you need to update HiJAckthis and then post a new log

was this marked as solved?

okay glad we could help... umm if this is truly solved than it needs to be marked as solved.....

well let us know if you get your hands on her computer or not...... hope we can help you further

your welcome....

it looks clean to me but you never know......

crunchie might have more for you to do too....
are you still having any problems????

if you dont have CCleaner you can get it from the link in my signature

you can get spybot S&D from www.filehippo.com and you can also use filehippo.com to check on newer versions or to try out...

you just click our "add to overwhelmed/gerbil's reputation and you can leave a comment in there too

you should remove that entry also and check your add/remove programs and see if you see anything that shouldnt be there.....

what does your cousin have on the computer because you can do a system recovery without losing music or pictures

and then you are gonna have to do a new scan and post a new HiJackThis logfile here. DO NOT EDIT THE LOGFILE IN ANY WAY WHEN YOU POST IT!!!

when you do a system scan with HijackThis you can select those entries and then click FIX SELECTED

remove this too
R3 - Default URLSearchHook is missing

also make sure she has all of the necessary updates from windows and microsoft

download CCleaner from the link in my signature, that has a registry cleaner in it.

and download AVG anti spyware, i'm pretty sure filehippo.com has it...

see if you can get it to start...

you need to close out the internet browser before clicking fix selected

remove the following:
O2 - BHO: (no name) - {00000000-d9e3-4bc6-a0bd-3d0ca4be5271} - (no file)

O2 - BHO: (no name) - {029e02f0-a0e5-4b19-b958-7bf2db29fb13} - (no file)

O2 - BHO: (no name) -...

how do you know that you are infected with that file? i just checked on it and it says its unclassified, meaning, that its not necessarily bad

have you tried removing these from hijackthis
O2 - BHO: (no name) - {243D2809-6B85-4DF5-A1FB-F19618810A12} - C:\WINDOWS\system32\drmclienq.dll (file missing)

O2 - BHO: (no name) -...

first off goto filehippo.com and download the newer HiJackThis and post a new log and have you tried combofix.exe?

remove this
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

did you download ccleaner and spybot s&d?? if you did then run the spybot first and then run...

Please download SmitfraudFix http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract the content (a folder named SmitfraudFix) to your Desktop

UMMM OKAY i was getting messages like that before... the "not a valid win 32 program" but when i first turned on my computer i was able to use them..... umm go to start/run and type in msconfig and...

what spyware and antivirus do you use????

you can remove these entries through the HiJackThis...

O2 - BHO: {47059018-7f25-7e68-a464-797a7d1802db} - {bd2081d7-a797-464a-86e7-52f781095074} - C:\WINDOWS\system32\ejtkbemq.dll (file missing)
...

you can remove these entries through the HiJackThis...

O2 - BHO: {47059018-7f25-7e68-a464-797a7d1802db} - {bd2081d7-a797-464a-86e7-52f781095074} - C:\WINDOWS\system32\ejtkbemq.dll (file missing)
...

also you need to do this READ CAREFULLY....

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the...

the reason i am telling you to enable ALL startup and services is because i had a problem in the past where the spyware was like hiding there and thats why i was still detecting spyware on my...

go to start/run and type in msconfig and make sure that ALL of your services are enabled and all of your startup services are enabled and then run a scan for spyware and viruses. I would also like to...

O20 - Winlogon Notify: ¨ ? ? ?
- C:\WINDOWS\

i think that this is bad but i cant find anything on it i would remove it and if it messes up the computer than just restore with HiJackThis

did you enable all your startup and all of your services and restart before you posted that log?

go into start/run msconfig and go to services and enable all and go to startup and enable all and restart your computer and post a new HiJackThis log

well im gonna let gerbil do a follow up on that.... but if you have ccleaner run that and run the registry tool in the ccleaner also and let me know how that works out for you and if you dont have...

this post needs to be marked as solved now

hrm.... i think i might just junk mcafee and try Nod32...... thanks crunchie and thanks for being here when im not..... had alot to do the past 2 days.....

i use mcafee because i have comcast and it comes free and i have never used kaspersky but i prefer mcafee because i have never had a problem with it

here is the removal tool for mcafee

http://download.mcafee.com/products/licensed/cust_support_patches/MCPR.exe

by any chance do u still use mcafee??? because i see the missing files at the bottom of your log. if you do not use this than there is a removal tool i can give you the link for and if you still wish...

http://www.grisoft.com/doc/download-free-anti-rootkit/us/crp/0


download and run this its an anti rootkit and run ccleaner if u havent already and run spybot if you havent already and post me a...

you know what now that i looked at your smitfraud log i think u do need to re do the smitfraud so follow what crunchie posted and redo the smitfraud and then we will finish what i was having you do