Ok..lets try this...
Download
KillBox http://www.bleepingcomputer.com/file...re/KillBox.zip
Open IE..internet options..and delete temp internet files and your cookies.
Reboot into Safe Mode (hit F8 key until menu shows up). Make sure to close any open browsers. Open add/remove programs and remove
MessengerPlus! 3
Run hijackthis and fix the following....
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
Run KILL box. Paste the following locations into KILL BOX one at a time. Checkmark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say
YES and when the next box opens prompting you to reboot now...click
NO...and proceed with the next file. Once you get to the last one click
YES and it will reboot.
C:\WINDOWS\system32\mfc71.pdb
C:\WINDOWS\system32\MFC71d.pdb
C:\WINDOWS\system32\mfc71u.pdb
C:\WINDOWS\system32\mfc71ud.pdb
C:\WINDOWS\Ejoatzllzk.gzg
C:\WINDOWS\Jknciglp.edp
C:\WINDOWS\Nljgtct.vvo
C:\WINDOWS\Nlwxicgipjv
C:\WINDOWS\system32\atl71.pdb
Once rebooted..post the log from the following tool and let me know if your still getting those ads.
Please empty any Quarantine folder in your antivirus, empty your recycle bin and purge/delete all recovery items in the spybot program if you use it…BEFORE!!! running this tool.
Download this virus checker and tool from eScan
Mwav.exe (Use Link 3)
1. Save it to a folder.
2. Reboot into safe mode
3. Double click the
Mwav.exe file.
(This is a stand alone tool and NOT just a virus checker......so it won't install anything)
4. Select
all local drives, scan
all files, press
SCAN and when it is completed, anything found will be displayed in the lower pane.
5. In the
Virus Log Information Pane (Bottom Window)
Left click and
Highlight all the info in the Lower pane--- Use
"CTRL C" on your Keyboard to copy all found in the lower pane and save it to a notepad file.
DO NOT post the log from the “View Log” button as that log does NOT contain the info we are after.
*Note* If prompted that a Virus was found and you need to purchase the product to remove the malware, just close out the prompt and let it continue scanning.
We are not going to use this to remove anything..but to ID the bad guys.
Once you copy that to a notepad file...highlight the text and copy it here