the message i get when i run ewido is " The file "E\WINDOWS\SYSTEM\mac80ex.idf/C:/WINDOWS/SYSTEM/msbe.dll" cannot be removed because it is embedded in the archive "E\WINDOWS\SYSTEM\mac80ex.idf". Dou you want to remove the whole archive?"

:smiley: Hi Thea,

You sound a little rattled, :coffee2: have a cup of coffee, kick back and take a deep breath. We'll do this one step at a time.

First. Pull up the PreWork instructions and print them out. Just to have for reference. Make sure that you download, CCleaner, and HijackThis!, you already have ewido, so we won't even worry about that.

As far as posting your logs, including the one you tried to post before. Look at the toolbars above where you are typing. Click on the image of the paperclip. A new box will open up. Click on one of the Browse buttons. Locate the Scan Report that you tried to post before. Click on it so that it is in the Filename box. Click on the Open button, then click on the Upload button. Your file will be saved as an attachment to your post.

Is there any part of the PreWork that you are unsure of how to do?

Look forward to your reply,

TTFN

LGW

exceeds the amount that this website allows to be posted. but tried again to post the hijack this log. but i dont know if i downloaded it into its separate file. i think i got the second log from ewido to post, i tried to attach it

Do you have an E drive that is something other than a CD or DVD?

Looks like she has skipped them on purpose.

But you can safely let ewido remove them , there all "nasty" files. And please run and post the hjt log after you have ewido remove these.

Also i see you dont have system restore disabled yet , please do so to prevent reinfection.

Maybe, but maybe not, have you ever seen a second harddrive assigned as E instead of D, even if it were an OES setup? Puzzling. :tongue:

Thea, and Joe, I have to sign off for the night. I will check back in tomorrow.

TTFN

LGW

yes, I had my old computer removed and transfered to the new one as an extra drive! and the other file that is attaced as above is called " netut80ex.vxd" ok I'm going to do what you said so far...