Hey Peter
Sounds like you got afew problems there, If you have your windows disk its
probably a good idea to start with the System file Check feature to make sure
you don't have damaged or corrupt system files.
Insert the Windows disk into the drive and then goto Start Menu then Run and
type
SFC /SCANNOW
remember the space after SFC and let it check all your system files as it
will repair any thats damaged or corrupt using the files from your disk.
Next for LOP I'm still not sure if you have MessengerPlus if you do please
uninstall it using the Add/Remove screen and remove both Messenger Plus and
the sponsor Program. If you do not have MessengerPlus but used to have it let
us know, If you have a different variant of LOP check your add/remove screen
for these:
Lop.com
LOP SEARCH
Window Searching
Window Active
Browser Enhancer
Ultimate Browser Enhancer
Search Plugin
Remove any found. You may also be able to locate a globe type icon in the
bottom right hand corner of your screen (near the clock), right click on it
then click Menu. From the main menu you will see a help button on the top
right hand corner. Click the help button then choose 'uninstall'
LOP strings random names together so its always difficult to help without
seeing a Hijack This log to show the entries but Spysweeper did well
yesterday when I ran LOP on my test machine but it did leave a couple of
entries in place, This was where the LOP entries were on my system
C:\Documents and Settings\Andy\Application Data\comphole\Fork Build.exe
C:\Documents and Settings\Andy\Application
Data\Dashproxybird\AudioDateWait.exe
C:\Documents and Settings\Andy\Application Data\Dashproxybird\live trans.exe
C:\Documents and Settings\Andy\Application
Data\Dashproxybird\SpamNurbEggsFive.exe
C:\Documents and Settings\Andy\Application Data\Dashproxybird\nwjhmqam.exe
C:\Documents and Settings\All Users\Application Data\1fragdeadtick\dalethe.exe
You need to enable hidden files and folders to view the application data
folders, Goto C:\Documents and Settings then goto 'Tools' on the top bar and
choose 'Folder Options', Go to the 'View' Tab and place a check next to "Show
Hidden Files and Folders"
There was also Registry run commands to start these files on reboot and a
hijacked IE search page and BHO entry, this was where Hijack This was usefull
to remove them.
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
h**p://
www.jmnyhtxmpmwhu.net/jAf4esK8Zzh1Pu0kDCYTvXHzH4bDxBzE13gPyHFr8EQYTk1dHGqcZShEKYRGKYXp.html
O2 - BHO: (no name) - {C9EA44CF-47B5-EA81-035A-66C7313A7BA8} -
C:\DOCUME~1\ANDY\APPLIC~1\comphole\Fork Build.exe
O4 - HKLM\..\Run: [DeadTickMfcdEach] C:\Documents and Settings\All
Users\Application Data\1fragdeadtick\dalethe.exe
O4 - HKCU\..\Run: [Pluspile] C:\DOCUME~1\ANDY\APPLIC~1\DASHPR~1\live trans.exe
If you have problems and cannot find a way to uninstall LOP download Hijack
This
http://www.spywareinfo.com/~merijn/files/HijackThis.exe
first save it in a convenient permanent folder such as C:\HJT\ then extract
and run Hijack This, Choose to do a 'system scan and save the logfile' when
its finished scanning it will open the results in notepad, If you need help
send that log to my email and I will let you know what needs removing
(
[email protected])
I noticed Dave made a reference to Spy Ferret, if you have that also please
uninstall it using the add/remove screen and remove its folder from
c:\Program Files area.
Next Download these
Please download, install, and update the free version of ewido security suite
http://www.ewido.net/en/download/
When installing, under "Additional Options" uncheck "Install background
guard" and "Install scan via context menu". Click on update in the left menu,
then click the Start update button. After the update finishes close Ewido
Download Ccleaner
http://download.ccleaner.com/download124bin.asp
Download Intermute's CWShredder from here:
http://cwshredder.net/bin/CWShredder.exe
This would be best running in safe mode but if you cannot boot to safe mode
run them in normal mode with all other IE browser windows closed.
Run Ewido again.
From the main menu click on 'scanner' then click 'Complete System Scan'
When ewido finds something, it will pop up a notification. Select "Remove"
and check the boxes "Perform action with all infections" and "Create
encrypted backup" then click on ok.When the scan finishes, click on "Save
Report" and save it to your desktop or c:/drive incase you need it again.
Run SpySweeper Again and remove anything found
Run CWShredder and click "Fix" to remove the CWS infection if it exists.
Run Ccleaner and press "Run Cleaner"
Close all Open Browser windows and goto Start Menu > Control Panel >
Internet Options, Next goto the Programs Tab and press "Reset Web Settings"
and include the homepage then click Yes, then go back to the General Tab and
enter the homepage you wish to use into the space provided then press apply.
With your problems getting to safe mode its hard to know whats causing this,
agp440.sys is refering to the advanced graphics port, possibly a conflict
somewhere or video card needs updating as its not compatible with windows in
some way, the other option may be a repair install of windows but with it
freezing at agp440.sys it may not be freezing on that but having problems
with whatever comes after that in the safe mode boot process.
Here's a couple of support pages but its hard to know if these pages are any
help for this issue.
http://support.microsoft.com/default.aspx?scid=kb;en-us;324764
http://support.microsoft.com/kb/307654/
Let us know how you get on
Regards
Andy
