Cant get rid of msg121.dll and msg121.cpy.dll

Discussion in 'adware, spyware & hijack cleaning' started by Storm7z7z, Mar 29, 2004.

Thread Status:
Not open for further replies.
  1. Storm7z7z

    Storm7z7z Guest

    Ad-aware scan says I have 2 files that it cant delete. Those files are msg121.dll and msg121.cpy.dll. I am really get frustrated at this because i spent my whole weekend tring to remove it. Any help on how to remove it would be appreciated.

    Also here is my hijackthis log:

    Logfile of HijackThis v1.97.7
    Scan saved at 9:33:01 AM, on 3/29/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\CookieWall\cookie.exe
    C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\DOCUME~1\STEVE~1.STO\LOCALS~1\Temp\Rar$EX00.143\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:81
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *ne2.attbb.net;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper Companion\CCHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5ECFC2DC-EEBD-1923-A330-B980356A7E1C} - (no file)
    O2 - BHO: (no name) - {B6034C6A-6B53-4355-A89F-3DC3D894AA2D} - (no file)
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - C:\Program Files\Panicware\Pop-Up Stopper Companion\popupus.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [CookieWall] C:\Program Files\CookieWall\cookie.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    O4 - HKLM\..\Run: [SpyBlocker] C:\Program Files\SpyBlocker Software\spyblocker.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
    O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
    O16 - DPF: {858B4F85-E945-4F0C-AF65-059E0AD9EEC0} (IntraLaunch.MainControl) - file://G:\Interface\IntraLaunch.CAB
    O16 - DPF: {94418D7F-29BF-460F-8614-DEFB34871FA4} - https://secure2.trueswitch.com/TrueConfig.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37870.4683217593
    O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    Storm7z7z, Mar 29, 2004
    #1
  2. storm7z7z

    storm7z7z Guest

    C:\windows\system32\msg121.cpy.dll
    C:\windows\system32\msg121.dll
     
    storm7z7z, Mar 29, 2004
    #2
  3. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hi Storm7z7z,

    Welcome to Wilders.

    Before you start, please unzip or move HijackThis to a separate folder. The program will make backups in the folder it's in. These easily get lost in a temporary folder or a folder with other programs.

    Check the following items in HijackThis.
    Close all windows except HijackThis and click Fix checked:

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing

    O2 - BHO: (no name) - {5ECFC2DC-EEBD-1923-A330-B980356A7E1C} - (no file)
    O2 - BHO: (no name) - {B6034C6A-6B53-4355-A89F-3DC3D894AA2D} - (no file)

    O3 - Toolbar: (no name) - {339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)

    Download CWShredder and run. Be sure ALL other windows are closed and use the Fix button and follow the instructions you will receive.

    Then go HERE and follow the instructions.

    Reboot and then post a fresh HijackThis log.

    Regards,
    Kent
     
    puff-m-d, Mar 29, 2004
    #3
  4. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Sorry Phant0m``,

    Dellater will not work for this cr@p.
    The site puff-m-d linked to will.

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 29, 2004
    #4
  5. storm7z7z

    storm7z7z Guest

    Well Phantom that program didn't work on this so tring the other thing puff-m-d posted.
     
    storm7z7z, Mar 29, 2004
    #5
  6. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    In approx 150 cases of msg121 that I have dealt with the only total cure has been the fix posted by Puff http://www10.brinkster.com/expl0iter/freeatlast/L2M/Msg121.htm

    the others haven't been sucsessful

    It's possible that the latest adaware update has included the cure but it needs a 2 or 3 stage total removal procedure

    unfortunately the merijn fix only worked once for me on 121 but has worked very well on 117/118 and a couple of times on 120
     
    dvk01, Mar 29, 2004
    #6
  7. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    Phant0m``,

    Removing the file is not all that needs to be done.
    If AdAware or Kill2Me can do a complete job. Fine. But that is not the program you advised to use. ;)

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 29, 2004
    #7
  8. Pieter_Arntz

    Pieter_Arntz Spyware Veteran

    Joined:
    Apr 27, 2002
    Posts:
    13,491
    Location:
    Netherlands
    No, it is not a competition.
    I will use anything that works. If possible with the least effort for the victim. So if and when I know, for sure that Kill2Me and/or AdAware work I will use those instead of pointing them to FreeAtLast' s site.

    Why would I not recommend AdAware if it works?
    Click the i button. ;)

    Regards,

    Pieter
     
    Pieter_Arntz, Mar 29, 2004
    #8
  9. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    No not a competition, but when we have already been through the sweat and anguish and had many users crying because they could not remove this pest and it ruined their surfing. Having tried all available fixes including some quite ingenious fixes cobbled together by various people, when a fix works, then that is what we recommend.

    The best fix is one that is known to work

    before a known fix is discovered, then yes experiments to find the best cure are done. For example the new adtomi problem , That is still being workerd on to find a simple complete cure and hopefully someone will come up with one. Until then we use the best we have
     
    dvk01, Mar 29, 2004
    #9
  10. storm7z7z

    storm7z7z Guest

    Hi guys sorry for my stupidness :'(. I have another problem on my hands now. I cant get on the web anymore because one of the removel programs told me to download something call fixip. I was stupid and deleted the stuff in there and now cant get the comp to get back online. Im at my cousins house now. Also I made sure ad-ware had all the up-to-date refrence files. Also im pretty sure I had all the settings on like u have phantom but im not at ad-aware right now so ill double check when i get home. But all the ways u told me to get rid of this thing does not do so. Maybe its just me but im ready to kick the comp out the door lol. Also it seemed that ad-aware was going to get rid of it fine but said it couldn't remove it to remove at next reboot and i said yes and boom it was still there after :(. The remove tool you download to get rid of the msg121.dll also doesn't run the way it is suppose too. when i double click on the batch file that is suppose to reboot the comp in 15 seconds all it does is makes a little cmd window and goes away :(. I think i need a rest from this all the aggrevation went to my head and I am doing dumb avoidable mistakes. Thanks guys for tring to help.
     
    storm7z7z, Mar 29, 2004
    #10
  11. storm7z7z

    storm7z7z Guest

    Phantom you are awsome man. Thanks :).
     
    storm7z7z, Mar 29, 2004
    #11
  12. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    that fix from pchell works perfectly on 117 & 118

    it has been tried on 120/121 and doesn't work, that is why Free at last at SWI came up with the 121 fix

    he MSG120 & 121 work in a diffferent way to the earlier versions

    but please do try it, it can't do any harm
     
    dvk01, Mar 29, 2004
    #12
  13. Storm7z7z

    Storm7z7z Guest

    Ok guys thanks for your patience with me. I will be back at it when i get home so hopefully u guys will be on tonight to help me through this shitty thing.

    Does this mean I gt a new version that cant be removed?
     
    Storm7z7z, Mar 29, 2004
    #13
  14. Storm7z7z

    Storm7z7z Guest

    Phantom I used the xp one. Also now i see the link for how I was suppose to use the other program. http://www10.brinkster.com/expl0iter/freeatlast/L2M/ts.htm :oops:
     
    Storm7z7z, Mar 29, 2004
    #14
  15. Shadowwar

    Shadowwar Spyware Expert

    Joined:
    Feb 26, 2004
    Posts:
    305
    Phantom.. Just an fyi..
    the new versions of msg121 Look2me are very nasty and do one hell of a job protecting itself. This has been researched heavily by quite a few experts and is very tough to remove on xp and 2k. The remove on reboot keys that you tried to use with delater or any other file delete program will not work as the two dll's work together to protect themselves from those deletions. the msg121.cpy and msg121 watch each others backs. Thus the instructions for older versions of look2me will not work. Also the file now loads with winlogon so adaware or spybot are almost never sucessful in removing the new versions. They will have sucess on 9x though. The best method is fals page that i have found.
     
    Shadowwar, Mar 29, 2004
    #15
  16. Storm7z7z

    Storm7z7z Guest

    Hi guys,
    Big thanks to everyone here. Thank god for my good old laptop and wireless connection. I got the Internet up and running again and removed the sh*tty msg121.dll out of my system. Sorry guys that program did work I just was so mad at this situation that I wasn't think clearly. The reason the fix didn't work is because i didn't extract the folder to my drive, I just ran it from winrar. Big huge out to you guys

    Thanks
    Storm
     
    Storm7z7z, Mar 29, 2004
    #16
  17. Storm7z7z

    Storm7z7z Guest

    Oh yeah here is a fresh log just to make sure nothing is still in there.

