I need help for about:blank malware pretty please.

Discussion in 'Malware Help (A Specialist Will Reply)' started by stritheor, Mar 11, 2005.

  1. stritheor

    stritheor Private E-2

    First I'd like to apologize because I know you guys have to be getting sick of these. Major geeks seems to be the only place in the know about this doozy.

    Anyway, everytime I open an IE window, I get a notice from AVG that I have the trojan downloader.agent.9.bf. None of my spyware scanners will finish running either. I have the latest Spybot, Ad-Aware, AVG and I tried the Trend Micro and it froze up too. I'm a complete idiot when it comes to computers, so please keep that in mind. I haven't ran HJT yet because I don't really know how to use it and the sticky said not to run it until told to do so.

    I have an HP with ME if that matters.

    Should I go ahead and run HJT and follow the sticky to start with or do I need to do something different.

    Thanks.
     
    stritheor, Mar 11, 2005
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    To help us to best help you, please follow the steps below closely and in the order given and do not skip anything. If you have any difficulty, please post back letting us know what steps you have completed, what you found while doing the scans if anything along with details about any problems you may have encountered in completing the steps. The more details you can provide the better. Don't be afraid to ask for additional help if you don't understand something!

    - Run ALL the steps in this Sticky thread READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus RemovalMake sure you check version numbers and get all updates.

    - Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


    After doing ALL of the above you still have a problem:

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENTto your next message. (Do NOT copy/paste the log into your post).
     
    chaslang, Mar 11, 2005
    #2
  3. stritheor

    stritheor Private E-2

    I just wanted to post a quick update. I've started the list and am now on the online scan. I tried and failed to connect to the internet in safe mode. And then I tried four times to run (in normal mode) both Trend Micro and Symantec scans with IE and every time I would get an IE error and my browser would close. So right now I'm running the java version of Trend Micro on Mozilla Firefox.

    I'm not going to be able to use HSRemove because I'm using Windows ME unfortunately.

    Also, in the getting prepared section, I assume section 2 only applies to those OS's named? I tried the services.msc thing just in case and it didn't work. It said windows couldn't find it, I assume because ME doesn't have it.

    I'll post back with another update once I've finished everything on the to do list.
     
    stritheor, Mar 11, 2005
    #3
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes that's what step two indicates!

    If you cannot get the online scans to work, complete the other steps and just note your problems when you come back.
     
    chaslang, Mar 11, 2005
    #4
  5. stritheor

    stritheor Private E-2

    Sorry it took so long. I got all the way done when my girlfriend told me I shouldn't run those online scans with AVG running, so I took AVG off of my start up list and ran them again. Then I mixed up my notes, so I had to do it again. Uggh. I have a few choice words for the person that wrote this only the best thing. Anyway...

    I had to run Trend Micro and Symantec online scans in normal mode.

    Trend Micro wouldn't run in IE, so I had to run it with Mozilla Firefox. It found nothing.

    I ran Symantec in IE and it found 4 infections. I don't know if you need this or not, but just in case you do...
    All of these scans were done in safe mode with the exception of the alternate online virus scans at the bottom:

    Avert Stinger found nothing.

    Ad-Aware found 52 critical objects; 4 Registry Keys, 11 Registry Values Identified, and 37 Files Identified.

    Spybot found no threats.

    CWShredder said I was completely clean.

    Kill2Me said Look2Me was removed if it was present.

    Avast said no virus body found.

    A-squared found malware: C:\HP\bin\Terminator.exe

    Bit Defender found 5 infected objects.

    RAV Anti-Virus found 0 infected, 2 suspicious.
    suspicious files found:
    Trojan Scan found 0 infected.

    And ADS Spy said Alternate Data Streams (ADS) are only possible on NTFS systems.

    So that's where I'm at now and I still have browsers going to about:blank. I figured I'd attach my HJT log since that's what you said to do in your post. If you'd rather me give a go at your generic solution here, just let me know. I should warn you though, I don't hardly understand any of that stuff in that thread.

