Help!!!MSN VIRUS!!

• ndmmxiaomayi

  1 Feb 07, 23:12

  Basically, most antivirus and firewall will die the minute you open this virus.
  
  I wonder if this works. http://www.mwti.net/download/tools/mwav.exe
  
  Download and save it.
  
  Then run it.
  
  Put a tick against these boxes:
  
  * Memory
  * Startup Folders
  * Drive - All Local Drives
  * Folder - then click "browse" to change the directory to C: (default is C:\Windows)
  * Registry
  * System Folders
  * Services
  * Include Sub-Directory
  * Scan All Files
  
  Then click on Scan and Clean. Just before scanning, click on Update to update it.
  
  NOTE: Sometimes mwav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.
  
  On the bottom portion of the window, you will see the lower panel where MWav is listing "infected items", please highlight everything in that lower panel and copy them by holding CTRL + C then paste it here. The whole log will be extremely BIG so there is no way to post the log. I just need the infected items list.
• spawnoflight

  1 Feb 07, 23:12

  Die ar just now I click the link but never open.I got gonna nt?
• ndmmxiaomayi

  1 Feb 07, 23:13

  Originally posted by KamenRider:

  get a Mac. ZERO virus and still counting.

  No virus because Windows is popular. If Mac has 99% of the PC users using it, you see got virus or not.
• rocky_509

  1 Feb 07, 23:14

  Originally posted by FBI:

  u can click but when it prompt u to download, jus don do it

  Yeah my NOD32 detects got links trojan on it.Then deletes.Wah meaning got bonus 2 viruses at same time.Cool.Something like V.B.O trojan sia..
• ndmmxiaomayi

  1 Feb 07, 23:14

  Originally posted by spawnoflight:

  Die ar just now I click the link but never open.I got gonna nt?

  No guarantee. In any case, just scan with antivirus and antispyware to be sure.
  
  If by any chance your antivirus and antispyware won't run, you know you got it.
• Agenda

  1 Feb 07, 23:22

  i have my own virus..
  
  rofl @ you, http://www.youfail.org
  
  or www.smokingfails.org
  
  
• rocky_509

  1 Feb 07, 23:24

  Originally posted by Agenda:

  i have my own virus..
  
  rofl @ you, http://www.youfail.org
  
  or www.smokingfails.org
  
  

  Hehe
  You fail life and everything.
• spawnoflight

  1 Feb 07, 23:34

  Originally posted by ndmmxiaomayi:

  No guarantee. In any case, just scan with antivirus and antispyware to be sure.
  
  If by any chance your antivirus and antispyware won't run, you know you got it.

  Thanks alot.I think I am fine.Avg still running as per norm.
• SIMpLiFy

  2 Feb 07, 06:30

  anyone knows what does this virus does besides sending the virus to ur msn contacts??and which antivirus/spyware should i download to scan?
• ndmmxiaomayi

  2 Feb 07, 07:42

  Originally posted by SIMpLiFy:

  anyone knows what does this virus does besides sending the virus to ur msn contacts??and which antivirus/spyware should i download to scan?

  Can I say almost all antivirus and antispyware won't work? I've posted a solution. First post of this page.
• OasisBlue

  2 Feb 07, 17:58

  Originally posted by FBI:

  haha why so kum lan go and download

  i said i didnt in the previous reply
• nuttawood1990

  2 Feb 07, 17:59

  i just fixed it..WOoohoo..........
• missqi

  2 Feb 07, 18:02

  i tried prevx, avg, and trojanhunter, and it still refuses to go away.
  i cannot provide my HJT log because it auto shuts down my HijackThis.
  
  Someone help me....
  mayi: i used the mwav, it deleted ALL my virusus except the trojan(s).
  I have pstord.exe and the msn virus thing.
  
• SIMpLiFy

  2 Feb 07, 20:59

  Originally posted by missqi:

  i tried prevx, avg, and trojanhunter, and it still refuses to go away.
  i cannot provide my HJT log because it auto shuts down my HijackThis.
  
  Someone help me....
  mayi: i used the mwav, it deleted ALL my virusus except the trojan(s).
  I have pstord.exe and the msn virus thing.
  

  same ...same..
• bryanseb

  2 Feb 07, 21:03

  If dun click download or sth, just press th 'x' to close can right?
• SexyChin

  2 Feb 07, 21:05

  Get a better antivirus software, such as nod32.
• ndmmxiaomayi

  2 Feb 07, 21:35

  Originally posted by missqi:

  i tried prevx, avg, and trojanhunter, and it still refuses to go away.
  i cannot provide my HJT log because it auto shuts down my HijackThis.
  
  Someone help me....
  mayi: i used the mwav, it deleted ALL my virusus except the trojan(s).
  I have pstord.exe and the msn virus thing.
  

