This thread's last reply is from June 5, 2009, 12:19 PM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
coreyg,
Taking out these two lines should free up IE. ----------------------------------------------------------- Remove log items with HighjackThis. Start HijackThis.
Click Do System Scan Only. When the Scan is complete, Check the following entries:
(Some of these lines may be missing) O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
Make sure Every other window except HJT is closed (No other tabs showing in the bottom tray), and Click Fix Checked
Click the "X" in the upper right corner of the HiJackThis window to close it.
askey127
I turned the whole thing off last night and started it up again this morning. It takes forever to get to a point where I can do ANYthing. Very very slow to boot up completely. The message I posted above still coming up and the only way around it is to click cancel. It comes up several times before it'll go away for good while surfing the net.
Save it to your Desktop as look.bat. Save it as File Type: All Files (not as a text document or it wont work).
Locate look.bat on your Desktop and double-click it.
When Notepad opens, copy/paste the content in your reply.
When you close Notepad, the CMD window will close automatically and the text file will be deleted.
askey127
coreyg, -----------------------------------------------------------
Please download the Registry Search Tool from here (scroll down-there are also other tools on the page):
http://www.billsway.com/vbspage/
Unzip it to a convenient location such as your Desktop.
Make sure that your Antivirus / OS allows the use of the .vbs scripts. If prompted, make sure to allow the script.
Double click regsearch.vbs
Copy / Paste the following line into the Search Box: SmartWeb
then hit Ok
It may take a while to run.
It will tell you when it's done and offer to have you look at the file.
Say Yes, and when it opens copy/paste the content in your reply.
askey
; Registry search results for string "SmartWeb" 5/27/2009 4:23:19 PM
; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)
Right-click erunt.zip, select Extract All... and follow the prompts to extract ERUNT to a new folder on your Desktop
Inside the new folder, double-click ERUNT.exe to start the program
OK all the prompts to back up your registry to the default location.
Note: If you ever needed to restore your registry later, you would go to the backup folder and start ERDNT.exe ----------------------------------------------------------- Copy/Paste/Run a Registry Edit
Copy/paste the following quote box into a new notepad document:
Make sure there are NO blank lines before REGEDIT4
Make sure there IS one blank line at the end of the file.
Save it as File Type All Files (not as a Text document, or it won't work).
Save it to your Desktop as fixme.reg
Double click fixme.reg on your Desktop, and merge it into the registry when asked.
Reboot Windows.
Let me know if the error message continues.
askey127
That particular error message is gone but now Intellipoint hasn't been working. I had to hook up a wireless laptop mouse to the desktop (which what we're trying to fix).
coreyg
ETA: It's reeeeeaaalllly slow on the net now, too.
I would Uninstall Intellipoint and re-install it.
Then have a look at Task manager and see what file is using most of the CPU time.
Also have a look at the Adobe programs. Do you have a copy of Adobe Acrobat? (not Reader)
If so, start it, click on Help, About and tell me what version it is.
Older versions have a broken updater which can hang up a machine.
Right now, besides IE, Mcshield.exe is using the most.
When I check Adobe in Program Files it seems I have Acrobat v 7.0 but it doesn't seem to be anywhere where I can run it. Maybe I'm just confused? Wouldn't be surprised!
Should I just go ahead and download Acrobat's latest version?
I'll have to locate the disk for Intellipoint before I dump it so I can re-install it. Is there a website where I can download it if I can't find the disk. I'm sure it's here somewhere but just in case.
BTW, I want to take this opportunity to thank you so very much for all your help. It's given me peace of mind already. We plan to donate to this site very soon.
coreyg,
You are most welcome. We sould have you all fixed up shortly.
Your Acrobat is OK for now.
Let's just doublecheck for any remaining malware. ------------------------------------------------------------
Download the latest version of Java SE Runtime Environment(JRE), and install it to your computer.
It is the 2nd item on the page, called JRE 6 Update 14
Select Windows and multi-language, and check to agree to the license.
Download it, choose Save, and save it to your desktop.
Then doubleclick it, and it will install the newest version of Java for you to use. -----------------------------------------------------
Please go to Kaspersky website and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Wednesday, June 3, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Wednesday, June 03, 2009 05:52:48
Records in database: 2300033
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
Scan statistics:
Files scanned: 127754
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 04:18:20
File name / Threat name / Threats count
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys2\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
coreyg,
Unless you use MusicMatch jukebox all the time, you should uninstall it.
Can you tell me about MusicMatch?
askey
✨ Ask AI about this thread
No ads, no affiliate links — generated on request from this thread's own
archived content, not written by forum staff. Never run a scan/removal tool
as a self-service step if the original thread describes it being done under
a helper's direct supervision, and don't include your name, email, or other
personal details in a follow-up question. See our privacy page
for details on how this works.
