Please help remove "application cannot be executed" virus

[harry 48]

http://www.computerhope.com/cgi-bin/process.pl

  there you go

[chrisski]

Thanks. I did that and am now rerunning SAS, MB etc. After doing so I am going to post the logs and shut my computer down until I hear back, in order to avoid further complications. (I will be checking this site on a different computer though). I have a quick question. The first time after I ran MB and SAS my wife thought that my system was clean and used a credit card for an online purchase. Is that card likely at risk and should I cancel it? I would intuitively say yes, however I also read that this virus is only dangerous if you give them your card to buy their bogus software. Thanks for the advice. I will post the logs for SAS, MB, HJT, and HJT PT early tommorow. Thanks again for helping me work through this. 

[harry 48]

i never use 1 on a pc

but if you are hijacked there are certain programmes that will steal your imformation , tell her to use it on a clean pc

[SuperDave]

Hello chrisski and welcome to Computer Hope Forum. My name is Superdave but you can just call me SD. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.
---------------------------------------------------------------------------------------------------------------------------------

Download HostsXpert

•Unzip HostXpert to your Desktop

•Open up the HostXpert program.

•Make sure that the "Make Hosts Writable?" button in the upper right corner is enabled.

•Click Create Back Up

•Then click on Restore Microsoft's Host Files

•Close the HostXpert program
--------------------------------------------------------------------------------------

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: PokerTime - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\PokerTimeMPP\MPPoker.exe (file missing) (HKCU)
O9 - Extra button: UB - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\Christian\Start Menu\Programs\UB\UB.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: UB - {1FBA04EE-3024-11d2-8F1F-0000F87ABD16} - C:\Documents and Settings\Christian\Start Menu\Programs\UB\UB.lnk (file missing) (HKCU)

Important: Close all open windows except for HijackThis and then click Fix checked.

Once completed, exit HijackThis.
-------------------------------------------------------------------------------------------------------------------------------

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1
link #2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts.
Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

[chrisski]

If only you had gotten here a day earlier. I went to an IT guy at my university and he told me the best option would be to reinstall my OP. Nothing else had worked so I did it. Thanks anyway though.