Posts by caperjack

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

   See this link for a listing of some online & their stand-alone antivirus programs:

   Virus, Spyware, and Malware Protection and Removal Resources

2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

   For a tutorial on Firewalls and a listing of some available ones see the link below:

   Understanding and Using Firewalls

4. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to …

Looks good ,just one thing ,the 016 like this one some are bad some are good ,fix them all to be sure ,the good ones will download again when you go to that site ,
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab

Try the Data Lifeguard Tools from WD

My apologies fer cuttin' in Jack :)

No apologies necessary ,That what it all about !Helping others ,And I lean to ,I've never used lifeguard tools

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank

R3 - Default URLSearchHook is missing

O2 - BHO: BTGrabObj Class - {00000000-F09C-02B4-6EC2-AD0300000000} - C:\WINDOWS\BTGrab.dll

O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} - C:\WINDOWS\systb.dll

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

I cant find any info on this ,that is usually a bad thing ,do you know whAT It is .if not fix it .
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe

O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe

O4 - HKCU\..\Run: [J0r3RXGEW] esslib.exe

Now reboot into safe mode and delete the following files and folders if found .

[AlcxMonitor] ALCXMNTR.EXE,,,delete file

C:\Program Files\CSBB\,,,,,,,,,,,,delete this folder if its something you don't reconise

C:\WINDOWS\wupdt.exe.....delete file

[J0r3RXGEW] esslib.exe ,,,,,,,delete file

to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new …

Thanks cperjack. Problem is, since Windows doesn't recognize the second drive, I can't access it to perform the format.

What I would do is get a win98 bootdisk from [http://www.bootdisk.com/bootdisk.htm then follow the instruction HEREon Fdisk and formating ,you can format it fat32 ,then if windows reconises it you can then use the xp cd to format it again in NTFS if that is the file system you want to use ,!

MeThinks

Check to make sure its formated .

http://www.synaptics.com/support/index.cfm

You should be able to find The Some Error fix on the Microsoft site !!LOL
Really though we will need to know the actuall error in bot popups!1 I will AnyWay!

Try this ,open windows Explorer /tools/file types /scroll to the Jpg ,hilite it ,then /Advanced/ then you will see change Icon ,you may need to find where the photoShop icons are stored ,you will need to do this for both file types .

Bittorrent has many of the same problems as does Kazaa. It too is a large source of illegal content much of which will be infected with virusses, trojans and other malware.

In fact all filesharing applications are like that, something I really like as it means users of illegal software are sooner or later more or less automatically punnished for their actions.

Bittorrent is the biggest resource hog you'll ever put on your computer!!

nothing in that log to slow down a computer,
[exceptAOL!lol just kidding ]

Kazaa is for fools!!!

Bittorrents are where its at....google it y0!!

Thats why hes' trying to use KazAaBEGONE ,its a Kazaa removal tool

Kazaabegone does not work right. Help!!!!!

What problem are you having with it

The question is if it is a physical problem then are there reputable companies that can recovery the recoverable data? :eek:

If the data is important enough to pay big money to recover.
You may be able to put in a new hardrive load windows ,then slave the old drive and axcess it to take the Data that you need off the drive ,

OK great -- I got USER.EXE out of the Options folder and have now restored it. The SFC scan was clean. What's next?

I don't know whats' next ,how the machine working now .!!!any problems !Any error messages .

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

   See this link for a listing of some online & their stand-alone antivirus programs:

   Virus, Spyware, and Malware Protection and Removal Resources

2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

   For a tutorial on Firewalls and a listing of some available ones see the link below:

   Understanding and Using Firewalls

4. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to …

Yes I do have trend micro. So thats the problem, I thank you so much for this info. This is a tremendous website! Caperjack you hit the nail on the head .vb389.

Your Welcome,

Do you have Trend Micro Virus program installed if so this could be you problem/error,this is copy /paste from another site.
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
It's a new component of Trend Micro Internet security products (Trendmicro), Essentially it warns of new threats that Trend hasn't managed to solve and tells you how to avoid them while it develops a cure. It's an excellent concept, but new active viruses are common, resulting in an annoying quantity of alerts. You can take note of them, ignore them, or if they frustrate you, disable it. "Start/Programs/Trend Micro Internet Security/Outbreak Warning Settings" uncheck "Enable Outbreak Alert to provide proactive recommendations". Reboot

Its an error on the page ,fix it by turning off debug checking ,
Go to tools in IE/internet options/advanced /Browsing ,and about the 4th one down check off , Disable Script Debugging[internet explore] .

