile
Set : Include additional Ad-aware settings in logfile
Set : Let windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Always back up reference file, before updating
Set : Play sound if scan produced a result

4-27-04 8:59:04 PM - Scan started. (Custom mode)

Listing running processes
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [kernel32.dll]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4279185093
    Threads            : 4
    Priority           : High
    FileSize           : 460 KB
    FileVersion        : 4.10.2222
    ProductVersion     : 4.10.2222
    Copyright          : Copyright (C) Microsoft Corp. 1991-1999
    CompanyName        : Microsoft Corporation
    FileDescription    : Win32 Kernel core component
    InternalName       : KERNEL32
    OriginalFilename   : KERNEL32.DLL
    ProductName        : Microsoft(R) Windows(R) Operating System
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:2 [msgsrv32.exe]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4294932853
    Threads            : 1
    Priority           : Normal
    FileSize           : 11 KB
    FileVersion        : 4.10.2222
    ProductVersion     : 4.10.2222
    Copyright          : Copyright (C) Microsoft Corp. 1992-1998
    CompanyName        : Microsoft Corporation
    FileDescription    : Windows 32-bit VxD Message Server
    InternalName       : MSGSRV32
    OriginalFilename   : MSGSRV32.EXE
    ProductName        : Microsoft(R) Windows(R) Operating System
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:3 [mprexe.exe]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4294930405
    Threads            : 1
    Priority           : Normal
    FileSize           : 28 KB
    FileVersion        : 4.10.1998
    ProductVersion     : 4.10.1998
    Copyright          : Copyright (C) Microsoft Corp. 1993-1998
    CompanyName        : Microsoft Corporation
    FileDescription    : WIN32 Network Interface Service Process
    InternalName       : MPREXE
    OriginalFilename   : MPREXE.EXE
    ProductName        : Microsoft(R) Windows(R) Operating System
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:4 [mmtask.tsk]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4294921553
    Threads            : 1
    Priority           : Normal
    FileSize           : 1 KB
    FileVersion        : 4.03.1998
    ProductVersion     : 4.03.1998
    Copyright          : Copyright
    CompanyName        : Microsoft Corporation
    FileDescription    : Multimedia background task support module
    InternalName       : mmtask.tsk
    OriginalFilename   : mmtask.tsk
    ProductName        : Microsoft Windows
    Created on         : 1/1/01
    Last accessed      : 4/27/04 4:00:00 AM
    Last modified      : 4/24/99 2:22:00 AM

#:5 [mstask.exe]
    FilePath           : C:\WINDOWS\SYSTEM\
    ProcessID          : 4294959229
    Threads            : 3
    Priority           : Normal
    FileSize           : 109 KB

Texruss · Answer

I'll need a Hijackthis log please. Texruss

fiveoh · Answer

here is the latest scan form cwshredder:

CWShredder v1.56.2 scan only report
Please understand that a CWShredder 'Scan only' report
might not be sufficient to troubleshoot an infected system.
You can use HijackThis for that:
http://www.merijn.org/files/hijackthis.zip
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

Windows 98 (4.10.2222 A)
Windows dir: C:\WINDOWS
Windows system dir: C:\WINDOWS\system
AppData folder: C:\WINDOWS\Application Data
Username: Default

Hosts file not present
Found CWS.Control (if filesize is over 50k) file: C:\WINDOWS\control.exe (2112 bytes, A)
Registry value: DefaultPrefix (should be http://) [] http://
Registry value: WWW Prefix (should be http://) [www] http://
Registry value: Mosaic Prefix (should be http://) [mosaic] http://
Registry value: Home Prefix (should be http://) [home] http://
Found Win.ini file: C:\WINDOWS\win.ini (7631 bytes, A)
Found line in Win.ini: load=
Found line in Win.ini: run=hpfsched
Found System.ini file: C:\WINDOWS\system.ini (2390 bytes, A)
Found line in System.ini: shell=Explorer.exe

- END OF REPORT -

Thanks

fiveoh · Answer

sorry maent to send the hijackm this log, here you go!

Logfile of HijackThis v1.97.7
Scan saved at 9:18:52 PM, on 4/28/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\MSWHEEL.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\CTSYSVOL.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\GAME CONTROLLERS\SWTRAY.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\PROGRAM FILES\WINZIP\WINZIP32.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.lycos.com/srch/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.snet.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SNET Internet
F1 - win.ini: run=hpfsched
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [POINTER] C:\PROGRA~1\MSHARD~1\point32.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\CTSYSVOL.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Creative Launcher] C:\PROGRAM FILES\CREATIVE\LAUNCHER\CTLAUNCHER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [ccProxy] c:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.EXE
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: SwTray.lnk = C:\Program Files\Microsoft Hardware\Game Controllers\SWTRAY.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir8d196.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {C3EF17D6-2201-11D4-9F0E-00B0D011B1AE} (Communities.com Passport) - http://cartoonorbit.cartoonnetwork.com/orbiter11020/winorbiter.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/wtgeneric/lilostitchpinball/install.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38013.7007175926
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab

Thanks

Texruss · Answer

There is a newer CWShredder (1.57.0) since you ran the older tool, but it looks like it did some good. Most of the baddies (and there were some rough customers) were also removed by Spybot and Adaware...kudos to those programs!
But they don't get them all, so here's where we get tough. *;-)

Open Hijackthis and scan. Check these for removal:

O2 - BHO: (no name) - {83DE62E0-5805-11D8-9B25-00E04C60FAF2} - C:\WINDOWS\2_0_1browserhelper2.dll
Comments: adware from Blazefind

O4 - Startup: PowerReg Scheduler.exe
Comments: optional remove..resource hog

O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} (WTHoster Class) - http://install.wildtangent.com/bgn/partners/wtgeneric/lilostitchpinball/install.cab
Comments: slim down the activeX components and this one is on my non-favored list

With no windows open (especially browsers) besides Hijackthis click fix checked.

