tetonbob

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

---------------------------------------------------------------------------------------------

Download HostsXpert.

• Unzip HostsXpert to it's own folder.
• Run HostsXpert.exe
• Click "Make Writable?" in the upper left corner.
• Click "Restore MS Hosts file" and then click OK.
• Close HostsXpert.
• Note: If a custom Hosts file was in place, you'll have to edit those entries back in.

---------------------------------------------------------------------------------------------

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

• We'll use this later.
  
  ---------------------------------------------------------------------------------------------
  
  Run a scan in HijackThis. Check each of the following and hit 'Fix checked' if they still exist (make sure not to miss any):
  
  O4 - HKCU\..\Run: [Start Bows] C:\DOCUME~1\Owner\APPLIC~1\LOVECO~1\BORESENDPOP.exe
  O4 - HKUS\S-1-5-21-551621690-1833427598-2558029555-1003\..\Run: [Start Bows] C:\DOCUME~1\Owner\APPLIC~1\LOVECO~1\BORESENDPOP.exe (User '?')
  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
  
  
  Close HijackThis now.
  
  ---------------------------------------------------------------------------------------------
  
  Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.
  
  ---------------------------------------------------------------------------------------------
  
  
  Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
  
  CiD Help
  
  Ignore any prompts to reboot at this time.
  
  ---------------------------------------------------------------------------------------------
  
  
  Go to My Computer->Tools->Folder Options->View tab:
  * Under the Hidden files and folders heading, select Show hidden files and folders.
  * Uncheck the Hide protected operating system files (recommended) option.
  * Also make sure there is no checkmark beside Hide file extensions for known file types
  * Click Yes to confirm and then click OK.
  
  ---------------------------------------------------------------------------------------------
  
  Click on the Start button & select Run
  Type in tasks & click Ok
  In the ensuing window, click on the 'Advanced' menu (located above) & select 'View Hidden Tasks'
  Review all the tasks/jobs at hand. You should be able to recognise jobs that you have created yourself.
  
  Delete this task:
  
  C:\WINDOWS\Tasks\E7FD1672A9E68DAE.job
  
  --------------------------------------------------------------------------------------
  
  Delete the following folders:
  
  
  C:\Program Files\Love cool meta
  C:\Documents and Settings\All Users\Application Data\great coal love default
  C:\Documents and Settings\Owner\Application Data\Love cool meta
  
  ---------------------------------------------------------------------------------------------
  
  Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

---------------------------------------------------------------------------------------------

Restart in normal mode.

---------------------------------------------------------------------------------------------

Download fl.zip
Extract the contents to a new folder on your Desktop.
Within the folder, locate & double-click fl.bat.
It should produce a report at c:\findlop.txt. Post the contents of the report in your next reply

---------------------------------------------------------------------------------------------

Run a new HijackThis scan. Save the log file and post it here.

---------------------------------------------------------------------------------------------

Please return with logs from:

findlop.txt
HJT