View Single Post
Old 01-25-2008, 03:00 PM   #6 (permalink)
Glaswegian
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
 
Glaswegian's Avatar
 
Join Date: Sep 2005
Location: Glasgow
Posts: 25,153
OS: Win XP Pro SP3 / Win 7 Pro

My System

Blog Entries: 10
Re: I have a Dowloader virus with lots of popups - please help

Hi again

Looking good.


Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Clear out Norton's Quarantine folder. If you're unsure on how to do it, you can use Symantec's guide.



Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any)

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O21 - SSODL: bmlvqkn - {6491FFDC-6DAA-491F-9A9A-BFFC157E50F6} - C:\WINDOWS\bmlvqkn.dll (file missing)
O21 - SSODL: agrlmvp - {013221D6-8DFD-4843-A023-EB356DA3115A} - C:\WINDOWS\agrlmvp.dll (file missing)


Please remember to close all other windows, including browsers then click Fix checked.


Delete the following File indicated in RED if it still exists.

C:\WINDOWS\system32\drivers\etc\1.hosts

Note: If it proves to be stubborn, you may have to boot to Safe Mode to delete it.


Post back with a fresh HijackThis Log.
__________________
Iain - Defender of the Haggis and all things Scottish.
I don't help by PM - post in the Forums.



PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner
Glaswegian is offline