my nephews lappy was riddled with spyware and sh*t,ive managed to clean
most of it up using avg,nod32,ad-aware,spybot s&d,hjt,cwshredder,windows defender,
not all the same time,now i noticed in the task manager that summat called twotoolmemo
is taking all the cpu,this is no programme called twotoolmemo on the lappy,ive googled
twotoolmemo and nothing comes up for this,but if i google twotool it says its a non virus
adaware,anyway this is taking too much of the cpu and bombarding me with pop ups
anyone know how i can delete this twotool thingy,ive looked in the add and remove section,did a search on lappy for it and nothing is found,i been told that i might need
to delete it from the registry,anyone know how i can find it and what the correct path to delete it from the registry


thanks....

Hello Mag.

I think you should do our "Prework" it is the link in pink on my signiture.

Then our security team can get you all cleaned up and free of these annoyances.

Copy n paste results back here on your thread.

Thankyou.

hi ive done the prework,ran super antispyware,avg antispyware,ran cccleaner,the avg anti spyware didnt find anything,the super anti spyware found adware lop and adware tracking cookies,which was quarentined,ran cc cleaner deleted temp net files,ran hjt and here the results below,the lappy is still slow loading net pages up,not seen this twotool thingy

thanks for looking...

Attached Files

hijackthis2.txt (5.1 KB, 2 views)

Hello.


First disable any "anti-spyware" programs that are running, as they may hinder the removal, such as
SpybotSD TeaTimer, SpywareGuard, Microsoft AntiSpyware Real-time Protection, AdWatch, SpySweeper, etc...

Then set Windows to view hidden and system files:

Next, run HijackThis. Place a checkmark by the following entries:

O4 - HKCU\..\Run: [DentPhone] C:\DOCUME~1\New-user\APPLIC~1\GRIDBO~1\hole shim this.exe

Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis.


Then, reboot to Safe mode and delete the following folder:

C:\Documents and Settings\New-user\Application Data\GRIDBO~1\ <-- folder

There will be more to the name of the folder, but it starts with GRIDBO, and contains the file hole shim this.exe

After the folder is deleted, reboot normally.


Next,
Open Hijackthis, click "Open the Misc Tools section"
Next to "Generate StartupList log", place a check next to "List also minor sections" (full) and "List empty sections (complete).
Then click "Generate StartupList log"
Click "Yes" to the box that pops-up.
Then copy and paste the notepad text that appears to this topic, along with the usual HijackThis log.

hi soz not been in touch been busy,ive uninstalled ad-aware,spybot s&d,and avg anti spyware,deleted the gridbook~1\folder,ran hijackthis for the start up log,and results
ive noticed its still getting pop ups directing me to winamp search thing and summat else called yesloans,im tempting to do a reformat but il wait for results from these logs


thanks for looking....


also ive uninstaled winamp and it seems to stop these other two pop ups

Attached Files

	start_up_log.txt (11.0 KB, 2 views)
	hijackthislog3.txt (4.1 KB, 4 views)

Just curious...why did you uninstall Ad-Aware, Spybot S&D, and your other protection programs?


I need you to run Panda ActiveScan.

• Once you are on the Panda site click the Scan your PC button
• A new window will open...click the Check Now button
• Enter your Country
• Enter your State/Province
• Enter your e-mail address and click send
• Select either Home User or Company
• Click the big Scan Now button
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
• When download is complete, click on My Computer to start the scan
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Attach the ActiveScan report in your next reply.

i took spybot and ad-aware off cos it was crashing halfway thru scanning,
went onto pada site did a scan,it was all over in two mins saying nothing
is infected ???,not got the twotool thing taking all my cpu,but still gettin
pop-ups,gonna install spybot and ad-aware