Help removing LOL2.exe and POD.exe virus'!

Grantbo · March 18, 2011

My wife open an email via Yahoo! yesterday on one of our laptops and apparently opened and executed a Trojan horse disguised as a FedEx zip file. The virus was quarantined by AVG, but it appears to have infected the internet browsers (IE and Mozilla) in such a manner that they can no longer connect to our wireless network. Non-infected laptops and desktops connect without issue. This is my first run in with an infected comp and my first post. AVG states that "Process LOL2.exe was detected and quarantined 17 seconds after detection. It also states that POD.exe was detected and quarantined 18 secs later.

Based upon what I've read in other posts I have add 2 logs files:

Logfile of IObit HijackScan v1.0.2.0

Scan saved at 10:29:23, on 2011-3-18

Running processes:

C:\Program Files\Dell\DellDock\DockLogin.exe

C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe

C:\Program Files (x86)\IObit\IObit Security 360\IS360srv.exe

C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files (x86)\IObit\Advanced SystemCare 3\AWC.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe

C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe

C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe

C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe

C:\Program Files (x86)\AVG\AVG10\avgtray.exe

C:\Program Files (x86)\IObit\IObit Security 360\is360tray.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe

C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

E:\HijackThis.exe

C:\Program Files (x86)\IObit\IObit Security 360\is360.exe

C:\Program Files (x86)\IObit\IObit Security 360\a_hijackscan.exe

O2 - BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG10\avgssie.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll

O2 - BHO: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files (x86)\AVG\AVG10\Toolbar\IEToolbar.dll

O4 - HKCU|\Software\Microsoft\Windows\CurrentVersion\Run\: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

O4 - HKCU|\Software\Microsoft\Windows\CurrentVersion\Run\: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG10\avgtray.exe

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [iObit Security 360] "C:\Program Files (x86)\IObit\IObit Security 360\IS360tray.exe" /autostart

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\Run\: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM|\Software\Microsoft\Windows\CurrentVersion\RunOnce\: [sTToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} -

O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} -

O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} -

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}Java Plug-in 1.6.0_24 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}Java Plug-in 1.6.0_24 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}Java Plug-in 1.6.0_24 - http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

O23 - Service: AVG Security Toolbar Service (AVG Security Toolbar Service) - Unknown - C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe

O23 - Service: AVGIDSAgent (AVGIDSAgent) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe

O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files (x86)\AVG\AVG10\avgwdsvc.exe

O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown -

O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe

O23 - Service: Diagnostic Policy Service (DPS) - Unknown -

O23 - Service: GameConsoleService (GameConsoleService) - WildTangent, Inc. - C:\Program Files (x86)\WildTangent\Dell Games\Dell Game Console\GameConsoleService.exe

O23 - Service: GoToAssist (GoToAssist) - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files (x86)\Citrix\GoToAssist\514\g2aservice.exe

O23 - Service: Group Policy Client (gpsvc) - Unknown -

O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

O23 - Service: Windows CardSpace (idsvc) - Unknown - %systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

O23 - Service: IS360service (IS360service) - IObit - C:\Program Files (x86)\IObit\IObit Security 360\IS360srv.exe

O23 - Service: Net.Tcp Port Sharing Service (NetTcpPortSharing) - Unknown - %systemroot%\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

O23 - Service: Quality Windows Audio Video Experience (QWAVE) - Unknown - %windir%\system32\svchost.exe

O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown -

O23 - Service: Security Accounts Manager (SamSs) - Unknown -

O23 - Service: Secondary Logon (seclogon) - Unknown - %windir%\system32\svchost.exe

O23 - Service: SoftThinks Agent Service (SftService) - SoftThinks SAS - C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE

O23 - Service: Distributed Link Tracking Client (TrkWks) - Unknown -

O23 - Service: Windows Modules Installer (TrustedInstaller) - Unknown -

O23 - Service: Block Level Backup Engine Service (wbengine) - Unknown - %systemroot%\system32\wbengine.exe

O23 - Service: Diagnostic Service Host (WdiServiceHost) - Unknown -

O23 - Service: Diagnostic System Host (WdiSystemHost) - Unknown -

O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown - %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 03/18/2011 at 12:20 PM

Application Version : 4.50.1002

Core Rules Database Version : 6623

Trace Rules Database Version: 4435

Scan type : Complete Scan

Total Scan Time : 00:34:12

Memory items scanned : 644

Memory threats detected : 0

Registry items scanned : 13039

Registry threats detected : 1

File items scanned : 29805

File threats detected : 65

Malware.Trace

(x86) HKU\S-1-5-21-4088428742-3427845163-3056580082-1000\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON#SHELL