Open Windows explorer (type: explorer at Start/Run). Drill into Windows and look for
2_0_1browserhelper2.dll and delete it if found. You may need to enable Hidden files or use Safe Mode, but try regular mode first.

How to start the computer in Safe mode
Show hidden files.

Reboot and run disk cleaner: type cleanmgr at Start/Run. Clean all hard drive categories.

Run a fresh log and post back here.

Cheers,

Texruss

fiveoh · Answer

it's getting better - internet seems better - works like it used to but still can't open Word - HJT=

Logfile of HijackThis v1.97.7
Scan saved at 10:23:12 PM, on 4/29/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\CREATIVE\SBLIVE\AUDIOHQ\AHQTB.EXE
C:\WINDOWS\SYSTEM\MSWHEEL.EXE
C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\CTSYSVOL.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\QTTASK.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCAPP.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUNOTIFY.EXE
C:\PROGRAM FILES\MICROSOFT HARDWARE\GAME CONTROLLERS\SWTRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WORKS SHARED\WKCALREM.EXE
C:\PROGRAM FILES\WINZIP\WZQKPICK.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\UNZIPPED\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.lycos.com/srch/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.snet.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by SNET Internet
F1 - win.ini: run=hpfsched
O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] c:\windows\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] c:\windows\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [POINTER] C:\PROGRA~1\MSHARD~1\point32.exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [CTSysVol] C:\PROGRAM FILES\CREATIVE\SURROUNDMIXER\CTSYSVOL.EXE
O4 - HKLM\..\Run: [Norton Auto-Protect] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE /LOADQUIET
O4 - HKLM\..\Run: [Creative Launcher] C:\PROGRAM FILES\CREATIVE\LAUNCHER\CTLAUNCHER.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec Core LC] C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe start
O4 - HKLM\..\Run: [URLLSTCK.exe] c:\Program Files\Norton Internet Security\UrlLstCk.exe
O4 - HKLM\..\Run: [NAV DefAlert] C:\PROGRA~1\NORTON~1\DEFALERT.EXE
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ccSetMgr] "c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"
O4 - HKLM\..\RunServices: [ccProxy] c:\PROGRA~1\COMMON~1\SYMANT~1\CCPROXY.EXE
O4 - HKLM\..\RunServices: [SndSrvc] C:\PROGRA~1\COMMON~1\SYMANT~1\SNDSRVC.EXE
O4 - HKCU\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: SwTray.lnk = C:\Program Files\Microsoft Hardware\Game Controllers\SWTRAY.EXE
O4 - Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O4 - Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: Dell Home (HKCU)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com/pub/shockwave/cabs/director/swdir8d196.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O16 - DPF: {C3EF17D6-2201-11D4-9F0E-00B0D011B1AE} (Communities.com Passport) - http://cartoonorbit.cartoonnetwork.com/orbiter11020/winorbiter.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38013.7007175926
O16 - DPF: {90A29DA5-D020-4B18-8660-6689520C7CD7} (DmiReader Class) - http://ftp.us.dell.com/fixes/PROFILER.CAB
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab

Thanks -5 oh

Texruss · Answer

Sorry..see next post...hit stop button too late to fix a typo and got a double post...no post deletion privileges for me. *;-) Message Edited by Texruss on 04-29-2004 11:24 PM

Texruss · Answer

Looking better...still a malicious ActiveX:

O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildApp.cab

Wildapp...kill it in HJT.

Your Word issue may require a repair mode in Add/Remove Programs. Could be virus-damaged or just Word corruption.

HTH,

texruss

jwatt · Answer

Your Word issue may require a repair mode in Add/Remove Programs. Could be virus-damaged or just Word corruption.

I'd try the usual remedy for strange problems with Word startup first. Locate all copies of the file "normal.dot" on your hard drive and delete them. You may need to enable the display of hidden files and folders, and display of file extensions for known file types, in order to find them.

"normal.dot" frequently becomes corrupted under seemingly normal usage. If you delete it, Word will create a new copy when it starts.

Jim

Texruss · Answer

Jim posted this excellent advice:>'normal.dot' frequently becomes corrupted under seemingly normal usage. Good suggestion...it's an easy thing to try first instead of the brute force method of Repair mode. *;-) Thanks, Texruss

fiveoh · Answer

Jimw -Thanks, great suggestion. I've already loaded WORD about ten times and nothing worked. As soon as I did what you said it came right up. That was the last thing to come back. Now my computer is whole! Thanks very much!

fiveoh

Virus & Spyware

TROJAN HORSEVIRUS

Was this post helpful?