DMR 152 Wombat At Large Team Colleague

When i looked at the memory mechanic that is built into the system mechanic program, it shows that i only have about like 34mb of ram left, when i first start up my computer and go to the desktop and check it, its about like 500mb or something like that. I don't understand whats going on, anyone have a clue what i could do?

It sounds like some program or process is slowly gobbling up your free memory, but there can be many different causes for that. Please do the following to see if you can identify a possible suspect:

- Hit Ctrl+Alt+Delete and click Task Manager in the resulting window.

- Click on the "Processes" tab and then put a check in the "show processes from all users" box at the bottom of the Processes window.

- Click on the "Mem usage" header at the top of the list of running processes to sort the processes by memory usage, highest to lowest.

- Monitor that list to see if you can spot a program/process whose memory usage gradually increases over time. Give us the name of the process if you find it.

DMR 152 Wombat At Large Team Colleague

it ussally has somthing to do with the video card

Yes, the nv_disp.dll file is a component of NVidia's video driver software.

Maybe i should unistall it and just try the driver windows puts on it?

Yes- see what happens when you do that.

Can you give us the full and exact text of the particular BSOD error you are getting please?

DMR 152 Wombat At Large Team Colleague

Accessing swecure pages/sites in general is a relatively common problem. Many possible solutions can be found in these related threads from our archive:

http://www.daniweb.com/search/search.php?q=secure%20sites%20access

DMR 152 Wombat At Large Team Colleague

Problems with accessing secure sites such as hotmail have been pretty popular around here, and the causes can range from spyware/virus infection to corrupt system files. Given that, the fixes obviously vary depending upon a given member's exact situation, but many of those fixes can be found in the following threads from our archive:

http://www.daniweb.com/techtalkforums/search.php?searchid=721824

DMR 152 Wombat At Large Team Colleague

Your system is pretty badly infested, but there's something you need to take care of before we begin the cleaning process:

C:\DOCUME~1\PAULED~1\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

The log entry above indicates that you are running HJT from within a Temp/Temporary folder. You need to create a folder for HJT outside of any Temp/Temporary folders and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.

After moving HijackThis to a safe location, please do the following:

You will need to close/quit all web browser programs and disconnect from the Internet for some of the following, so you should print out the following instructions or save them into a text file with Notepad.


1. Run at least two or three of the following online anti-virus/anti-spyware scans and let them fix what they can:

http://www.kaspersky.com/scanforvirus.html
http://housecall.trendmicro.com/
http://us.mcafee.com/root/mfs/default.asp?cid=9914
http://www.pandasoftware.com/active...n_principal.htm
http://www.ravantivirus.com/scan/
http://www.bitdefender.com/scan/licence.php


2. Download and install the following (free) …

DMR 152 Wombat At Large Team Colleague

That's why I like to check when I don't understand something!

Always a good plan :)

Glad we could help.

DMR 152 Wombat At Large Team Colleague

OK- your log does show signs of infections. Please do the following:

1. Download and install ewido Security Suite - http://www.ewido.net/en/download/


2. Open ewido. If you receive a warning message saying "Database not found"; just click "OK" for this. Next, in the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.


3. Open MS Antispyware beta. Make sure the "AntiSpyware AutoUpdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.


4. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up).


5. Run ewido and MS Antispyware beta consecutively (the order doesn't matter), and have both programs fix whatever they find.
When ewido finds the first malicious object on your system, it will ask you if it should clean it. When it asks this, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.


6. Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders …

DMR 152 Wombat At Large Team Colleague

If the disk crash is due to Windows system file corruption or the like, you might be able to access/recover the data on the drive by using an alternate operating system like Linux. I've used the "Live" (runs entirely off of a CD) version of Knoppix to do this quite a few times.

On the other hand, if the drive failure is of an electronic or mechanical nature, you might have to resort to this :eek:

DMR 152 Wombat At Large Team Colleague

1. Does the computer's BIOS recognize the drive? Go into your BIOS setup and take a look.

2. If the BIOS sees the drive but Windows does not, it may just be that the drive is not formatted yet. In the Computer Management utility in your Administrative Tools folder, go to Storage and click on Disk Management. Is the drive listed in one of the right-hand panes of the disk management window? If so, what information for the disk do you see listed there (please be specific)?

