re: Proper Spacing this time sorry..im learning :-)
Tuesday, July 12, 2005 at 5:13 pm
Windows XP Annoyances Discussion Forum
Posted by MrCharlie
(4526 messages posted)
We're getting there.
Download and unzip a fresh copy of cwsserviceremove to your desktop. use
link below:
DownloadItHere
Make sure you unzip it into a folder, you should end up with this reg file: cwsserviceremove.reg
Do this in regular mode.
Press Control-Alt-Del to enter the Task Manager.
Click on the Processes tab and end the following processes if listed:
crzv32.exe
Exit the Task Manager when finished
Close ALL programs down, leaving ONLY HijackThis running.
Place a check against the following items:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\kohmj.dll/sp.html#37049
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E09F949B-33ED-E152-6852-2FECABDB4D1C} - C:\WINDOWS\atlat32.dll
O4 - HKLM\..\Run: [NAVNet] "C:\DOCUME~1\TIMWIN~1\LOCALS~1\Temp\36.tmp" /m
O23 - Service: Network Security Service (NSS) ( 11Fßä #•ºÄÖ`I) - Unknown owner -C:\WINDOWS\system32\crzv32.exe"
/s (file missing)
Click on Fix Checked and exit HijackThis.
Delete these files:
C:\WINDOWS\kohmj.dll
C:\WINDOWS\atlat32.dll
C:\WINDOWS\system32\crzv32.exe
C:\DOCUME~1\TIMWIN~1\LOCALS~1\Temp delete the contents of this folder - not
the folder - just what's in it!
Double click on the cwsserviceremove.reg and allow it to merge into the registry.
Run AboutBuster
Run the CW-Shredder
Clean out temporary and TIF files. Go to Start > Run and type in the box: cleanmgr.
Let it scan your system for files to remove. Make sure these 3 are checked and then
press *ok* to remove:
Temporary Files
Temporary Internet Files
Recycle Bin
Reboot and post a fresh HijackThis log and we'll take another look. MrC
|
All messages in this thread [show all]
 |  | | | | | | |  | re: Proper Spacing this time sorry..im learning :-) (MrCharlie: Tue, Jul 12, 2005, 5:13 pm) |
| |
| |
| |
Return to the Windows XP Discussion Forum
|
|
