O2 entry is still there, but it's from Windows Messenger, so we're not going to waste more time in order to remove it....


Your computer is clean

1. Download Temp File Cleaner (TFC)
Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

2. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

3. Restart computer.

4. Turn System Restore on.

5. Make sure, Windows Updates are current.

6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

7. Download, and install WOT (Web OF Trust): Internet Security | WOT Web of Trust. It'll warn you (in most cases) about dangerous web sites.

8. Run defrag at your convenience.

9. Read How did I get infected?, With steps so it does not happen again!: How did I get infected?

10. Please, let me know, how is your computer doing.

Hi
Thanks for your email
I was a bit confused as to what
Your computer is clean image: Then the http link. When I pressed on the link a box appeared with this is a unsafe site please proceed with caution so i did not open the link.
6. you mention if any trojan are present i was confused as where to look. was it with the temp file cleaner. If so no log was produced and the box appeared quickly - could not get proper look. I then thought the list was suppose to be present after i turned restored systems on and created a file for that but cannot find it.
I still have the mywebsearch tool bar and the lettering on the desktop is slightly stretched if that makes sense. it never used to be like this.
Many Thanks

Then the http link. When I pressed on the link a box appeared with this is a unsafe site please proceed with caution so i did not open the link.

Says what program? TFC is perfectly clean program. Do you think, I'd point you to some dangerous sites?

I don't see any MyWebSearch toolbar present in your HJT log. What browser do you see it in?

You didn't have any trojans, so you can omit #6.

Hi
thanks for your reply.
You miss understand me. I did not mean the download Temp Clean File was corrupt. I read your reply via my email and printed off the instructions. The first thing that it said was your computer is clean image http - i have just read your reply on the site and seen this refers to an advert with an image above the instructions you gave me. So it was my mistake. I thought the advert - did not see the image - was part of the instructions. Although it sounded strange. I ran everything as you instructed. and have downloaded WOT. I still am getting mywebsearch popping up as my internet browser when I press the desktop icon for the internet. I would like to get rid of this and get back to what I was using before - google.
Thanks

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:

netsvcs
%SYSTEMDRIVE%\*.exe
%systemroot%\system32\eventlog.dll
%systemroot%\system32\scecli.dll
%systemroot%\netlogon.dll
%systemroot%\system32\cngaudit.dll
%systemroot%\system32\sceclt.dll
%systemroot%\ntelogon.dll
%systemroot%\system32\logevent.dll

* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
  Since those are pretty big files, you can attach them, if you wish.

Hi
thanks for your reply
I have downloaded OTL on to my desktop. When I try to run it a message comes up reading. C:\Users\lydia\Desktop\OTL.exe is not a valid Win 32 application. it will not let me run the scan
Thanks

Download avz4.zip from here

• Unzip it to your desktop to a folder named avz4
• Double click on AVZ.exe to run it.
• Run an update by clicking the Auto Update button on the Right of the Log window:
• Click Start to begin the update

Note: If you recieve an error message, chose a different source, then click Start again

• After the update, from the "File" menu, choose "Standard Scripts"
• Put a check next to item 2: Advanced System Analysis
• Click Execute selected scripts
• At the next prompt, click the Yes button
• Let the scan run and click "OK" when the completion prompt pops up
• Now Close out of the Standard Scripts window, and exit AVZ
• Navigate to the avz4 folder and locate the folder LOG
• Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
• Attach the compressed file, virusinfo_syscheck.zip, to your next reply.

Hi
thanks for your reply. I cannot seem to open avz4.zip. it does not seem to want to run - instead i just unzip the files.
Thanks

it does not seem to want to run - instead i just unzip the files

I'm not sure, what you're saying...