A) The "MessengerPlus! 3" has two installation options, one of which (the "sponsored" mode) will install adware/spyware. If you aren't sure whether or not you installed the program with the "sponsor" option, uninstall it. If you want to use the program, reinstall it after we clean your system, making sure not to use the sponsored installation mode.
B) Perform these general cleaning procedures:
You will need to disconnect from the Internet for some of the following, so you'll need to print out the following instructions, or save them into a text file with Notepad.
1. Download and install this utility (but do not run a scan with it yet):
ewido Security Suite (trial version) - http://www.ewido.net/en/download/
- Open ewido. In the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.
- Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.
- Open SpyBot and use its update feature to download and install the most current spyware definitions file. Close the program once the update is complete.
- Open AdAware, click the "Check for updates now" button, and follow the prompts to install the most current spyware definition database. Close the program once the update is complete.
- Open your anti-virus program and use its update feature to make sure that you have the most current virus definitions installed. As with the above programs, don't run a scan with it; just close it once it is updated.
2. Download and install the CCleaner utility, but don't run it yet.
3. Run HijackTHis again, put a check mark next to the following entries (some of which may have been fixed already), and then click the "Fix checked" button. Close HJT once it has finished performing its fixes:
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKLM\..\Run: [NAV] C:\WINDOWS\system32\dll\csrss.exe
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
4. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up).
5. Run Ccleaner. It may take a while for the program to perform its cleaning, so be patient. Close the program when it has finished.
6. Run AdAware, SpyBot, ewido, MS Antispyware beta, and your antivirus program consecutively; have the programs fix all malicious items they find.
When ewido finds the first malicious object on your system, it will ask you if it should clean it. When it asks this, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.
Save the log file that ewido will create after it finishes scanning; you'll be including that log in your next post here.
7. Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".
- Locate and delete the C:\WINDOWS\system32\dll\csrss.exe file.
8. Empty your Recycle Bin, reboot normally, run HijackThis again, and post the new log. Also post the log that ewido generated.