    Thank you again for your time chaslang. :)
     

    Attached Files:

    stritheor, Mar 12, 2005
    #5
  6. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    MESSENGER PLUS! 3 Installs all kinds of malware on your system including LOP. You should go to Add/Remove programs and uninstall this now. I'm still looking at the rest of your log.

    Do you really need the below to load at startup? Why not just run it when needed instead of always runnng it?
     
    chaslang, Mar 12, 2005
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Before contiuning with the cleanup, I need an additional step to be run. Please download "StartDreck", from here:
    http://www.niksoft.at/_data/startdreck.zip

    Unzip to its own folder and start the program,
    Press 'Config'
    Press 'Unmark All'
    Check the following boxes only:
    Registry -> Run Keys
    System/drivers> Running processes
    Press 'Ok'
    Press 'Save' and select the location to save the log file
    (default is the same folder as the application)

    Please attach the log in this thread.
     
    chaslang, Mar 12, 2005
    #7
  8. stritheor

    stritheor Private E-2

    I removed it.

    I'm not sure what you mean. Were you talking about Messenger Plus! 3 or all the crap on my list? Either way really, I have no idea what I'm supposed to have and could do without, which is why I mess with it as little as possible. All I care to have on start up is my wordweb dictionary, AVG (which is currently off of my list), and regular Windows stuff.

    I ran the StartDreck. I hope you're able to open .log files, because that's what it saved as. Unless there's a way to choose the file type that I didn't see?
     

    Attached Files:

    stritheor, Mar 12, 2005
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay I left out a line:
    O4 - Startup: WordWeb.lnk = C:\Program Files\WordWeb\wweb32.exe

    Why do you need this to load at startup instead of only when you need it? Isn't this just a theasaurus and dictionary? Why do you always need it loaded?
     
    chaslang, Mar 12, 2005
    #9
  10. stritheor

    stritheor Private E-2

    Okay, I see what you mean. No I don't need it at startup. I just had it that way because I use it a lot. I'll take it off, but I'll wait to see if there's anything else first.
     
    stritheor, Mar 12, 2005
    #10
  11. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you run StartDreck before or after uninstalling Messenger Plus? I still see signs of it in the StartDreck log.
     
    chaslang, Mar 12, 2005
    #11
  12. stritheor

    stritheor Private E-2

    Before, sorry.
     

    Attached Files:

    stritheor, Mar 12, 2005
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hmmm! There is still the below:
    »RunOnce
    *MessengerPlusUninstall=C:\WINDOWS\command.com /C "C:\WINDOWS\TEMP\MsgPlusUninst.bat"

    Have you rebooted since uninstalling?
     
    chaslang, Mar 12, 2005
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Make sure you have about:Buster downloaded from the READ ME FIRST. And make sure you have UPDATED the database for about:buster. I believe it is up to number 25.

    You need to print or save these instructions locally because after this reading this sentence you will need to physically unplug your connection from your cable, ADSL, or dial-up modem to your PC and then you MUST exit all browsers and DO NOT run any again until requested.

    Okay, unplug your internet connection and exit browsers now!!!!

    Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
    C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    C:\WINDOWS\NETYM32.EXE
    C:\WINDOWS\SYSTEM\SYSNQ32.EXE

    After killing all the above processes, click "Back".
    Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now (DO NOT OPEN ANOTHER BROWSER UNTIL AFTER POWER DOWN AND POWER UP, see below):
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\jwlvf.dll/sp.html#44768
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\jwlvf.dll/sp.html#44768
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system\jwlvf.dll/sp.html#44768
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system\jwlvf.dll/sp.html#44768
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system\jwlvf.dll/sp.html#44768
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system\jwlvf.dll/sp.html#44768
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - Default URLSearchHook is missing
    O2 - BHO: Class - {7405DFC9-0104-BD6B-6AFF-86732A81A6A5} - C:\WINDOWS\SYSTEM\NTUJ32.DLL
    O4 - HKLM\..\Run: [IEXPLORE.EXE] C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
    O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    O4 - HKLM\..\RunServices: [NETYM32.EXE] C:\WINDOWS\NETYM32.EXE
    O4 - HKLM\..\RunServices: [SYSNQ32.EXE] C:\WINDOWS\SYSTEM\SYSNQ32.EXE
    O4 - Startup: PowerReg Scheduler.exe
    Do you know what the below line is for? If not, fix it too.
    O16 - DPF: {22A88341-AFCB-45F0-A856-C2BAE74F878E} (InstallX Class) - http://www.20x2p.com/b89ef1e1/enter.cab