  Postcard.exe ?
  
  Delete that postcard.exe file.
  
  See if you can get this to run.
  
  IBProcman
  
  Once you download it, unzip it, double click to run it.
  
  Click on the diskette button to save a log file.
• ndmmxiaomayi

  2 Feb 07, 21:35

  Originally posted by SIMpLiFy:

  same ...same..

  Could you get HijackThis to run?
• lpx88

  2 Feb 07, 21:46

  Originally posted by missqi:

  i tried prevx, avg, and trojanhunter, and it still refuses to go away.
  i cannot provide my HJT log because it auto shuts down my HijackThis.
  
  Someone help me....
  mayi: i used the mwav, it deleted ALL my virusus except the trojan(s).
  I have pstord.exe and the msn virus thing.
  

  try using those in safe mode liao?
• serra

  2 Feb 07, 23:43

  Originally posted by ndmmxiaomayi:

  Basically, most antivirus and firewall will die the minute you open this virus.
  
  I wonder if this works. http://www.mwti.net/download/tools/mwav.exe
  
  Download and save it.
  
  Then run it.
  
  Put a tick against these boxes:
  
  * Memory
  * Startup Folders
  * Drive - All Local Drives
  * Folder - then click "browse" to change the directory to C: (default is C:\Windows)
  * Registry
  * System Folders
  * Services
  * Include Sub-Directory
  * Scan All Files
  
  Then click on Scan and Clean. Just before scanning, click on Update to update it.
  
  NOTE: Sometimes mwav will pause and it appears to be finished, but it isn't done. Just let it run until it says it's complete.
  
  On the bottom portion of the window, you will see the lower panel where MWav is listing "infected items", please highlight everything in that lower panel and copy them by holding CTRL + C then paste it here. The whole log will be extremely BIG so there is no way to post the log. I just need the infected items list.

