[admin]

Forgot we have it too

Try this link
http://www.geekstogo...=download&id=16

[Advertisements]

it said no version of application found to unistall.....

[gbrl77]

it said no version of application found to unistall.....

[admin]

Doesn't always work

Try this:
Download: http://www.downloads...g/VX2Finder.exe

1.) Delete all files found (VX2Finder will "End Task" on up to 2 instances of Rundll32.exe automatically)
You will get a message about "cannot delete this one" matching the same name in the Guardian Key.

2.) Click "Open regedit" will take you right to the Guardian Key (no need to search for it)

Hilite "Guardian", RightClick and choose
Security/permissions, you'll get another
window with 'advanced'..
DE-select (uncheck) the lower box with
"inheritable permissions"
hit 'ok' and 'remove' on the following security prompts.

Restart computer.

3.) On restart use VX2Finder again, select + delete the last file, click "User Agent$" will remove that entry from the registry.

4.) Click "Open regedit" again, this time restoring the checkmark in "inheritable permissions"

5.) Click "Guardian.reg" Deletes the Guardian Key.

6. Use Find again should produce a clean log of blank values.

7.) Click "Restore Policy" to restore the Debug policy altered in the look2Me installation.(requires reboot to apply, but not immediatley neccessary)

[gbrl77]

This is all I get when I click the Click to find VX2.BetterInternet Button:

Log for VX2.BetterInternet File Finder

Files Found---


Guardian Key--- is called:

User Agent String---

[admin]

We must be missing something... I'll take another look at it tomorrow.

[gbrl77]

OK no Problem......Thanks for all the Help....

[admin]

It has all the markings of a VX2.BetterInternet infection. May be a new strain not detected by this removal tool. These fixes are still a work in progress by the experts.

Let's try running the latest CWShredder in safe mode:
First download this file to your desktop.
http://209.133.47.12.../CWShredder.exe

Next, reboot in safe mode (by tapping F8 at startup and select safe mode from the menu), and run the file.

[gbrl77]

Nothing was found.....Also does it normally take 2-3 Minutes for windows to shut down? And also I have a D: partition incase you didn't notice........And the problem is there....

[gbrl77]

I meant the problem could be in the D: Partition....

[gbrl77]

I was just looking around at some files on my computer and I noticed that it Start up there is an unregonized file for Winlogin.exe and it's odd because as sson as something goes in there I always delete it so I think that might be the problem just wondering what you think........Thanks Again

[gbrl77]

Also there are some programs and files I'm not to familiar with......
Collector's Edition 251
Raptor Special Edition
Wildtangent Multiplayer
Microsoft .NET Framework 1.1
Viewport Media Player
Wildtangent.jar

Just Wondering...Thanks

[admin]

Ah! You're good. We've found it!

This is a brand new CoolWebSearch infection. CWShredder hasn't been updated to fix it yet, and I kept missing it (looks like the legit winlogon.exe)

O4 - Global Startup: winlogin.exe

Let's try CTRL+ALT+Delete, in the task manager find winlogin.exe, select it and "End Process".

Next restart Hijack This and fix this entry:
O4 - Global Startup: winlogin.exe

Search for and delete this file:
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\winlogin.exe

[gbrl77]

Looks like that did it...Thanks so much for all of the help.....

[admin]

Congratulations!

How do you prevent spyware from being installed again? We strongly recommend installing SpywareBlaster (it's free for personal use).

Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted pests.
Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox.
Restrict the actions of potentially dangerous sites in Internet Explorer.
Consumes no system resources.

Download, run, check for updates, download updates, select all, protect against checked. All done. Check for updates every couple of weeks. If you have any errors running the program like a missing file see the link at the bottom of the javacool page.
Link to SpywareBlaster: http://www.geekstogo...tion=show&id=12

It's also very important to keep your system up to date to avoid unnecessary security risks. Click Here to make sure that you have the latest patches for Windows.

It's okay to delete the Hijack This folder if everything is working okay.

[Kat]

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.