Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
I cant find any info on this one ,but it looks fishy ! and when you can't find any info it usually means it bad !
O4 - HKLM\..\Run: [AITwoUpdater] "C:\Program Files\AIUpdate\AIUpdate.exe
The next 3 are optional but recomended,because they are rescorce hog and not needed in startup.
O4 - Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
Now reboot into safe mode and delete the following files and folders if found .
C:\Program Files\AIUpdate,,,delete folder
to delete the above files and folder you will need to do the following
go to
Show hidden files & folders
"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode
reboot computer and post a new log
caperjack
I hate 20 Questions
13,069 posts since Aug 2003
Reputation Points: 1,064
Solved Threads: 812
2. Another cleanup that will help is to go to Start>Programs>Acccessories>System Tools> Disk Cleanup and put a check mark beside all the entries in the disk cleanup window that ask you what you want to clean. Clean all hard drives and all files. This will get rid of any malware that is hiding in the temporary folders.
3. Make sure that all are gone, by checking the folders that the Temporary Internet Files and Temp files are stored in. To do so use Control Panel > Internet Options(or right click the IE icon on the desktop and choose Properties). Click Delete Files on the General Tab - place a check in the Delete all offline content box, then 'Clear History' and then press OK (or go direct to the C:\Documents and Settings\userprofilename\Local Settings\Temp\ folder) and
C:\Documents and Settings\userprofilename\Local Settings\Temporary Internet Files\)
4. Empty your Recycle Bin
5. Double Check the following folders to make sure they are empty:
C:\WINDOWS\Profiles\your account\Temporary Internet Files
Delete all the files in (and any subfolders of) the C:\Windows\Temp\ folder (or go direct to the C:\Documents and Settings\userprofilename\Local Settings\Temp\ folder) and C:\Documents and Settings\userprofilename\Local Settings\Temporary Internet Files\)
6. You may find that you have to repeat the steps a couple of times.
caperjack
I hate 20 Questions
13,069 posts since Aug 2003
Reputation Points: 1,064
Solved Threads: 812
caperjack
I hate 20 Questions
13,069 posts since Aug 2003
Reputation Points: 1,064
Solved Threads: 812
Caperjack, again thank you for the suggestions. I did as you said. New HJT log follows:
Hopefully the bad guys have been taken care of. Do you see anything requiring additional attention?
Looks good now to me !!
caperjack
I hate 20 Questions
13,069 posts since Aug 2003
Reputation Points: 1,064
Solved Threads: 812
AIUpdate could be part of some software from a Taiwanese computer company ( http://www.ktop.com.tw/kautai/index-english.htm ) as it can be found in thier code ( http://www.ktop.com.tw/kautai/32.htm ). Unfortunately, I don't read Chinese, so I don't know what kind of program it is. You can take a look at their site and if any of that type of stuff is something you use, you may want to contact them to see what AIUpdate is and if you need it.
dlh6213
Posting Maven
3,117 posts since Jul 2004
Reputation Points: 63
Solved Threads: 214