    Then exit HJT after clicking FIX

    Run Windows Explorer and look for and try to delete (sort the listing in windows explorer by Modification dates and look for possibly other similarly name files from the same date - let me know if you find others):
    C:\WINDOWS\system\jwlvf.dll
    C:\WINDOWS\SYSTEM\NTUJ32.DLL
    C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
    C:\WINDOWS\NETYM32.EXE
    C:\WINDOWS\SYSTEM\SYSNQ32.EXE
    C:\WINDOWS\TEMP\MsgPlusUninst.bat

    If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. If you cannot find or delete them, note which ones and continue (tell me the results when you come back here).

    - Run about:Buster and save the log to ab1.log (make sure you let it do the second scan).

    - NOW PULL THE POWER PLUG TO YOUR PC! Yes, you read that correctly. This is very important! I do not want you to power down the normal way.

    - After that wait a minute or two and then power up into safe mode (still with no internet connection available and do not open any browsers). Only run what I request.

    - Empty your Recycle Bin and run Ccleaner that you installed while running the READ ME FIRST.

    Now we need to Reset Web Settings:
    1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
    2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
    3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

    - Run about:Buster again and save the log to ab2.log (let it do second scan)!

    - Immediately after about:buster completes, reboot in normal mode. (you do not need to pull the powser plug here. Just reboot.)

    - Plug your cable to the internet back in now.

    - Open and close a couple of IE sessions and then with IE closed get a new HJT log.

    - Now come back here and post both about:Buster logs and the new HJT log. And tell me what happened during the procedure.

    Let me know anything else that you notice.
     
    chaslang, Mar 12, 2005
    #14
  15. stritheor

    stritheor Private E-2

    I tried the list there and ran into a problem. When I clicked on "Scan" for HJT, I got a BSOD with Error: OE: 017F: BFF8E64B. Then I hit a key and it went to a black screen with a white box with Hijack This at the top and the following in it:

    Then I hit close and after fighting back and forth between that and the BSOD, I had to reset. I tried the whole thing twice.

    And I took wordweb off of my startup list, so it's not there anymore.
     
    stritheor, Mar 12, 2005
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Did you (or were you able to kill the processes first)?
     
    chaslang, Mar 12, 2005
    #16
  17. stritheor

    stritheor Private E-2

    Yes. However, the only process listed was: C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE

    These two weren't on there at all: C:\WINDOWS\NETYM32.EXE
    C:\WINDOWS\SYSTEM\SYSNQ32.EXE

    After I killed the first process, I hit back, and then scan. As soon as I hit scan, it went to a BSOD.
     
    stritheor, Mar 12, 2005
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Post a current HJT log. Also I thought that KB891711.EXE should not be running after installing. It is a Microsoft patch. But it could be that for your OS it needs to remain running. So for the remainder of the steps ignore the lines with that KB891711.EXE on them. (That is do not fix the O4 line or remove the file. At least not yet!)
     
    chaslang, Mar 12, 2005
    #18
  19. stritheor

    stritheor Private E-2

    Do you want me to go ahead now, or wait till you've read the current log?
     

    Attached Files:

    stritheor, Mar 12, 2005
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Go ahead! BUT SKIP ALL LINES REFERRING TO KB891711.EXE.
    Do not kill the process!
    Do not fix the O4 entry!
    Do not delete the file!

    Ignore the fact that the below are not shown to be running:
    C:\WINDOWS\NETYM32.EXE
    C:\WINDOWS\SYSTEM\SYSNQ32.EXE
     
    chaslang, Mar 12, 2005
    #20
  21. stritheor

    stritheor Private E-2

    I ignored all lines pertaining to KB891711. Then went to Windows Explorer and deleted C:\WINDOWS\system\jwlvf.dll. I couldn't find any of the others listed, but found some that had similar names, although I may have been pretty broad in what I considered similar. I searched for them with the search function and manually looked in the folders.

