HiJackThis Log

[DazzaStark]

Here's My HiJackThis Log, Please give any suggestions. Thanks!

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and have your computer scanned.

Then, go and read both these threads by RBS. Follow all the instructions exactly.

How to remove Trojans and its ilk! and How to remove Begin2search / coolwebsearch and other nasties.

Only after doing the above. Post a fresh HJT log. Thanks.

Regards Howard :wave: :wave:

 

[DazzaStark]

Done Here's My Latest Log. Thanks. Anything Else?

 

[howard_hopkinso]

Boot into safe mode. See how HERE

Turn off system restore. See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Go to add remove programmes in your control panel, and uninstall anything to do with(if there).

C:\Program Files\winsupdater

Close control panel.

Open your task manager, by pressing the ctrl/alt/delete keys together.

Click on the processes tab, and select, and end process for(if there).

winsupdater.exe

Close task manager.

Run HJT with no other programmes open, and have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto

Fix all 016 DPF entries.

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)

Now click the fix checked button.

Close HJT.

Locate, and delete the following bold files(if there).

C:\Program Files\winsupdater\winsupdater.exe /auto

Click start/run, and type services.msc into the run box, and press the enter key.

When the window appears, maximise it, and locate the above 023 service.

Double click on it, and if it`s running, select stop. Set the startup type to disabled. Click apply/ok.

Reboot into normal mode, and turn system restore back on.

Regards Howard