ok, the scan is running and I went ahead and did the same search again and this time right clicked it AND the location of the file is in the windows folder under system 32 folder....but it is there....
Malware Removal Forums
MY reports. need help
77 min read
OK, let scan finish and post back log then 
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, March 30, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, March 30, 2009 14:35:03
Records in database: 1986635
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Z:\
Scan statistics:
Files scanned: 178925
Threat name: 4
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 02:57:11
File name / Threat name / Threats count
iexplore.exe\MSIMG32.dll/iexplore.exe\MSIMG32.dll Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.cv 1
C:\_OTMoveIt\MovedFiles\03272009_093018\PROGRA~1\MyWebSearch\bar\1.bin\F3WPHOOK.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\_OTMoveIt\MovedFiles\03272009_093018\PROGRA~1\MyWebSearch\bar\1.bin\M3IDLE.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ax 1
C:\_OTMoveIt\MovedFiles\03272009_093018\PROGRA~1\MyWebSearch\bar\1.bin\M3SLSRCH.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.cl 1
The selected area was scanned.
Monday, March 30, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, March 30, 2009 14:35:03
Records in database: 1986635
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
Z:\
Scan statistics:
Files scanned: 178925
Threat name: 4
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 02:57:11
File name / Threat name / Threats count
iexplore.exe\MSIMG32.dll/iexplore.exe\MSIMG32.dll Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.cv 1
C:\_OTMoveIt\MovedFiles\03272009_093018\PROGRA~1\MyWebSearch\bar\1.bin\F3WPHOOK.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch 1
C:\_OTMoveIt\MovedFiles\03272009_093018\PROGRA~1\MyWebSearch\bar\1.bin\M3IDLE.DLL Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.ax 1
C:\_OTMoveIt\MovedFiles\03272009_093018\PROGRA~1\MyWebSearch\bar\1.bin\M3SLSRCH.EXE Infected: not-a-virus:AdTool.Win32.MyWebSearch.cl 1
The selected area was scanned.
Delete that file and empty this folder:
C:\_OTMoveIt\MovedFiles
Empty Recycle Bin.
Still problems?
C:\_OTMoveIt\MovedFiles
Empty Recycle Bin.
Still problems?
Idid the move it folder no problem....but it will not let me delete the msimg one... it tells me I need permision....unless you are talking about delelting the whole system 32 folder
Please close messenger if open and try again.
nope it keeps telling me I need permission to delete and on the top of the box it says destination access to folder denied
Then please try to close all browser windows as well and try again.
I have tried it all it will not let me
Please try then in safe mode.
how do you put the computer in safe mode? I did it years ago but cannot remember
This should help here.
no it still wouldn't let me ...i am typing the exact thing the box says when it comes up:
Destination access folder denied
you need permission to perform this action
GDIEXT client dll
file version 6.0.6000.16386
Try again
so when I hit try again nothing happens and it keeps popping up with this box
Destination access folder denied
you need permission to perform this action
GDIEXT client dll
file version 6.0.6000.16386
Try again
so when I hit try again nothing happens and it keeps popping up with this box
So let's use then otmoveit3 again:
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
- Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
- Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
:files
C:\Windows\system32\MSIMG32.dll
:commands
[EmptyTemp]
[reboot]
- Return to OTMoveIt3, right click in the "Paste List of Files/Folders to Move" window (under the yellow bar) and choose Paste.
- Click the red Moveit! button.
- Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
- Close OTMoveIt3
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
Files moved on Reboot...
DllUnregisterServer procedure not found in C:\Windows\system32\msimg32.dll
C:\Windows\system32\msimg32.dll NOT unregistered.
File move failed. C:\Windows\system32\msimg32.dll scheduled to be moved on reboot.
DllUnregisterServer procedure not found in C:\Windows\system32\msimg32.dll
C:\Windows\system32\msimg32.dll NOT unregistered.
File move failed. C:\Windows\system32\msimg32.dll scheduled to be moved on reboot.