DMR 152 Wombat At Large Team Colleague

1. Are you using XP Home edition or Pro?


2. When you try to browse My Network Places, do you get any errors? If so, post the full and exact text of the error(s).


3. Can you ping the IP address of the desktop from the laptop, and vice verse?:

On each computer, open an MS-DOS box, type the following command, and then hit Enter:

Ping IP_address_of_other_computer

What are the results of the ping commads?

DMR 152 Wombat At Large Team Colleague

1. Can you ping the local loopback address of the problematic computer?:

ping 127.0.0.1


2. Can you ping the IP address assigned to the problematic computer?:

ping IP_address_of_computer


3. Does the laptop work when hard-wired to the network via a CAT5 Ethernet cable?


4. Have you disabled any and all firewalling software on the problematic computer?

DMR 152 Wombat At Large Team Colleague

alsanady, please do the following:


1. Download and install these two utilities:


ewido Security Suite - http://www.ewido.net/en/download/
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en


2. Open ewido. If you receive a warning message saying "Database not found"; just click "OK" for this. Next, in the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.


3. Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.


4. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up).


5. Run ewido and MS Antispyware beta consecutively (the order doesn't matter), and have both programs fix whatever they find.
When ewido finds the first malicious object on your system, it will ask you if it should clean it. When it asks this, put a checkmark in the lower left corner of the box that says "Perform action on all infections", then choose clean and click OK.


6. Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- For every user account listed under C:\Documents …

DMR 152 Wombat At Large Team Colleague

Perhaps this should be placed in the spyware section? I am sure a MOd will move it for you. :)

-T

Yes, and Yes. :mrgreen:

Moving now...

DMR 152 Wombat At Large Team Colleague

We shold get a HijackThis log from you at this point.

1. Disconnect from the Internet.

2. Disable McAfee if it's still preventing HijackThis from running.

3. Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log".

4. Re-enable McAfee and reconnect your computer to the Net.

5.Open the HijackThis log file with Windows Notepad and cut-n-paste the entire contents of the Notepad file here.

DMR 152 Wombat At Large Team Colleague

Thank you Hollystyles!

I'm confused about the printer as it's a Dell unless that company owns Dell?

Not quite, but close.
Dell doesn't make their own printers, so they partnered with the Lexmark company to have Lexmark manufacture printers for them. In other words, the printer you have may have the Dell brand name on the outside, but its all Lexmark on the inside.

DMR 152 Wombat At Large Team Colleague

Download Ewido, and scan your computer with it...

Erm... check the HJT log. Ho-Man already has ewido installed :mrgreen:


Ho-Man,

Once you've run ewido, please post the scan report log it generated, as well as another log from HijackThis.

DMR 152 Wombat At Large Team Colleague

Cool- glad you got it all sorted out :)

DMR 152 Wombat At Large Team Colleague

Your latest log is infection-free, so try just_a_nobody's suggestion.
If that doesn't work, here are a few more troubleshooting steps to try:

1. Open your Internet Options control panel, click on the Connections tab, and then on the "LAN Settings" button. In the LAN settings window, make sure the "automatically detect settings" box is checked.


2. In Internet Explorer and Firefox, see if you can reach Google and Yahoo by their IP addresses as opposed to their URL. In hte browsers' address/location bars, type in the following locations one at a time and tell us what happens:

http://66.102.7.147
http://66.94.230.37


3. Click on the "Run..." option in your Start menu. In the "Open:" box of the resulting window, type "cmd" (omit the quotes) and hit Enter. This will bring up a DOS window

- At the DOS prompt, type the following commands, hit Enter after each, and tell us the exact results for each command:

ping 127.0.0.1
ping 66.102.7.147
ping www.google.com


- Again at the DOS prompt, type the following command, hit Enter, and post the information returned by the command:

ipconfig /all

DMR 152 Wombat At Large Team Colleague

Glad we could help, MsNytOwl :)


If possible, can you run HijackThis one more time and post the new log for us, please. We'd like to review the log just to make sure that all signs of "unwanted guests" have been removed before we mark this thread as "Solved". Thanks.