Adware.Tracking Cookie

C:\Users\Fairweather\AppData\Local\Temp\Low\Cookies\fairweather@ad.yieldmanager[2].txt

C:\Users\Fairweather\AppData\Local\Temp\Low\Cookies\fairweather@ad.wsod[2].txt

ia.media-imdb.com [ C:\Users\Fairweather\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QXUCJYAS ]

media.wfaa.com [ C:\Users\Fairweather\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QXUCJYAS ]

s0.2mdn.net [ C:\Users\Fairweather\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\QXUCJYAS ]

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ads.monster[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ad.yieldmanager[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ad.wsod[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@collective-media[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@realmedia[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ads.as4x.tmcs[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@interclick[4].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ad.yieldmanager[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@adinterax[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ad.wsod[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@invitemedia[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@content.yieldmanager[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@microsoftwindows.112.2o7[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@imrworldwide[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@mediaplex[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@adinterax[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@click.bsftransmit50[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@a1.interclick[4].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@www.burstnet[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@www.burstnet[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ads.undertone[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@serving-sys[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@eyewonder[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@atdmt[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@content.yieldmanager[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ads.monster[4].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@media6degrees[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@bizrate[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@bmwmoter.122.2o7[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@2o7[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@adserver.adtechus[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@content.yieldmanager[5].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@content.yieldmanager[6].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@tacoda.at.atwola[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@a1.interclick[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@statcounter[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@at.atwola[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ad.yieldmanager[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@richmedia.yahoo[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ar.atwola[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ads.monster[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@revsci[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@doubleclick[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@at.atwola[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@a1.interclick[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@interclick[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@media6degrees[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@interclick[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ads.nba[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@content.yieldmanager[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@gemoneysusrsfeapply.112.2o7[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@invitemedia[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@adxpose[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@ad.wsod[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@user.lucidmedia[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@invitemedia[3].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@realmedia[2].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@click.bsftransmit50[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@tacoda.at.atwola[1].txt

C:\Users\Fairweather\AppData\Roaming\Microsoft\Windows\Cookies\Low\fairweather@apmebf[1].txt

Grantbo · March 19, 2011

Issues resolved!

Unfortunately there are no responses to my issue, but I am reporting back to say that I successfully managed to remove the malware that was preventing browser access to my wireless router....at least with IE. Malwarebytes came to rescue and successfully detected the malware and removed it! I immediately gained full access to the internet using IE. Mozilla access was still blocked, but since it was a recent download with book marks to deal with, I simply uninstalled it and reinstalled it. The reinstall returned it to its prior full functionality.

FYI SpyBot did not detect the threat.

Grant

Malwarebytes' Anti-Malware 1.50.1.1100

http://www.malwarebytes.org

Database version: 6100

Windows 6.1.7601 Service Pack 1

Internet Explorer 8.0.7601.17514

3/18/2011 9:34:02 PM

mbam-log-2011-03-18 (21-34-02).txt

Scan type: Quick scan

Objects scanned: 159505

Time elapsed: 2 minute(s), 20 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Superdave · March 21, 2011

Hello and welcome to IOBit Forums. My name is Dave. I will be helping you out with your particular problem on your computer.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.

2. The fixes are specific to your problem and should only be used for this issue on this machine.

3. If you don't know or understand something, please don't hesitate to ask.

4. Please DO NOT run any other tools or scans while I am helping you.

5. It is important that you reply to this thread. Do not start a new topic.

6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.

7. Absence of symptoms does not mean that everything is clear.

If you can't access the internet with your infected computer you will have to download and transfer any programs to the computer you're using now and transfer them to the infected computer with a CD-RW or a USB storage device. I prefer a CD because a storage device can get infected. If you use a storage device hold the shift key down while inserting the USB storage device for about 10 secs. You will also have to transfer the logs you receive back to the good computer using the same method until we can get the computer back on-line.

**********************************************************

Download DDS from HERE or HERE and save it to your desktop.

Vista users right click on dds and select Run as administrator (you will receive a UAC prompt, please allow it)

* XP users Double click on dds to run it.

* If your antivirus or firewall try to block DDS then please allow it to run.

* When finished DDS will open two (2) logs.

1) DDS.txt

2) Attach.txt

* Save both logs to your desktop.

* Please copy and paste the entire contents of both logs in your next reply.

Note: DDS will instruct you to post the Attach.txt log as an attachment.

Please just post it as you would any other log by copy and pasting it into the reply.

Sign In

Help removing LOL2.exe and POD.exe virus'!

Recommended Posts

Grantbo

Link to comment

Share on other sites

Grantbo

Link to comment

Share on other sites

Superdave

Link to comment

Share on other sites

Archived

Browse

Activity