  Hello, i did the scan. and i have the results.
  Here :
  Object "grokster Spyware/Adware" found in File System! Action Taken: Entries Removed.
  Object "downloader-ak Trojan-Downloader" found in File System! Action Taken: Entries Removed.
  Object "roings Spyware/Adware" found in File System! Action Taken: Entries Removed.
  Object "winfixer/errorsafe Adware" found in File System! Action Taken: Entries Removed.
  Object "abetterinternet Spyware/Adware" found in File System! Action Taken: Entries Removed.
  Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: Entries Removed.
  Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: Entries Removed.
  Object "whenu.savenow Spyware/Adware" found in File System! Action Taken: Entries Removed.
  Object "winfixer/errorsafe Adware" found in File System! Action Taken: Entries Removed.
  Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: Entries Removed.
  Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: Entries Removed.
  Entry "HKCR\DirectAnimation.PathControl" refers to invalid object "{D7A7D7C3-D47F-11D0-89D3-00A0C90833E6}". Action Taken: Entries Removed.
  Entry "HKCR\DirectAnimation.Sequence" refers to invalid object "{4F241DB1-EE9F-11D0-9824-006097C99E51}". Action Taken: Entries Removed.
  Entry "HKCR\DirectAnimation.SequencerControl" refers to invalid object "{B0A6BAE2-AAF0-11D0-A152-00A0C908DB96}". Action Taken: Entries Removed.
  Entry "HKCR\DirectAnimation.SpriteControl" refers to invalid object "{FD179533-D86E-11D0-89D6-00A0C90833E6}". Action Taken: Entries Removed.
  Entry "HKCR\DirectAnimation.StructuredGraphicsControl" refers to invalid object "{369303C2-D7AC-11D0-89D5-00A0C90833E6}". Action Taken: Entries Removed.
  Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: Entries Removed.
  Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: Entries Removed.
  Entry "HKCR\Microsoft.sqlwep.3" refers to invalid object "{E327539B-D87A-2B9B-AEE5-CC6D528A7C40}". Action Taken: Entries Removed.
  Entry "HKCR\MyWebSearch.PseudoTransparentPlugin" refers to invalid object "{7473D294-B7BB-4f24-AE82-7E2CE94BB6A9}". Action Taken: Entries Removed.
  Entry "HKCR\SharePoint.WebPartPage.Document" refers to invalid object "{388ED91D-7FD2-11D0-A60B-00A0C90A43FF}". Action Taken: Entries Removed.
  Entry "HKCR\SharePoint.WebPartPage.Document.1.0" refers to invalid object "{388ED91D-7FD2-11D0-A60B-00A0C90A43FF}". Action Taken: Entries Removed.
  Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: Entries Removed.
  Entry "HKCR\VisualStudio.VSPolicyExtenderProvider.8.0" refers to invalid object "{2AA841FA-72CF-493d-BD95-81E46540BEC8}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\popcaploader.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\system32\objsafe.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\DIMM.DLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\System.Windows.Forms.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\System.EnterpriseServices.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Microsoft.JScript.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Microsoft.Vsa.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\System.Drawing.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscoree.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscorlib.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\System.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\Microsoft.Vsa.Vb.CodeDOMProcessor.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1028\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1031\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1034\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1036\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1040\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1041\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1042\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1043\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1046\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\1053\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "c:\Program Files\Common Files\System\Ole Db\Resources\2052\MSOLAP80.RLL". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\FileCDDefault\resFileCD.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\Default\resCdmkr.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\JCMDefault\resJCMkr.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\DFDefault\resNDVD9To5.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\popcaploader.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\objsafe.tlb". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\DOCUME~1\61939\LOCALS~1\Temp\_ISTMP1.DIR\_ISTMP0.DIR\FileGrp\Msvcrt10.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller98.exe". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\system32\pxwma.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.exe". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\iPodService.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\da.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\de.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\en.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\es.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\fi.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\fr.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\it.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\ja.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\ko.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\nb.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\nl.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\ru.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\sv.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\zh_CN.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\iPod\bin\iPodService.Resources\zh_TW.lproj\iPodServiceLocalized.dll". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Documents and Settings\darren_soh\Local Settings\Application Data\Microsoft\OFFICE\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\FileCDDefault\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\Default\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\JCMDefault\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\WEDefault\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\DFDefault\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\NewTech Infosystems\NTI Backup NOW! 4\Default\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Acer\Empowering Technology\ePerformance\Resources.Notebook\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Acer\Empowering Technology\ePerformance\Resources.Desktop\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Acer\Empowering Technology\eLock\Resources.Notebook\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Acer\Empowering Technology\eLock\Resources.Desktop\". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\Folders" refers to invalid object "C:\Program Files\Common Files\Teleca Shared\". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".1148374702235". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".amv". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".mol". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".nth". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".php". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object ".wba". Action Taken: Entries Removed.
  Entry "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts" refers to invalid object "OpenWithList". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "60A5FC6E548B5906438A6A163A886BAF2BE75AA9". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "9A2CB3F3-D3E1-425F-993F-EAA4B198F2D1". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "eMusic Promotion". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB885453". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB887472". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB893357". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB898461". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "KB912475". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Tiger System Preferences v2". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "Windows Live Safety Scanner". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{02BE569D-7BBD-4451-A955-C0CDFB0695F1}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{1807A881-57A4-4791-8F21-7485F785A1E1}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{191BB17D-7BB4-43E9-8C98-7A981EF8AA43}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{1B128158-3BFE-4971-AA27-AF61C7C5012F}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{2AFBAC85-8F32-4EDB-AF56-D68239DAFF7D}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{2B257128-0B59-4A88-AFDF-BE12E5F5B9A0}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{2B257128-0B59-4A88-AFDF-BE12E5F5B9A1}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{3D77346B-06FB-4B20-8EF6-DAD346F359C3}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{48FFD824-B28F-46C6-A3D4-7560BEF48550}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{52F34B4D-32E3-4065-9869-74F96B1AFA23}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{536F7C74-844B-4683-B0C5-EA39E19A6FE3}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{5482BBD9-1042-4385-8662-74AF4616856C}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{55FA89BD-21D3-42F7-9249-C94C0094A83C}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{5A055969-A4BA-4FE9-AE47-5FBDC8B4CB48}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{633372EE-FB01-48AC-A986-5CB03E56A53D}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{6A39CB92-E333-41D5-872F-BAD00FB42013}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{6B43F751-D211-4882-9B35-5C5BD05BE0B1}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7884F09C-F871-4489-9CD2-24CF2954A095}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{78A2EB09-1741-4C3E-A555-471462EC2A84}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{78FA2B9A-A348-44D6-9A44-71EF400F35DA}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{7A837109-E671-470D-B489-F1EBE471D220}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{80CEE4D4-1AAA-41B1-BEFC-6E22E04E0267}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{81CFF79E-04E6-41BC-B4FA-D2FF4DE58A15}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{871AEDDF-9E12-41A9-91A3-E5AB678A81D7}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{89375062-B649-4FEF-B972-3024F1F325CE}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{89A344E4-A54B-4C5E-97BD-040B4B300324}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{99747F0D-D4F8-4877-9CA0-4AE96D963633}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{AA0FEBC9-3E9A-46DE-B264-CD59B180DDD4}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{AEB9948B-4FF2-47C9-990E-47014492A0FE}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B6022393-1C08-4F1D-8530-BFF51A481C27}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B6F867E8-F092-4C5E-7D72-AC7057DBEF45}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B802CFA4-B4C8-4959-84D0-5FE9BA57DAED}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{B901999B-27BF-46D1-8F53-5497FC957F29}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{BBE92E80-4331-4DD8-A05C-8856B50B4AA8}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{BC46B93E-995A-430A-BF3A-0AF4B02C0B0D}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{C11E39B9-B92F-4D47-9073-365022954233}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{C6F1E87D-F3E1-4874-97EC-F87DAB6D6878}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{CB5C177A-7FDB-45E9-AC22-0D8BF529AE57}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{CF582A67-98CD-44A9-83AF-A9DC8BCE683F}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{D08B83BB-C13A-40A8-9BBC-6C581AFCAB2C}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{D77FA095-7E20-4632-ACA0-83E28ECFDD03}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{DC69D2DF-E5EA-40CA-A67B-CF8277F79E02}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{DD0CF6CB-ADBC-4062-B30C-D53B21A83AFB}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{FDDDDF2C-BCA9-4286-9C14-81298C589237}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{FE9126DB-5F84-495A-BB46-3C724F1C2D08}". Action Taken: Entries Removed.
  Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache" refers to invalid object "{FFB59000-EB47-45BC-842A-EFFBDA635C94}". Action Taken: Entries Removed.
  File C:\Documents and Settings\61939\Local Settings\Temporary Internet Files\Content.IE5\B30GGI4D\popup[2].htm infected by "Trojan-Clicker.HTML.Agent.a" Virus! Action Taken: File Deleted.
  File C:\Documents and Settings\61939\Local Settings\Temporary Internet Files\Content.IE5\IR0VVMR7\beautiful-lunacy.blogspot[1].htm infected by "Trojan.JS.Cardst" Virus! Action Taken: File Deleted.
  File C:\Documents and Settings\61939\Local Settings\Temporary Internet Files\Content.IE5\IR0VVMR7\popup[1].htm infected by "Trojan-Clicker.HTML.Agent.a" Virus! Action Taken: File Deleted.
  File C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\SJMHSNCF\popup[1].htm infected by "Trojan-Clicker.HTML.Agent.a" Virus! Action Taken: File Deleted.
• ndmmxiaomayi

