Greetings!
When we're done cleaning off your system, i'd
recommend that you install all the
critical windows updates available from
Microsoft, upto
service pack 1. This will help to make your system more secure and prevent many '
problems' from reoccuring in the future.
===============
Go to
www.trendmicro.com, and then:
1. Click "
Free Online Scan".
2. Click "
Scan now, it's free".
It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:
1. Select all available drives.
2. Check(tick) "
Auto Clean".
3. Click "
Scan".
When it completes, post back the full filename of any files that cannot be cleaned or deleted.
===============
Download, unzip to your desktop
CWShredder and run it, then:
1. Click "
Check For Update"
(
If an update isn't available, skip to step #4.)
2. Click "
Click here to Download the upate".
3. When the new version has been downloaded, click "
Save".
4. Click "
Fix ->"
===============
Let's look for, and delete, any program segments(
prefetches) that might be present, and are associated with the '
problems' we're trying to remove from this system. To do this, let's:
1) Click "
Start | Search", then search for each of these program's
base name(s), in all files and folders:
CxtPls.exe*
2) Then if any are found in the '
prefetch' folder, delete them.
Look closely, since the '
base' name will have a bunch of random numbers and letters attached to it.
===============
Go to
Add/Remove programs and remove(uninstall) the following, if present:
EZula Toptext
SEP
Web Related
The above could appear anywhere within the entry. Be careful not to remove any
personal or
system software.
===============
Run
HiJackThis then:
1. Click "
Config..."
2. Click "
Misc Tools"
3. Click "
Open Process manager"
-
Next, while holding down the
CTRL key, locate (
if present) and click on (
highlight) each of the following:
C:\PROGRA~1\ezula\mmod.exe
C:\Program Files\CxtPls\CxtPls.exe
Now double-check and make sure that only those item(s) above are highlighted, then click "
Kill process". Now, click "
Refresh", check again, and repeat this step if any remain.
===============
Now, let's open a
command prompt and unregister the dll(s) we're going to remove, by entering the following:
regsvr32 /u cxtpls.dll
regsvr32 /u sep.dll
regsvr32 /u esyn.dll
It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save on the typing.
===============
Run
HiJackThis and click "
Scan", then check(tick) the following, if present:
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} - C:\Program Files\CxtPls\cxtpls.dll
O2 - BHO: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O2 - BHO: Band Class - {CC378B83-9577-44D0-B4F8-0DD965E176FC} - C:\Program Files\eSyndicate\esyn.dll
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\Program Files\SEP\sep.dll
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - Global Startup: KODAK Picture Transfer Software.lnk = ?
O4 - Global Startup: PayPal Plug-In for Outlook Express.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {FF65677A-8977-48CA-916A-DFF81B037DF3} (WMService Class) - http://download.overpro.com/WildAppNonUS.cab
Now, with all windows closed except
HiJackThis, click "
Fix checked".
===============
Locate and
delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
folders...
C:\PROGRA~1\ezula
C:\Program Files\CxtPls
C:\Program Files\SEP
C:\Program Files\eSyndicate
-
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're '
in use', try deleting them from "
Safe Mode".
===============
Post back a new log, and let me know how everything goes.