    SYSNQ32.exe not found;

    Similar names:
    Netym32.exe not found;

    Similar names
    The others didn't have files with similar names, and I couldn't find MsgPlusUninst.bat.

    For some reason, it's not letting me upload my first AB file. This one is the second. I'll keep trying to get the first one posted.
     

    Attached Files:

    stritheor, Mar 13, 2005
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Looks clean right now! Any problems?
     
    chaslang, Mar 13, 2005
    #22
  23. stritheor

    stritheor Private E-2

    Nope, none so far (knock on wood). It even seems to be running faster than before I got the bug. Does this mean I'm good to go? Did you see anything else on my startup list that doesn't need to be there?
     
    stritheor, Mar 13, 2005
    #23
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You should follow the steps in the below thread to help keep you clean:

    How to Protect yourself from malware!

    As far as other things you do not need in startup (but they are up to you):


    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe


    The below is installed with the software for Logitech products. Automatically checks for software upgrades AND new products, services and special offerings from Logitech. It is not necessary.
    O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    The below is consider adware by some. Not sure if it is needed.
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe

    See the below link and scroll down to Bjcfd
    http://www.answersthatwork.com/Tasklist_pages/tasklist_b.htm
     
    chaslang, Mar 13, 2005
    #24
  25. stritheor

    stritheor Private E-2

    That's kinda sad. That BJCFD, according to that article, is from Comcast. I haven't had Comcast cable for over a year now. Should I remove both of those using HJT, or through the regular startup menu with msconfig? Or does it even matter?
     
    stritheor, Mar 13, 2005
    #25
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you saying you no longer have an ISP that required BJCFD. More than just ComCast use it. I still don't think it is required for normal operation.

    I would not use msconfig permanently but you could use it to try it out temporarily disabling them from loading and make sure you have no problems.
     
    chaslang, Mar 13, 2005
    #26
  27. stritheor

    stritheor Private E-2

    Well, I don't think so. I know that BJCFD started with Comcast. Then I moved to North Carolina and got Time Warner Roadrunner. That article said that BJCFD is the old one, and CFD is it's newer incarnate. CFD.exe just asked permission to access the internet through ZA. I clicked on the help tab to make sure it was okay and ZA said to give it permission.

    However, I just called Time Warner and they said that they don't require any executables to run high speed internet, unless it was for the Roadrunner medic, which shouldn't be installed anyway. So the lady told me that as far as she knows, TW doesn't require either of those .exes.
     
    stritheor, Mar 13, 2005
    #27
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    OK! So as a starting test, begin by disabling loading using msconfig to see if everything works ok without the files. If all seems well, you can stop using msconfig and then use HJT to permanently remove the item from loading at startup. And if desired, you could even look in Add/Remove programs for an uninstall.
     
    chaslang, Mar 13, 2005
    #28
  29. stritheor

    stritheor Private E-2

    Everything seems to be working fine without CFD, for two days now. Do I select normal startup from the general tab to stop using selective startup and then use HJT to get rid of CFD? Or do I just re-check CFD in my startup list and go into HJT once it's back on the list?

    On a side note, is there a specific setting to change in Zone Alarm so I can see more pictures? Even on majorgeeks, it's keeping me from seeing buttons like the indent, insert email link, etc. when replying right now. I'm assuming it's ZA anyway. Matter of fact, I just came into to edit this in and now I see all the buttons. Weird.
     
    stritheor, Mar 15, 2005
    #29
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member


    Try just using Normal Startup and then then use HJT to fix the entry in the registry.

    I'm not sure that it is ZoneAlarm (it could be). Could also be some other security setting in IE. Try just shutting down ZoneAlarm temporarily and see what happens. Then you will know for sure.
     
    chaslang, Mar 15, 2005
    #30
  31. stritheor

    stritheor Private E-2

    Ugh, you're probably not going to like this. I think I've been on selective startup since forever. Now that I'm on normal startup, I've got all kinds of crap starting up that I don't want, which is why I unchecked them in my startup list in the first place. I never knew how else to remove them other than through msconfig. I wanted to post another HJT log so you could review it.

