I NEED MAJOR HELP, THIS IS MAKING ME NUTS!!

[Jannie K.]

PLEASE HELP..I HAVE WINDOWS XP, I AM THE ADMINISTRATOR
AND THERE ARE 2 USER ACCOUNTS AS WELL, MINE IS FINE, BUT
EACH TIME THE OTHERS ARE OPENED, THERE IS A POP UP
MESSAGE THAT READS AS FOLLOWS..(THIS IS EXACTLY AS IT
READS WITH THE EXACT SPACES AND ALL)

HEADING IS..TASK SYSTEM

Failed to load control 'PiracyProtectorOCX' from . Your
version of may be outdated. Make sure you are using the
version of the control that was provided with your
application.



I HAVE DONES SEARCHES UPON SEARCHES, SCANS, ETC...I
CANNOT FIND ANYTHING NAMED THIS IN MY COMPUTER OR ON THE
INTERNET..ITS MAKING ME NUTS. I HAVE EVEN CHANGED THE
OTHER ACCOUNTS TO ADMINISTRATORS AND RAN SCANS, ADAWARE,
SPYBOT...I REALLY HAVE TRIED ALOT OF THINGS WITH NO
LUCK...PLEASE HELP! THANK YOU, JANNIE K.

 

[Peter Lawton]

Have you tried running AdAware while logged on as one of the other two
accounts, it may only scan the user registry hive of the currently logged on
user.

If that fails it's probably worth deleteing the other two users profiles and
let them re-build, as one account is working OK it's unlikely to be a global
machine problem.

It does look like some 3rd party plugin is broken to me, either one the
other two users have installed and you haven't, or a sneaky adware that's
installed itself at some time.

 

[H Leboeuf]

Jannie K.
Deleting the two other profiles you will loose all that is in these
profiles.


Get AdAware and SpyBot and run them both. Keep them up to date.
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

Additional link:
http://aumha.org/a/quickfix.htm

You may need this removal tool.
More: Complete list by variant with up-to-date information.
http://www.merijn.org/cwschronicles.html
More: Removal tool: http://www.merijn.org/files/cwshredder.zip

Read this: "So how did I get infected in the first place?"
http://forums.net-integration.net/index.php?showtopic=3051
===
If all fails.

Go to http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.merijn.org/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip the Download file in a NEW FOLDER that you can create before you start
the download.
DO NOT use any of the TEMP folders that are presently in your computer.
Double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/

The Tutorial if you want to know more about the results or the .log file.
http://www.merijn.org/htlogtutorial.html

====

If these are comming as SPAM from MS Messenger have a look at these.

How to Prevent Windows Messenger from Running on a Windows XP-Based Computer
By default, Windows XP Professional and Windows XP Home Edition install
Windows Messenger, and the user interface does not provide a way to remove
or to uninstall Windows Messenger.
http://support.microsoft.com/?kbid=302089 (4.4, 4.5, 4.6. 9/23/2003)


Messenger Service Window That Contains an Internet Advertisement Appears
A Messenger service window appears that contains an Internet advertisement
that is similar to the following text:
Messenger Service
Message from source to your_computer_name.ISP_name on date time Message Text
http://support.microsoft.com/?kbid=330904 (XP/W2000 11/4/2003)


Stop Messenger SPAM
http://www.spywareinfo.com/articles/spam/messenger.php


Stop Messenger SPAM
The developer of the messenger spam software indicates on their web site
that "these messages are completely anonymous and virtually untraceable.
With this program your IP address never shows up anywhere."
http://www.stopmessengerspam.com/