I can't go on to Facebook, I get a wierd restricted message???

[mcummings36]

What about avast? I have that as well. Are the free programs ok, or is it worth it to purchase an upgraded or advanced version? My printer driver is fine for now, lostcoast on the chatroom helped me with that last night. I'm am totally willing, at this point, to purchase a better security program if needed. I just am not sure which is best, or if what I have is okay, and I'm maybe just not running them often enough. Thank you everyone who has replied with help. I don't mean to come across as rude or ungrateful, this stuff just freaks me out.

[SuperDave]

Hello mcumming36 and welcome to Computer Hope Forum. My name is Superdave but you can just call me SD. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

I apologize if things got off on the wrong foot in your request for help. As you can see SAS and MBAM certainly got rid of a lot of infections. Now, if you don't mind, I would like to have a fresh HJT log. Then we can start to clean what's left on your computer.

[mcummings36]

Thank you! I'll wait for you to tell me the next step!

[cruisin702]

I'll wait for you to tell me the next step!

I normally don't like to post once SuperDave is on the case, however to speed things up for you I will point out that SuperDave has requested that you run HijackThis again and post a new log.

I apologize if things got off on the wrong foot in your request for help. As you can see SAS and MBAM certainly got rid of a lot of infections. Now, if you don't mind, I would like to have a fresh HJT log. Then we can start to clean what's left on your computer.

[mcummings36]

Here is the newest hijackthis log, just ran it now.

[Saving space, attachment deleted by admin]

[SuperDave]

Thanks, cruisin.

It appears the the two previous scans got rid of a lot of infections. Just a few more things to do.

Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the desktop.

----------------------------------------------------------------------------------

Open HijackThis and select Do a system scan only

Place a check mark next to the following entries: (if there)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R3 - URLSearchHook: (no name) -  - (no file)
O3 - Toolbar: Mirar - {2CEB7D52-D79D-4E78-94C4-626D622D2375} - C:\WINDOWS\system32\7c78.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Program Files\Java\jre6\bin\jusched.exe\"
(Description: Sun Java update scheduler. Checks for updates. Not necessary. Removing this entry will free up a small amount of system resources.)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} -
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://www.worldwinner.com/games/v46/shared/FunGamesLoader.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab

Important: Close all open windows except for HijackThis and then click Fix checked.

----------------------------------------------------------------------------------------------------------

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1
link #2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Vista users Right-click combofix.exe and select Run as Administrator and follow the prompts.
Double-click combofix.exe and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

Once completed, exit HijackThis.

[mcummings36]

I went to the site to download whatever it is to remove windows messenger, but I don't know what to click on??? There are a bunch of different downloads there, but none say windows messenger? Which one is it?

[BC_Programmer]

I went to the site to download whatever it is to remove windows messenger, but I don't know what to click on??? There are a bunch of different downloads there, but none say windows messenger? Which one is it?

http://majorgeeks.com/downloadget.php?id=2327&file=1&evp=407844d9f4a1d230eda60d32e2d153e8

[mcummings36]

"Unzip the file on the desktop..."
Does that mean open and run the program, because tha's pretty much the only option it's giving me. I right clicked on it to see if there was an option to unzip, and there wasn't.

[harry 48]

Does that mean open and run the program,

thats right just click it

[mcummings36]

I got an error message about ComboFix only or not being compatible with Windows XP? Now what? It downloaded to my desktop, but didn't run apparently.

[BC_Programmer]

I got an error message about ComboFix only or not being compatible with Windows XP? Now what? It downloaded to my desktop, but didn't run apparently.

does it look like This:



If so just tell it to Run the program. Otherwise, I have no idea what it is or what it's from; I just ran it successfully on my XP Virtual Machine and that box was all that appeared.

EDIT: it's also possible that malware is showing you this "not compatible" message. you could try renaming combofix to something else.

[SuperDave]

Hi mcummings. Does it look like what B C Programmer posted. If not, could you do a screen print and post it here in your next reply?
How to post screenshots or images

[mcummings36]

I couldn't post a screenshot, I clicked out of it before I posted the last message. However, I believe the program ran anyway, as the blue/black box came up and it went through all the phases, rebooted, etc...do I need to post anything else? Thanks so much for helping me and for responding so quickly.

[BC_Programmer]

I couldn't post a screenshot, I clicked out of it before I posted the last message. However, I believe the program ran anyway, as the blue/black box came up and it went through all the phases, rebooted, etc...do I need to post anything else? Thanks so much for helping me and for responding so quickly.

When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

Once completed, exit HijackThis.

So- the Combofix log and a new hijackthis log. If you already closed the notepad window that displays the log, or it didn't appear for whatever reason, I believe Combofix saves it as C:\ComboFix.txt.