    Another thing I hope you can help with is the "Resume Windows Update" thing. That's what initially led me to unchecking the things I didn't want starting up. I had to recover my HP a couple of months ago and when I was updating to IE 6.0, that kept popping up. It only gave me two options, "Yes, resume setup." and "No, run setup from beginning. Select this option is Setup has failed more than once." It seems that no matter what option I pick, setup would fail. The only thing IE seemed to have trouble installing was VML or something, vector graphics rendering, I don't know. Can't recall. Other than that, IE ran fine, so I just unchecked the resume setup off of the startup list.

    Sorry, I know I'm probably wearing thin on your patience.

    I'm using FF now and all images loaded fine on this session, so maybe it was just a fluke or something.
     

    Attached Files:

    stritheor, Mar 15, 2005
    #31
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Please tell me specifically which items you do not want to load so we can work on them. I see a load of stuff now for you HP printer in addition to the BJCFD program we already talked about. And what about RealPlay and WinampAgent, you do not need them at startup either.
     
    chaslang, Mar 15, 2005
    #32
  33. stritheor

    stritheor Private E-2

    No, I don't want anything to startup except the spywareguard, AVG, ZA, and anything that's supposed to startup for windows. Everything else I can do without.
     
    stritheor, Mar 16, 2005
    #33
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Are you sure about that statement? Are yo sure you don't need your EasyShare Digital Camera, your HP Printer etc? What aboot Google Toolbar and WinAmp Browser Bar?

    Let's first remove two items we know you do not need and one problem. Have HJT fix the below lines:
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - Startup: Windows Update.lnk = C:\WINDOWS\WUPDMGR.EXE

    Then boot into safe mode and delete: C:\WINDOWS\WUPDMGR.EXE

    Now post a new HJT log and answer my questions above.
     
    chaslang, Mar 16, 2005
    #34
  35. stritheor

    stritheor Private E-2

    Yes, I'd like to keep the google toolbar and winamp browser bar.

    Does the HP printer stuff need to startup to function properly? If so, I'll keep it. I don't print that much.

    The logitech and Ypager can go. Ypager shouldn't be starting up anyway. I have that option unchecked to keep it from starting up, I guess it ignored me.

    When I booted into normal mode after following your instructions, the resume windows setup started up again. I canceled it. But then when I was replying to you, after a few minutes a BSOD popped up with error: 06: CFB2: 000014E0. I hit a key to keep going and then it wouldn't let me get on either browser, it kept popping up with that BSOD. So I had to reset, and this time the windows resume thing didn't startup.
     

    Attached Files:

    stritheor, Mar 16, 2005
    #35
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    What about EasyShare?

    As far as the HP stuff is concerned, I do not know exactly what each of those items loading is for. I would bet that some are not needed or are only for very specific functions. You would have to check with HP to find out why the need to install so much crap.

    I would also say the below are not need at startup:
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

    This next one (Easyshare.exe) is used to transfer files from your camera to your PC. But it can easily be run when you want it from Start-->All Programs
    O4 - Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

    O4 - Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
    O4 - Startup: Yahoo! Messenger.lnk = C:\Program Files\Yahoo!\Messenger\YPager.exe
    O4 - Startup: HEWLETT-PACKARD RECORDER.LNK = C:\Program Files\Hewlett-Packard\hp officejet v series\FRU\Remind32.exe
     
    chaslang, Mar 16, 2005
    #36
  37. stritheor

    stritheor Private E-2

    Okay, it looks like I'm good to go. I also removed MS works portfolio because I hate that thing.

    Thank you very much for all of your help and your patience. I truly appreciate it.
     
    stritheor, Mar 16, 2005
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You're welcome. You should make sure you have completed the steps (or the equivalent of them) in the below thread to help avoid future problems:

    How to Protect yourself from malware!
     
    chaslang, Mar 16, 2005
    #38

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds