Hi there, I have been having problems with my PC and I think I have identified the culprit as the MyWay nasty. Spybot identifies it but cannot delete it, the item does not show up in the add/remove programs listing.
I have read the previous posts regarding this subject and have completed the advanced spybot search but cannot upload report as it's 70Kb.
Have just complete HijackThis scan and attach this report.
I have bought Norton 360 but cannot upload it, and the Norton removal tool just jams up/stalls. Norton Support were worse than useless and just kept pimping their expert consultant service for another £65. Figured someone with a bigger brain than me could help for a donation.
Any ideas on what to do next would be gratefully recieved. Many thanks
Hello dcasson
Welcome to Safer Networking.
Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
That said, All advice given by anyone volunteering here, is taken at your own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen.
It is advisable that you back up your personal data before starting any clean up procedure.
Please do not attach any logs or reports, just copy and paste them in.
Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.
R3 - URLSearchHook: {1A03F196-9617-4CA0-842B-A83CEECB022B} - - (no file)
O2 - BHO: mxlivemedia browser enhancer - {21D80113-3785-3C16-82D2-9A50966250C1} - C:\WINDOWS\system32\ohtmrccizcwpxtv.dll (file missing)
O2 - BHO: (no name) - {E2E25069-F9C3-42AE-A6CF-A94C786F20F9} - C:\WINDOWS\System32\docproph2.dll (file missing)
O3 - Toolbar: (no name) - {7CC4630A-A0DD-4DB2-A2B3-485A4F5B2923} - (no file)
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Msdmxm] c:\windows\system32\msdmxm.exe /noconnect
O4 - HKUS\S-1-5-18\..\Run: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [] (User 'Default user')
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZZ
Please download ATF Cleaner (http://www.atribune.org/ccount/click.php?id=1) by Atribune to your desktop.
This program is for XP and Windows 2000 only
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.
Please download Malwarebytes' Anti-Malware from Here (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) or Here (http://www.besttechie.net/tools/mbam-setup.exe)
Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.<-- Don't forget this
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and Paste the entire report in your next reply along with a New Hijackthis log.