Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Email Problems [CLOSED]


  • This topic is locked This topic is locked

#16
admin

admin

    Founder Geek

  • Administrator
  • 24,501 posts
Don't worry, some times removing spyware is like peeling an onion. One layer is removed, just to reveal another layer.

Reboot in safe mode (by tapping F8 at startup and select safe mode from the menu).

Please go offline, close all browsers and any open Windows, making sure that only HijackThis is open. Scan and when it finishes, put an X in the boxes, only next to these following items, then click fix checked.
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WTOOLSA.EXE
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\WSUP.EXE
C:\PROGRAM FILES\COMMON FILES\SLMSS\SLMSS.EXE
C:\WINDOWS\MWSVM.EXE
C:\WINDOWS\HMPQNIR.EXE
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.websearch...spx?tb_id=50028
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default-homep...rt.cgi?new-hklm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://server224.sma...earch/?new-hklm
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.websearch...spx?tb_id=50028
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.websearch...spx?tb_id=50028
R3 - URLSearchHook: (no name) - {707E6F76-9FFB-4920-A976-EA101271BC25} - C:\TV MEDIA\TvmBho.dll
O2 - BHO: DefaultSearch.SeekSeek - {5074851C-F67A-488E-A9C9-C244573F4068} - C:\WINDOWS\IEASST.DLL
O2 - BHO: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - C:\PROGRA~1\COMMON~1\WINTOOLS\WTOOLSB.DLL
O2 - BHO: (no name) - {7371F073-AC0F-4b80-BB2F-96A488CEFB32} - C:\PROGRAM FILES\XMOD\XM320.DLL
O4 - HKLM\..\Run: [slmss] C:\Program Files\Common Files\slmss\slmss.exe
O4 - HKLM\..\Run: [TV Media] C:\TV MEDIA\TVM.EXE
O4 - HKLM\..\Run: [Mwsvm] C:\WINDOWS\mwsvm.exe
O4 - HKLM\..\Run: [fash] C:\WINDOWS\fash.exe
O4 - HKLM\..\Run: [hmpqnir] C:\WINDOWS\hmpqnir.exe
O4 - HKLM\..\Run: [stcinstaller] c:\installer\id53.exe
O4 - HKLM\..\Run: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKLM\..\RunServices: [WinTools] C:\Program Files\Common files\WinTools\WToolsA.exe
O4 - HKCU\..\Run: [RealUpdater] C:\WINDOWS\SYSTEM\realupd.exe
O4 - HKCU\..\Run: [TV Media] C:\TV MEDIA\TVM.EXE
O8 - Extra context menu item: Web Savings - file://C:\Program Files\WebSavingsfromEbates\System\Temp\ebateswebsavings_script0.htm
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab
O16 - DPF: {26E8361F-BCE7-4F75-A347-98C88B418322} - http://download.webs..._50028/QDow.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {00000EF1-0786-4633-87C6-1AA7A44296DA} - http://www.addictive...ab/emCraft1.cab

Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\PROGRAM FILES\COMMON FILES\WINTOOLS\ <- this folder
C:\PROGRAM FILES\COMMON FILES\SLMSS\ <- this folder
C:\WINDOWS\MWSVM.EXE <- this file
C:\WINDOWS\HMPQNIR.EXE <- this file
C:\TV MEDIA\ <- this folder
C:\WINDOWS\fash.exe <- this file
c:\installer\ <- this folder
C:\WINDOWS\SYSTEM\realupd.exe <- this folder

Reboot your PC.

If you would please, rescan with HijackThis and post a fresh log, and let us know how your system's working. <_<
  • 0

Advertisements


#17
sdhaliwal

sdhaliwal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
sorry its taking so long, i just need to get my cousins to pring out the page of the things i need to get rid of because i dont feel like writing it by hand and ill probably have it done by tomorrow thanks!!
  • 0

#18
sdhaliwal

sdhaliwal

    Member

  • Topic Starter
  • Member
  • PipPip
  • 26 posts
Do I press F8 after the windows screen pops up or before? I tried both and it didn't work. Maybe i have to hold it down?

And what is the deal with safe mode? It always worries me when my computer goes into safe mode because i'm afraid something is wrong with it. Will I be able to get back to normal mode without a problem after fixing? <_< thanks
  • 0

#19
Smokey

Smokey

    Member 1K

  • Retired Staff
  • 1,423 posts
Safe mode is needed because all the junk doesn't load with Windows so you can fix you're problem without trouble. After you restart you will be automatically put into normal mode.

Restarting in safe mode:
1. Start Windows, or if it is running, shut Windows down, and then turn off the computer.
2. Restart the computer. The computer begins processing a set of instructions known as the Basic Input/Output System (BIOS). What is displayed depends on the BIOS manufacturer. Some computers display a progress bar that refers to the word BIOS, while others may not display any indication that this process is happening.
3. As soon as the BIOS has finished loading, begin tapping the F8 key on your keyboard. Continue to do so until the Windows Advanced Options menu appears.
4. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Using the arrow keys on the keyboard, scroll to and select the Safe mode menu item, and then press Enter.
5. Choose "Administrator" to proceed
6. On the dialog box that appears, choose "Yes" and then do as admin instructed.
  • 0

#20
admin

admin

    Founder Geek

  • Administrator
  • 24,501 posts
On some systems it works to enter safe mode by simply holding down the CTRL key--as soon as your computer starts.
  • 0

#21
Kat

Kat

    Retired

  • Retired Staff
  • 19,711 posts
  • MVP
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP