Critical System Error Icon. Please help remove

[Gcreeper314]

Hey guys i have this icon in my taskbar that is a yellow flashing circle that has a question mark and X flashing. When i put my mouse over it it says Critical System Errors. If i click on it it takes me to a Virusblast page. I've tryed everything i can think of to try and fix it but nothing. Any info on how to get rid of this would really be appreciated. Thanks.

 

[The Sheep]

Dont download anything!


How to remove VirusBlast


What this program does:

VirusBlast is a rogue anti-spyware application that gets installed along with malware without asking for permission or that is suggested by sites that are of dubious nature. This program can also be accompanied by other malware that changes your desktop background to a fake warning or by Trojans that issue fake taskbar security alerts. These are all used as a scare tactic to have you purchase their commercial software. A screenshot of this program can be seen below.


VirusBlast



Symptoms in a HijackThis Log:

O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program Files\VirusBlast\BlastIEmonitor.dll
O4 - HKLM\..\Run: [VirusBlast] C:\Program Files\VirusBlast\VirusBlast.exe /s Revision History


Removal Instructions:

In order to remove this infection we will need to use HijackThis to manually remove the infection:

1. Print out these instructions as we will need to shutdown every window that is open later in the fix..

2. Enter the Windows Control Panel and double-click on Add/Remove Programs.

3. When the installed programs list appears, double-click on the entry for VirusBlast v5.0 if it exists and allow it to uninstall. Then exit the Add/Remove Programs screen and the Control Panel.

4. Download HijackThis from the above link and extract it to c:\hijackthis.

5. Close all windows, even this Internet Explorer window.

6. Navigate to the c:\hijackthis directory and double-click on HijackThis.exe

7. When the program starts, click on the Scan button.

1. Put a checkmark next to the following entry (There may be more than one of each):

O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program Files\VirusBlast\BlastIEmonitor.dll
O4 - HKLM\..\Run: [VirusBlast] C:\Program Files\VirusBlast\VirusBlast.exe /s

2. Then click the Fix button

8. Exit HijackThis.

9. Reboot your computer into Safe Mode

10. Delete the following files if they exist:

C:\Program Files\VirusBlast\

11. Reboot your computer back to normal mode.


Your computer should now be free of Virus Blast. It is likely, though, that this infection was installed with other malware.


This is obviously something I copied, so whether it works or not I dont know

 

[LambOfGod]

EDIT: The Sheep got to it first good job man, Try what he said first, then try my suggestion.

END EDIT:




Sounds like your taskbar was highjacked.

try this.

(on all of the following download/install/update/Scan w latest definitions)

AVG antivirus
http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10596553.html?tag=pop.software

Scan first with AVG, then download and install and update

Ad-aware
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10399602.html?tag=pop.software


then try a third i would reccomend

Spybot
http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10401314.html?tag=list

or

Windows Defender
http://www.microsoft.com/downloads/...ypuuCWkyIFZwdO0FivUaWMd1qwAgXMVM7oAPdOIPuUQ==

after you use these programs.
if the problem is still there.


Use google, to search for removal tools.
Look in taskmanager for the offending task (ctrl+alt+del)
look in your system startup as well (start/run/msconfig)

give us more info so we can help further.

good luck

 

[Gcreeper314]

Dont download anything!


How to remove VirusBlast


What this program does:

VirusBlast is a rogue anti-spyware application that gets installed along with malware without asking for permission or that is suggested by sites that are of dubious nature. This program can also be accompanied by other malware that changes your desktop background to a fake warning or by Trojans that issue fake taskbar security alerts. These are all used as a scare tactic to have you purchase their commercial software. A screenshot of this program can be seen below.


VirusBlast



Symptoms in a HijackThis Log:

O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program Files\VirusBlast\BlastIEmonitor.dll
O4 - HKLM\..\Run: [VirusBlast] C:\Program Files\VirusBlast\VirusBlast.exe /s Revision History


Removal Instructions:

In order to remove this infection we will need to use HijackThis to manually remove the infection:

1. Print out these instructions as we will need to shutdown every window that is open later in the fix..

2. Enter the Windows Control Panel and double-click on Add/Remove Programs.

3. When the installed programs list appears, double-click on the entry for VirusBlast v5.0 if it exists and allow it to uninstall. Then exit the Add/Remove Programs screen and the Control Panel.

4. Download HijackThis from the above link and extract it to c:\hijackthis.

5. Close all windows, even this Internet Explorer window.

6. Navigate to the c:\hijackthis directory and double-click on HijackThis.exe

7. When the program starts, click on the Scan button.

1. Put a checkmark next to the following entry (There may be more than one of each):

O2 - BHO: IEExtension Class - {1F6FE2C2-6040-4645-9053-7F689AFFE176} - C:\Program Files\VirusBlast\BlastIEmonitor.dll
O4 - HKLM\..\Run: [VirusBlast] C:\Program Files\VirusBlast\VirusBlast.exe /s

2. Then click the Fix button

8. Exit HijackThis.

9. Reboot your computer into Safe Mode

10. Delete the following files if they exist:

C:\Program Files\VirusBlast\

11. Reboot your computer back to normal mode.


Your computer should now be free of Virus Blast. It is likely, though, that this infection was installed with other malware.


This is obviously something I copied, so whether it works or not I dont know

I did that but the files are not there. This is the log.




Logfile of HijackThis v1.99.1
Scan saved at 12:02:35 PM, on 11/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Hijackthis directory\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O16 - DPF: DigiChat Applet - http://chat.hunting.net/DigiChat/DigiClasses/Client_IE_5_0_1_2.cab
O16 - DPF: Yahoo! Dots - http://download.games.yahoo.com/games/clients/y/dtt1_x.cab
O16 - DPF: Yahoo! Klondike Solitaire - http://yog55.games.scd.yahoo.com/yog/y/ks12_x.cab
O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt3_x.cab
O16 - DPF: Yahoo! Pool 2 - http://download.games.yahoo.com/games/clients/y/pote_x.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1162229147015
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: ferrateen - {27321538-5739-4aa1-b84c-7d18e4383f1f} - C:\WINDOWS\system32\rrtcany.dll
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

 

[LambOfGod]

Like i said if you cant fix it with Post #2 use my post to fix the problem

 

[Gcreeper314]

EDIT: The Sheep got to it first good job man, Try what he said first, then try my suggestion.

END EDIT:




Sounds like your taskbar was highjacked.

try this.

(on all of the following download/install/update/Scan w latest definitions)

AVG antivirus
http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10596553.html?tag=pop.software

Scan first with AVG, then download and install and update

Ad-aware
http://www.download.com/Ad-Aware-SE-Personal-Edition/3000-8022_4-10399602.html?tag=pop.software


then try a third i would reccomend

Spybot
http://www.download.com/Spybot-Search-Destroy/3000-8022_4-10401314.html?tag=list

or

Windows Defender
http://www.microsoft.com/downloads/...ypuuCWkyIFZwdO0FivUaWMd1qwAgXMVM7oAPdOIPuUQ==

after you use these programs.
if the problem is still there.


Use google, to search for removal tools.
Look in taskmanager for the offending task (ctrl+alt+del)
look in your system startup as well (start/run/msconfig)

give us more info so we can help further.

good luck

I've tryed all of those programs and non seem to be able to detect it.

Isamini and Isamonitor where on my taskmanager like 2 days ago and i ended up getting rid of them but that didn't fix the problem. I also went to internet options/Programs/Manage Add-ons. From there i got a toolbar remover and removed 2 add-ons that weren't suppose to be there. But still nothing. I don't know what else to do.

 

[LambOfGod]

I've tryed all of those programs and non seem to be able to detect it.

Isamini and Isamonitor where on my taskmanager like 2 days ago and i ended up getting rid of them but that didn't fix the problem. I also went to internet options/Programs/Manage Add-ons. From there i got a toolbar remover and removed 2 add-ons that weren't suppose to be there. But still nothing. I don't know what else to do.

ALL of those programs i mentioned came up clean???

Use google, to search for removal tools.

look in your system startup as well (start/run/msconfig)

good luck

Have you tried these 2 things?


have you looked in add remove programs?

 

[The Sheep]

Do you have an anti-virus installed? Have you tried doing a scan? If that comes up clean, some let you do an online scan (incase your antivirus has been corrupted by a virus)

I can't find any other advice I'm afraid

 

[LambOfGod]

Do you have an anti-virus installed? Have you tried doing a scan? If that comes up clean, some let you do an online scan (incase your antivirus has been corrupted by a virus)

I can't find any other advice I'm afraid

Yea thats what i said in Post #3, and he said he already did that.

try this.

(on all of the following download/install/update/Scan w latest definitions)

AVG antivirus
http://www.download.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10596553.html?tag=pop.software

Scan first with AVG

 

[The Sheep]

Sorry, didn't realise that was an online scan.

I'm sure it must be dead by now, if he's done all of this?