New to this website and happy to have someplace willing to help - thanks! Not sure which forum this belongs in, so my apologies if I've gone wrong putting it into "Windows XP"...

Every time I boot up my machine I get a pop-up stating that file "0g640iv8.dll" cannot be found. When I click 'OK' and proceed, I do not notice anything else wrong with my machine.

When I do web searches for this file (and PCHF), all of the hits are in regard to computers being hi-jacked, taken over by pop-ups, messages on the wallpaper, etc. I am not experiencing any of this.

I use a heavy dose of protection on my computer including Norton "Internet Security", Webroot "Spysweeper" and Microsoft "AntiSpyware". I also occasionally scan with "Ad-Aware" and "Spybot - Search and Destroy". Despite repeatedly running these programs, the pop-up when booting continues.

How can I get rid of this pop-up? Is this anything that I need to worry about?

Thanks for reading,
Jeff

Hya Jeff , welcome to PCHF.

I think you have (atleast) a Look2me infection on there. Please download and run this tool first:

http://www.simplytech.it/L2MRemover/index_e.htm

And after that please follow the instructions in the "Prework" link below in my sig , and attach the 2 resulting log files to a post. Then we'll have youre pc clean in no time.

Thanks for your quick response to my post Joe!

Ran Look2Me removal tool - nothing was found (or removed).

The Ewido and HiJackThis files are attached. HJT was supposed to be run in safe mode after Ewido, right?

Thanks again!

Jeff

Nope , it isn't a Look2me infection , looks alot like it though.

Lets get rid of it.

You can run Ewido again and let it fix what it finds this time.



Then please boot in safemode again and fix these with hjt:

And do a manuall search for this file:

0g640iv8.dll

And delete all you find.

Then reboot and post an new hjt log out of regular mode please.

Joe,

I followed the earlier instructions - no problems. The new HJT log from regular mode is attached.

What about the following, they look similar to the one that I removed?

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE

Also, I have been getting a pop-up that reads:

"The instruction at "0x009996bc" referenced memory at "0x00000000". The memory could not be "written".

Click OK to terminate the program.
Click on CANCEL to debug the program."

I don't get this at every boot-up, only occasionally for a couple weeks. Is this related to the problems we're currently working on?

Thanks again!
Jeff

Those two files are ok and dont have to be removed.

And you hjt log is clean. Do you still have any other problems then the error you just posted?

I dont think that has anything to do with what we just removed.
Does it give any program or file names aswell?

Lets see if that is a ram problem , you can do that by running Memtest:
http://www.memtest86.com/

Joe,

I let the MemTest86 run for 18 cycles and it found 0 errors. I have restarted my machine several times and not seen the memory error again (it had previously happened intermittently).

Are we done? Am I OK now?

For future reference, any idea how I might have gotten infected, given the amount of protection that I have? What should I be doing going forward so that I don't have any problems in the future?

Thanks for all of your help!

Jeff