|
On with the show...
I don't know if this little jewel came courtesey of your ISP, or some other source. It's really not a good thing:
D:\PROGRA~1\NETASS~1\SMARTB~1\MotiveSB.exe
BroadJump - Newer name for BroadJump Foundation Client (BJCFD) from BroadJump.com, now Motive. The software collects information on your Internet activity and sends it to your ISP so that your ISP can serve you advertisements related to the type of sites you visit. I would ask your ISP on how to remove it and why they installed it in the first place. Please do not uninstall the program, since it looks like it is required for your internet connection. This especially applies to those who use SBC as their ISP (Internet Service Provider). If they can't/won't resolve this problem for you, then it's time to switch to another provider that don't embed this spyware in their program. You will most likely also have Support.com installed. The same situation applies here also. Try to find out how to remove it from your ISP. Don't uninstall it yourself.
------------------------------------------------------------------------
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are following the procedures below.
Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that Display the contents of System Folders' is checked. Windows XP's search feature is a little different. When you click on 'All files and folders' on the left pane, click on the 'More advanced options' at the bottom. Make sure that Search system folders, Search hidden files and folders, and Search subfolders are checked.
Reboot into Safe Mode (hit F8 key until menu shows up).
Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):
svcchosts.exe <- Do not confuse this with svchost.exe, as that is a necessary program.
cnstat.exe
wssdsfgsd.exe
lbfvdu.exe
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
D:\WINDOWS\System32\svcchosts.exe
D:\WINDOWS\System32\cnstat.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Start Uppings] svcchosts.exe
O4 - HKLM\..\Run: [LOLss] wssdsfgsd.exe
O4 - HKLM\..\Run: [Windows Compliant] lbfvdu.exe
O4 - HKLM\..\Run: [System Failure Statistic] cnstat.exe
O4 - HKLM\..\RunServices: [Start Uppings] svcchosts.exe
O4 - HKLM\..\RunServices: [LOLss] wssdsfgsd.exe
O4 - HKLM\..\RunServices: [Windows Compliant] lbfvdu.exe
Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:
D:\WINDOWS\System32\svcchosts.exe
D:\WINDOWS\System32\cnstat.exe
wssdsfgsd.exe
lbfvdu.exe
Reboot into Normal Mode and post a new HijackThis log file so we can make sure it's clean.
|