    Logfile of HijackThis v1.97.7
    Scan saved at 10:10:53 PM, on 3/29/2004
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CookieWall\cookie.exe
    C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\SpywareGuard\sgmain.exe
    C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
    C:\Program Files\Norton SystemWorks\Norton Antivirus\navapsvc.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE
    C:\Program Files\Norton SystemWorks\Norton Antivirus\SAVScan.exe
    C:\Program Files\SpywareGuard\sgbhp.exe
    C:\WINDOWS\System32\tcpsvcs.exe
    C:\WINDOWS\System32\snmp.exe
    C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-aware 6\Ad-watch.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Hijackthis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:81
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *ne2.attbb.net;<local>
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: CCHelper - {0CF0B8EE-6596-11D5-A98E-0003470BB48E} - C:\Program Files\Panicware\Pop-Up Stopper Companion\CCHelper.dll
    O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Pop-Up Stopper &Companion - {8F05B1A8-9D77-4B8F-AF54-6B2202066F95} - C:\Program Files\Panicware\Pop-Up Stopper Companion\popupus.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton SystemWorks\Norton Antivirus\NavShExt.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [CookieWall] C:\Program Files\CookieWall\cookie.exe
    O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
    O4 - Startup: PowerReg Scheduler V3.exe
    O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions present
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: Real.com (HKLM)
    O9 - Extra button: Messenger (HKLM)
    O9 - Extra 'Tools' menuitem: Messenger (HKLM)
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {0000000A-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB
    O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} - http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
    O16 - DPF: {68BCE50A-DC9B-4519-A118-6FDA19DB450D} (Info Class) - http://www.blizzard.com/register/wowbeta/si.cab
    O16 - DPF: {858B4F85-E945-4F0C-AF65-059E0AD9EEC0} (IntraLaunch.MainControl) - file://G:\Interface\IntraLaunch.CAB
    O16 - DPF: {94418D7F-29BF-460F-8614-DEFB34871FA4} - https://secure2.trueswitch.com/TrueConfig.cab
    O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?37870.4683217593
    O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
     
    Storm7z7z, Mar 29, 2004
    #17
  18. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    Hi Storm7z7z,

    I know it was a little frustrating but now your log is clean.... Good work!!!

    Regards,
    Kent
     
    puff-m-d, Mar 29, 2004
    #18
  19. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    Hi Storm7z7z

    Just to make sure it has finally gone pleae post a new killbox log, that is the best way to check as it doesn't show in HJT

    I can't remember from the thread whether you have alrready got the killbox, I am sure we did have you download it somewhere along the line, but just in case here are the full instructions

    Please download the KillBox from here:

    http://download.broadbandmedic.com/VbStuff/KillBox.zip

    UnZip it to it's own folder not to the Desktop or a Temp folder. Click on The KillBox.exe and it will open. Now click find then find msg.dll, then on the little pop up window, that says killbox file list, press file/create log and a pop up says do you want to create a log in notepad, say yes and then save as usual in notepad and copy & paste the resulting list here
     
    dvk01, Mar 30, 2004
    #19
  20. Storm7z7z

    Storm7z7z Guest

    Hi Dvk01,
    I think this is what you wanted. If not then ill try again :).

    Log for KillBox ver.2.0.1
    --------------------------

    ---msg{}dll search---
    C:\WINDOWS\System32\msgina.dll
    C:\WINDOWS\System32\msgsvc.dll
    C:\WINDOWS\System32\dllcache\msgr3en.dll
    C:\WINDOWS\System32\dllcache\msgsvc.dll
    C:\WINDOWS\System32\Setup\msgrocm.dll
     
    Storm7z7z, Mar 30, 2004
    #20
  21. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    That is fine

    the log is showing as completely clear of that pest now
     
    dvk01, Mar 31, 2004
    #21
  22. Unregistered

    Unregistered Guest

    You mention a method you found on fals page. Can you tell us what it is or were to find it?
     
    Unregistered, Apr 11, 2004
    #22
  23. puff-m-d

    puff-m-d Registered Member

    Joined:
    Feb 13, 2002
    Posts:
    5,703
    Location:
    North Carolina, USA
    HTH.....

    Kent
     
    puff-m-d, Apr 11, 2004
    #23
  24. dvk01

    dvk01 Global Moderator

    Joined:
    Oct 9, 2003
    Posts:
    3,131
    Location:
    Loughton, Essex. UK
    unfortunately the fix on F A L 's page has been taken down because it has been found that usin g it on the latest versuins of L2M causes severe damage to the operating systems in NT based computers so he has removed it and will not allow it to be used any longer
     
    dvk01, Apr 11, 2004
    #24
  25. Shadowwar

    Shadowwar Spyware Expert

    Joined:
    Feb 26, 2004
    Posts:
    305
    Its was actually removed becuase its useless on the newest version being they use random filenames. This dll updates itself when it is running and morphs to the current version available. Another good reason to run a software firewall.
    :rolleyes:
     
    Shadowwar, Apr 11, 2004
    #25
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...