ad.firstadsolution.com

Make sure viewing of hidden files is enabled (per the tutorial).

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O4 - HKLM\..\Run: [bendwindowmeowgrim] C:\WINDOWS\Application Data\proxy close bend window\Type aim.exe
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS\TEMP\SE.DLL,DllInstall
O4 - HKCU\..\Run: [TBON] C:\PROGRAM FILES\TBONBIN\TBON.EXE /r
O4 - HKCU\..\Run: [eggsseek] C:\WINDOWS\APPLIC~1\INFOHO~1\bore less coal.exe
O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\PROGRAM FILES\TBONBIN <--- the whole folder
C:\Program Files\info hold <--- the whole folder
C:\WINDOWS\Application Data\info hold <--- the whole folder
C:\WINDOWS\Application Data\proxy close bend window <--- the whole folder
C:\WINDOWS\TEMP\SE.DLL

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.
Now run Ccleaner (installed while running the READ ME FIRST).

Now reboot in normal mode and post a new HJT log.

Make sure you tell me how things are working now. We may need some special steps to remove the SE.DLL file if it comes back.

Reminder Note: Once we have determined you are malware free you will need to disable System Restore, reboot, and re-enable system restore per step 1 of the READ & RUN ME. This only applies to if using WinXP or WinMe.

 

Please remember that logs MUST be attachments.

Did you just install/re-install the below? It was not in your previous log!
O4 - HKLM\..\RunServices: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart

MessengerPlus! 3 could be the root cause of all your original LOP infections and other malware that we just finished fixing.

You need to have HijackThis fix the below line:
O2 - BHO: Need2Find Bar BHO - {4D1C4E81-A32A-416b-BCDB-33B3EF3617D3} - C:\PROGRAM FILES\NEED2FIND\BAR\1.BIN\ND2FNBAR.DLL (file missing)

Then ATTACH a new HJT log and let me know how things are working.

 

Look in Add/Remove programs and if you find MSN Messenger Plus, just uninstall it. Let me know what you find. If that does not work we will fix it manually.

 

Did you sayyes! If not, try again and say Yes! Then check to make sure it is gone. Take note of that message where it says & Sponsor that's the malware that they install.

Also run HJT and select those two lines from MSN Messenger Plus that I listed in message # 4 and make sure you fix them.

Then delete the below folder if found (you may have to reboot into safe mode to delete):
C:\Program Files\MessengerPlus! 3

 

Your log is clean. If you are not having any other malware problems, you should work thru the below link:

How to Protect yourself from malware!