Also- have a read through this thread for suggestions on how you can minimize your chances of getting infected in the future.

DMR 152 Wombat At Large Team Colleague

OK- not too much info to go on there, unfortunately. The cryptic hexadecimal numbers in the errors you posted can be decoded, but that's not something I'm going to dig in to right at this moment (which happens to be the moment of 12:35 AM for me).

Faulting games are often a function of video or sound card issues (drivers, etc.); have you looked into that possibility yet?

DMR 152 Wombat At Large Team Colleague

Im suspicious they didnt do anything and the long duration of shipping reset it somehow?

Essentially, that is possible.


1. Open the computer's case and see if you can more definitively determine which component is making the clicking noise (the power supply, the hard drive, etc.). A clicking from the power supply can indicate two things: that the supply itself is shot, or that some component in the computer is faulty, and is "dragging down" the supply.

2. Turn the computer off and unplug the internal power connections from all non-essential devices (CD-ROM, DVD, floppy drive, etc.). Does it power up correctly with only the motherboard and hard drive powered? If so, start reconnecting the other devices one at a time. Is there a certain device that, when connected, causes the problem to occur?

3. Try the process of elimination in the above step with all PCI cards and RAM modules: remove one at a time to see if you can identify a particular suspect.

DMR 152 Wombat At Large Team Colleague

We would need to know the exact make and model of your motherboard to definitively answer your question. Also- S3 makes a wide variety of graphics chips, so specifics on that would be needed as well.

If you don't know the above information, there's a great freeware program called Everest which will tell you more than you ever wanted to know about your system.

DMR 152 Wombat At Large Team Colleague

Buying a new computer

Hey all, new here and am looking at buying a brand new computer ...

Unfortunately, the computer you linked to is not a brand new computer. Read the fine print from the ad:

This high-quality item has been factory reconditioned

While the system is pretty well-outfitted, the $1,600 base price (for a refurbished computer with no monitor) is high.

DMR 152 Wombat At Large Team Colleague

The following information should appear at the top of the details windows; please give us that info as well:

Event Type
Event Source
Event Category
Event ID
User

DMR 152 Wombat At Large Team Colleague

The problem could be almost anywhere, especially considering the fact that the system is newly-built.

A few thoughts:

1. Please give us the exact make and model of the motherboard.

2. Recheck all of your connectors/cards/components; make sure everything is seated properly and firmly.

3. Remove 1 stick of RAM at a time and test-drive the system. If it only crashes when a particular memory module is installed, you might want to replace that module. You can also "stress-test" your RAM with the free memtest86 utility.

4. Thermal problem perhaps? Check the temp readings in your BIOS (if available), and make sure you have sufficient ventilation.

5. Obviously- if you've "overclocked" any settings, throttle them back down to their default settings.

DMR 152 Wombat At Large Team Colleague

Unlike the log in the other thread you referenced, there are no indications of malicious infections in your log.

Open the Event Viewer utility in your Administrative Tools folder and look through the System and Application log files for entries labelled "Error" or "Warning". If you find such entries, double-click on them to view their details; if any seem related to the program crashes, post the full and exact contents of the details window(s) here.

DMR 152 Wombat At Large Team Colleague

Gobble Gobble!! :)

DMR 152 Wombat At Large Team Colleague

what is this root kit virus & how do I get rid of it if I have it. Anti Vir is not picking it up.

There are many "rootkit" variants, but if you have no reason to suspect that you are infected with one, I wouldn't worry about that for now.

The problems you're describing, especially given the fact that the system is newly-built, really sound like hardware/driver/etc. issues instead of symptoms of malicious infections. Are there any error/warning messages in the System and/or Application logs in the Event Viewer which might shed some light on the cause(s) of ht eproblems?

DMR 152 Wombat At Large Team Colleague

Hi MsNytOwl,

Your log indicates a few different infections; let's start with the following general cleaning:

<EDIT> Hmm... looks like just_a_nobody beat me to some of this already</EDIT>

1. Download and install these two utilities:


ewido Security Suite - http://www.ewido.net/en/download/
Microsoft Anti-Spyware beta - http://www.microsoft.com/downloads/...&displaylang=en


2. Open ewido. If you receive a warning message saying "Database not found"; just click "OK" for this. Next, in the main screen, click "Update" and click "Start Update". After the update process completes, exit from Ewido.


3. Open MS Antispyware beta. Make sure the "AntiSpyware Autoupdater" feature is enabled, and that it has downloaded the most current antispyware updates. Close the program after you've verified this.


4. Reboot into Safe Mode (you get to the safe mode boot option by hitting the F8 key as your computer is starting up).


5. Run ewido and MS Antispyware beta consecutively (the order doesn't matter), and have both programs fix whatever they find.


6. - Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types".

- For every user account listed under C:\Documents and Settings, delete the entire contents of these folders (but not the folders themselves):

Important: One of the normal steps in eliminating malicious …

DMR 152 Wombat At Large Team Colleague

Good work; that's a clean log :)


Now that your system is malware-free, have a read through this thread for suggestions on how to protect your system from future infections:

http://www.daniweb.com/techtalkforums/thread27519.html

DMR 152 Wombat At Large Team Colleague

Mandy 9.0 is 3 years old now; I'd suggest getting a newer version. Mandrake has since renamed itself "Mandriva" (don't ask...); check out their latest releases at their download site.

A couple of other Linux distros which I'd recommend for users coming from a Windows background are SuSE (now owned by Novell) and Fedora (an offshoot of Red Hat).

DMR 152 Wombat At Large Team Colleague

...i inserted the xp cdrom and formatted the hard drive, and installed the windows xp all over again.

Well- sometimes a reformat can be the most expedient solution.

DMR 152 Wombat At Large Team Colleague

Issues with the MSVCRT.DLL file aren't uncommon; try the fix suggested in this Microsoft support article.

DMR 152 Wombat At Large Team Colleague

Your HJT log shows no signs of malicious infections or anything else which would account for the problem.


Before performing any other troubleshooting steps, disable your firewall software. To make sure that you've entirely disabled it, go into the program's options/preferences, turn off the option to automatically start the program when Windows starts, and reboot. Simply choosing to disable the firewall once it has started often does not shut it down completely.

If the firewall isn't the source of the problem, we'll need to try to determine at what level the problem is occuring:

1. Open an MS-DOS box, type the following command, and hit Enter:

ipconfig /all

Do you see correct entries for the computer's IP address, the gateway IP address, and DNS server address(es)?

2. Again at the DOS prompt, type the following two commands and tell us the results:

ping www.google.com
ping 66.102.7.147


3. See if you can reach a site in your browsers by its IP address as opposed to its URL. Using Google as an example, enter the following into IE and Firefox's address bar, and let us know the result:

http://66.102.7.147


4. Here's a software fix you can try:

WinsockXPFix


5. Cruft built up in your Temporary Internet Files folder and other locations can cause browsing problems. Do the following "housecleaning":

- …

DMR 152 Wombat At Large Team Colleague

There are still three malicious entries in your latest log.

1. Have HijackThis fix:

O4 - HKLM\..\Run: [Dynamic DLL Injection] dyntopat32.exe
O4 - HKLM\..\Run: [Adobe Acrobat Reader CFG] mnaetwrplj.exe
O4 - HKLM\..\RunServices: [Dynamic DLL Injection] dyntopat32.exe


2. Open Windows Explorer, and in the Folder Options->View settings under the Tools menu, select "show hidden files and folders", and uncheck "Hide protected operating system files" and "Hide extentions for known file types". Search for the following files and delete them if found:

dyntopat32.exe
mnaetwrplj.exe


3. Empty your Recycle Bin and reboot.


4. Once the computer reboots, run HijackThis again and post the new log.

DMR 152 Wombat At Large Team Colleague

There are still a couple of malicious entries in your log. Please do the following:

1. Run HijackThis and have it fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.plsqgxebxmyijyztor.org/o...eS3mpCqwkh.html
O20 - Winlogon Notify: Nls - C:\WINDOWS\system32\ptchdprf.dll (file missing)


2. Reboot your computer.


3. Once the computer has rebooted, run HijackThis again and post the new log.

DMR 152 Wombat At Large Team Colleague

You're welcome roz, glad we could help :)

Why not get AVG Free, it is a free anti-virus program that works great.

