Hijackthis log....

[brian5534]

Having some problems with my computer.

Everytime i log on and off, INCD.exe has to be terminated with the End Process button. And everytime i turn my computer on, there is a message saying that my computer has "just recovered from a serious error". I send the message to micorsoft, and everytime it just says it is looking into the problem, and doesnt give any help on how to fix it.


So...if you guys can help me in anyway, it would be greatly appreciated

 

[Abraxas]

You should run a virus scanner, AdAware and such, but others can help you more with that part. INCD.exe seems to be part of Ahead, though and you'd just need to remove that Autostart entry, I guess. But I think I've seen more bad things (URL Search Hook missing for instance) and hopefully others can tell you everything about it.

However, about the sending-to-Microsoft thing...it's just an error report, it won't give you any instructions on how to fix this. It can tell them what applications you are running and how to get rid of certain bugs (or not).

 

[RealBlackStuff]

Go to this post here first, and follow the instructions EXACTLY, especially about UPDATING and HJT-location.
How to remove Begin2Search/Coolwebsearch and Other Nasties

While there, fix these as well:

C:\temp\msbb.exe
O4 - HKLM\..\Run: [msbb] c:\temp\msbb.exe

When you are finished, delete all contents of C:\temp

Then post a new log as an attachment.

 

[brian5534]

Updated Hijack This Log.....

OK, I did everything you said Realblackstuff....here's the most current Hijack This Log....

 

[RealBlackStuff]

Boot in Safe Mode.
Switch System restore OFF, see how here.
In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here.
Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:
MediaGateway.exe

Next, try to UNinstall anything to do with (not delete yet!):
C:\Program Files\Media Gateway\MediaGateway.exe

Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
...................................................................................................
C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O9 - Extra button: Help - {0660E1B2-82A0-46E7-BC66-8FBC5BD1DE23} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: ComcastHSI - {359E0976-EBCF-4D34-A284-AB4D926E20A5} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: (no name) - {869EE607-5376-486d-8DAC-EDC8E239AD5F} - (no file) (HKCU)
O9 - Extra button: Support - {EC206FBD-172A-4ADB-999B-0A59EBE6E9B7} - http://www.comcastsupport.com (file missing) (HKCU)
...................................................................................................
Now click on the Fix Checked button in HJT.

When done, from between the above dotted lines, delete the highlighted bold files.
When a \directory-name\ is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Delete all files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
Boot normal. When all OK, switch System Restore back on.