Midnight Star
5 Rhenium

Re: hijackthis log file...stil have problems with Dr. watson

archies,

Let's see what we can do...



Go to www.trendmicro.com, and then:

1. Click "Free Online Scan".
2. Click "Scan now, it's free".

It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:

1. Select all available drives.
2. Check(tick) "Auto Clean".
3. Click "Scan".

When it completes, post back the full filename of any files that cannot be cleaned or deleted.



Go to Add/Remove programs and remove(uninstall) the following, if present:

Windows AdStatus

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.



Run HiJackThis then:

1. Click "Config..."
2. Click "Misc Tools"
3. Click "Open Process manager"

-

Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:

C:\Program Files\Windows AdStatus\WinStatKeep.exe
C:\WINDOWS\system32\gah95on6.exe
C:\Program Files\Windows AdStatus\WinStat.exe

Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.



Run HiJackThis and click "Scan", then check(tick) the following, if present:


O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe
O4 - HKLM\..\Run: [gah95on6] C:\WINDOWS\system32\gah95on6.exe
O4 - HKCU\..\Run: [msmc] C:\WINDOWS\system32\msedpb.exe

O16 - DPF: {BAB3E70B-A847-4A88-ACFC-778FCCC00287} (CActSetupObj Object) - http://www.odysseusmarketing.com/actsetup.cab


Now, with all windows closed except HiJackThis, click "Fix checked".



Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:

folders...

C:\Program Files\Windows AdStatus

files...

C:\WINDOWS\system32\gah95on6.exe
C:\WINDOWS\system32\msedpb.exe

-

Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them from "Safe Mode".



Post back a new log.

-

Mike.
0 Kudos