[Howard]

In that case, just use the admin account then.

Regards Howard

This thread is for the use of kr4614 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[kr4614]

ok its telling me I can't unistall because windows installer won't operate in safemode??

[Howard]

Ok, no problem.

Uninstall the suggested programmes from normal mode first, then follow the rest of the instructions.

Regards Howard

This thread is for the use of kr4614 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[kr4614]

ok Howard here are the new logs...also nolonger getting security alerts at bootup...Thanks

[Howard]

Ok, few more things to do now.

Go to add remove programmes in your control panel and uninstall anything to do with(if there).

Viewpoint

Close control panel.

Click start/run and type services.msc into the run box and press the enter key.

When the window appears, maximise it. Double click on the following services(if there) and select stop if they are running. Set the startup type to disabled. Click apply/ok for each service you disable.

Viewpoint Manager Service

Close the services window.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE. In your case, it`s ok to use the admin account.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\sw g.dll (file missing)

O16 - DPF: {918753F1-34D2-46EE-9D53-2722D1FE4BCC} (MyCorkboard Class) - http://www.mycorkboard.com/CabFiles/WebsiteHelper.cab

O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or folders(if there).

C:\Program Files\Viewpoint<Delete the entire folder.
C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\bak

Reboot into normal mode and rehide your protected OS files.

Download combofix.exe to your desktop. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "1" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Combofix will automatically save the log file to C:\combofix.txt

Post the Combofix log as well as a fresh HJT log and another awf.txt after running option 1 of the FindAwf tool.

Regards Howard

This thread is for the use of kr4614 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[kr4614]

ok Howard here you go...had to pick my daughter up at school (actually her computer) Thanks for your patience

[Howard]

Almost done, you awf.txt and HJT logs are clean..

Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the quote box nothing out side of it.
Also ..

Pay particular attention to this :-

Make sure the word Folder:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Code:

Folder::
C:\Program Files\Viewpoint
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.



This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Regards Howard

This thread is for the use of kr4614 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[kr4614]

Hope I did it right!

[Howard]

All clean mate.

Click start/run and type combofix /u Note the space between the combofix and the forward slash. This will uninstall Combofix and all it`s folders etc.

You can also delete the Findawf tool.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

I suggest you go and read this thread HERE.

If you have no further questions could you please mark this topic Solved by going to the top of this thread and click Thread tools, then select Mark this thread as solved As seen in the image below:

If you need this thread re-opened please contact a moderator or PM me.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

This thread is for the use of kr4614 only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[kr4614]

DUDE!! you are the man!! Thanks so much Howard!!!