A good point. If you're just looking for an anti-virus program (as opposed to an entire "Internet Security" package), AVG is very effective, and doesn't bog down your system in the way that Norton or McAfee can.

It's also free for personal use, and free is always good :mrgreen:

You can download AVG here.

DMR 152 Wombat At Large Team Colleague

There are quite a few freeware programs which you can use to retrieve lost/forgotten passwords; this Google link will lead to more than a few choices.

DMR 152 Wombat At Large Team Colleague

First and foremost: please don't change settings in the router unless you understand exactly what the settings mean. Diong so will only cause more problems.


1. Do not disble the router's firewall- you'll be leaving your system(s) vulnerable to attacks from the outside world.


2. Do not change your connection type (connection protocol); set it back to the type for which it was originally configured.

PPPoE= Point-to-Point Protocol over Ethernet
PPPoA= Point-to-Point Protocol over ATM

PPPoE and PPPoA are the two common network transmission protocols used by DSL providers. Your router must be set to the protocol that your particular ISP uses; check with the ISP if you are unsure.


3. "High Speed Mode" (A.K.A. SpeedBooster) and "Frame Burst" are technologies that boost the max transfer rate of 802.11g wireless devices above the standard speed of 54Mbps. HSM claims a slightly higher speed increase over Frame Burst, but your mileage with either will definitely vary.


4. The Noise Margin (or Signal-to-Noise Ratio) is basically a measurement of the actual ADSL data signal strength vs the strength of other unwanted, interfering signals along the transmission line between your service provider's location and your home. The larger the Noise Margin number (measured in dB), the better the DSL signal quality.


5. For your game, what you need to do on the router is called "Port Forwarding". Your game communicates on certain network channels called …

DMR 152 Wombat At Large Team Colleague

Are apple scrips of any use for this

This is a Mac you're working on then, yes?

DMR 152 Wombat At Large Team Colleague

Just recently been getting this eventid

"Just recently"?! That event error was generated in July; look at the datestamp:

Date: 18/07/2005

Also: it looks like your post appeared on another tech support forum back in July as well. What's the deal here?

DMR 152 Wombat At Large Team Colleague

Hi virtuedata,

First of all- welcome to TechTalk!

We ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Given the above, I've split your question into its own thread, which you can find here.

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules


Thanks for understanding.

DMR 152 Wombat At Large Team Colleague

As long as your computer is not connected to the Internet and you do not use any floppy/CD-ROM discs in the time that you are "unprotected", you won't get infected.

1. Leave Norton installed and active until the moment you're ready to install McAfee.

2. Physically unplug the cable that connects your computer to the Internet.

3. Uninstall Norton; Install McAfee.

4. Reconnect your Internet/network cable.

5. Open McAfee and use its online update feature to make sure you have the most current virus definitions installed.

DMR 152 Wombat At Large Team Colleague

1. The AUTOEXEC.NT error is not uncommon, and is most likely due to corruption of that file. Try this:

Open Windows Explorer and navigate to the C:\Windows\Repair folder; in that folder you should find backup versions of the "autoexec.nt" and "config.nt" files.

Copy both of these files into the C:\WINDOWS\SYSTEM32 folder, answering YES when/if asked if you want to replace the existing files.


2. For the winik infection:

a) Download the Registry Search Tool from here:
http://www.billsway.com/vbspage/vbsfiles/RegSrch.zip

Unzip to your Desktop and double click on regsrch.vbs
(if you have script protection, please allow this to run)

In the dialog that opens enter the following:
winik

Press 'OK'

The search will run for a while then alert you when it is finished.

Press 'OK' and copy the contents of the WordPad window and post in this thread.


b) Download WinPFind. Follow the usage instructions given on the download page and post the log here.


c) Run ewido again and post the scan report log it generates.

DMR 152 Wombat At Large Team Colleague

Hi drewdawg79, welcome to DaniWeb :)


To begin with, please do the following:

Download the (free) HijackThis utility:

http://www.stevewolfonline.com/Downloads/DMR/Spyware%20Tools/HJT/HijackThis.exe

Once downloaded, follow these instructions to install and run the program:

Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

Run HijackThis, but do not have HJT fix anything yet; only have it scan your system! Once the scan is complete, the "Scan" button will turn into an option to "Save log...".
Save the log in the folder you created for HijackThis; the saved file will be named "hijackthis.log". Open the log file with Windows Notepad, and cut-n-paste the entire contents of the Notepad file here.