  2 Feb 07, 23:57

  serra, you got other malwares.
  
  Download SmitFraudFix and save it to somewhere convenient.
  
  Double click to run it.
  
  Next, press any key to proceed.
  
  After that, press 1 and hit the Enter key.
  
  It will start scanning. Once it's done, you will find a log file called rapport.txt at C: drive or C:\rapport.txt
  ________________________________
  
  Download HijackThis and save it to somewhere convenient.
  
  Right click on HijackThis and select rename. Type in dumb or any other name you like.
  
  Double click to run HijackThis. Select Do a system scan and save a log file.
  
  Post the rapport.txt and HijackThis log back.
• kawasaki2

  4 Feb 07, 14:15

  Depending on the Instant Messaging program you are using, I believe there is an option somewhere in the program which allows you to disallow links in conversation windows.
  
  As a preventive measure, do not click on links within conversation windows to avoid getting infected.
  
  There is no need for your antivirus programs to alert you if are careful enough..
• ndmmxiaomayi

  4 Feb 07, 15:37

  Yes, you are right about the disabling of links in certain messengers. This feature is present in WLM (not too sure for previous versions).
  
  However, the need of antivirus is another issue. While common sense is what you need, an antivirus serves as an extra layer of protection.
  
  Protection programs on computers work the same way as vaccination does.
  
  The antivirus signatures recognize something, just as your body immune system recognizes a particular strain of bacteria/virus and launches an attack against it.
  
  Not all of us are doctors, neither are all of us PC experts. Since neither of us are good at everything, that's where these extra products come in to protect us.
• ndmmxiaomayi

  7 Feb 07, 15:54

  Download MSNRemVir from either of these links:
  
  http://downloads.malwareremoval.com/MsnVirRem.exe
  
  http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item9
  
  Save it somewhere and double click to run.
  
  When it opens, click on Search and Destroy.
  
  If you are infected, it asks you to reboot. Follow the prompts.
  
  After rebooting, Notepad will open. If it doesn't just double click to run it again.
  
  Paste the contents of Notepad here...
  
  If by any chance you can't download, please do the following:
  
  Please download HostsXpert if you are having problems downloading the tools provided here.
  
  Extract it as per the instructions on page 4.
  
  Double click on HostsXpert.exe to run it.
  
  On your right hand side, you should see a section called Backup and Restore.
  
  Click on the Restore Microsoft's Hosts File button.
  
  Here's a screenshot (look at the brown box)
  
  
  
  Then try downloading the tools again.
  
  If you can't download HostsXpert, let me know also. The rest of the tools won't go public.
• monster2357

  7 Feb 07, 22:04

  just use active virus shield and put its setting to the highest and give it a scan(takes a few hours) then u can delete it when it prompts u...