The log contents will tell us a lot about what "nasties" have crept into your system, and once we analyse the log we can tell you what to do from there.

DMR 152 Wombat At Large Team Colleague

============================================
Thanks for the above action plan.
Will apply this in two days when back home and will post results.

You're welcome :)

Post when you can; we'll be here...

DMR 152 Wombat At Large Team Colleague

No problem; HijackThis is running from the right place now.


The "[winsync]" entry in the log is indicative of an infection that HijackThis alone can't thoroughly clean (and you may have leftovers from other infections as well), so let's run a couple of removal utilities and see what they can clean up:

You will be disconnected from the Internet for some of the following, so you'll need to print out these instructions, or save them into a text file with Notepad.

1. You already have MS Antispyware installed, so open the program and click on "Spyware Definitions" on the main page of the program to check for and install the most current spyware definitions database. Don't run a scan yet; just close the program when it finishes the update process.


2. Download and install ewido Security Suite. Run the program; you will receive a warning message saying "Database not found", just click "OK" for this. Next in the main screen, click "Update" and click "Start Update". Don't run a scan yet; just close the program when it finishes the update process.


3. Download and install CCleaner. As with the above two utilities, don't run the program yet.


4. Reboot the computer into Safe Mode. You get to the Safe Mode boot option by tapping the F8 key as your computer is starting up.


5. Once in Safe Mode, run full system …

DMR 152 Wombat At Large Team Colleague

Hi loulouthefox, welcome to DaniWeb :)

Your log definitely indicates "unwanted guests" on your system, but you need to take care of something first:

C:\DOCUME~1\gibelin\LOCALS~1\Temp\Rar$EX01.387\HijackThis.exe

The log entry above indicates that you are running HJT from within a Temp/Temporary folder. Please do the following:

Create a folder for HJT outside of any Temp/Temporary folders and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, by running disk clean-up utilities, etc.


Once you've moved HijackThis to a safe location, please do the following:

You will need to disconnect from the Internet for some of the following, so you'll need to print out the following instructions, or save them into a text file with Notepad.


1. Download and run these specific about:blank/Home Search/etc. removal tools (before scanning/fixing with about:buster and CWShredder, use their online update features to make sure you have the most current updates installed):

CWShredder - http://www.intermute.com/spysubtrac...r_download.html
about:Buster - http://www.majorgeeks.com/AboutBuster_d4289.html
HSRemove -

DMR 152 Wombat At Large Team Colleague

OK- your log indicates signs of at least one malicious infection, but there's something you need to take care of first:

C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

The log entry above indicates that you are running HJT from within a Temp/Temporary folder. Please do the following, as I instructed in my first post:

Create a folder outside of any Temp/Temporary folders for HJT and move it there now. A folder such such as C:\HijackThis or C:\Spyware Tools\HijackThis will do.

One of the normal steps in eliminating malicious programs is to entirely delete the contents of all Temp folders. Given that, if HijackThis (and other data that you care about) is living in those Temp folders, it will be erased along with everything else!
Temp/Temporary folders are just that- Temporary. They are not meant for permanent storage, as their contents are often delete in the course of troubleshooting, virus/spyware removal, running disk clean-up utilities, etc.


Please move HijackThis to a safe location and post another log after that. Once we're sure that HJT is no longer running from a Temp location we can begin removing the "nasties".

DMR 152 Wombat At Large Team Colleague

..i'll get back to you to let you know if this works

Hi yerpc,

First of all- welcome to DaniWeb!

We do ask that members not tag their questions on to a thread previously started by another member (regardless of how similar your problem might seem). Not only does it divert the focus of the thread away from the original poster's problem, but it also makes it less likely that you yourself will get the individual attention that you need.

Given that, if you do need/want to post more information concerning your particular problem, please start your own thread and post the info there.

For a full description of our posting guidelines and general rules of conduct, please see this page:

http://www.daniweb.com/techtalkforums/faq.php?faq=daniweb_faq#faq_rules


Thanks for understanding.