You could try starting computer in safe mode, by hitting the f8 key on bootup ,and deleting them ,but you have more problems than that with trojans and spyware!!
There are bad process running WtoolsS.exe ,HuntBar./and Wsup.exe to i think,maybe even more anyway please follow advice below.

.........................................................
This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. …

log looks ok ,as for the USER.EXE ,depending on how win98 was loaded it maybe in a folder on your drive .Check for a OPTIONS folder in c:\windows\. or look for a folder called Win98,in those folders are the win cab files needed to restore the user.exe.if thats there then direct SFC either of these 2 instead of the cdrom .
Check this ,about user.exe.
http://www.techadvice.com/w98/U/user-exe_w98.htm
I will send you the cab_42 file if you can't find it anywhere on you computer and you could extract it from threr .

Should I just go ahead and delete them all and then reboot? I think that's right but I do want to check with you before I proceed

Yes fix them .
also go to Start /run /type in , SFC ,you may need the win98 cd in the cdrom drive ,this will check for missing and or corrupt system files .

Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe

We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT/tsgen...001052409420406
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Finally if you are going to run both Spybot SD and Ad-Aware SE, leave the rescan with HijackThis until you have completed running both tools. If only running Spybot SD then RESCAN with HijackThis and POST your logfile in the same thread using ‘Add Reply’. Please do not attempt to fix anything in HijackThis yourself!

Scanning With Ad-Aware SE :

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan

2.Close ALL windows except Ad-Aware SE

3. Click on the‘world’ icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.

4. Once the update is finished click on the ‘Gear’ icon (second from the left at the top of the window) to access the …

look good now ,do you still get the orignal error message

when you installed ,MessengerPlus3 ,did you install without sponsor support,if not go to add abd remve programs and uninstall it and reinstall ,making sure to install with out sponsor support .
then post a new log /

when iexplore is in the system/system32 folder its the bad one ,in program file internet explorer its ok.
you have lots of programs running that don't really need to be ,but i don't see one that will cause your rundll problem!

I just had a machine come into my shop with a most interesting problem. All of the user accounts are gone, it will boot up into the windows XP (home) logon screen and have no choices. Even under safe mode the Admin option is not available, i tried "Ctrl + Del" to go into the manual option, and manually type any of the customers screen names, and this also dosent work. Im trying to solve this issue with out doing a system restore.

thanks

I frig with xp a bit ,just wondering you say you don't want to do a system restore ,why not !or do you mean a OS reload ,also if you have no admin acct in safe mode what do you get !
What about booting to the Winxp cd and doing a SFC \SCANNOW

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O4 - HKCU\..\Run: [Instant Access] rundll32.exe EGDHTML_1026.dll,InstantAccess
This next one optional ,but recomended as it a rescource hog
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia.cab

reboot computer and post a new log

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

Caperjack,

I can't believe that is all I had to do! I have been sitting here for weeks barking up different wrong trees -- since it disappeared so suddenly I assumed it was something terrible. A million thanks.

Ben

Your Welcome .hard to believe ,I didn't really think that was it ,just a quess!

About a week ago the entire top of my Explorer browser disappeared. I.e. I have no forward/backward buttons, no address bar, nothing. I have not been able to determine how this happened or what I can do to fix it. Luckily my homepage has a websearch option on it so I am not completely disabled but I would really like to know what to do about this.
Can someone out there help?
Thanks a lot,
Ben in Holland

Hit the f11 or run the mouse over the toolbar,see if you get anything .if you have all the different stuff unchecked when you right click on the toolbar and auto hide on , and hit the f11 key you would have nothing showing untill you pass the mouse over the toolbar

The windows rundll32.exe,is in the c:\windows\system32 folder but there is also a Bad rundll32.exe created bu a virus ,but not put in the system folder,.Please follow instruction below.
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" …

I'm gonna format again and get windows update on before i connect to the internet.....ty for your help and quick replies.

Good Idea,good luck

Having exactly the same problem,

If so then just follow the steps giving to the originator of this thread.
Fix this one to.
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocach...etup1.0.0.8.cab

You will need to get windows updates SP2 somehow to install before you go online ,download it on another computer maybe and burn a copy and install it on you machine . If I were you I would get a copy some how and format and reload winxp and the sp2 right after that ,sp2 best on a clean install ! Download it here .SP2 Or HERE
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)
Fix all instances of these !
O4 - HKLM\..\Run: [Start Upping] windupdts.exe

O4 - HKLM\..\Run: [cosine] cosine.exe

O4 - HKLM\..\Run: [start uploading] crsss.exe

Now reboot into safe mode and delete the following files and folders if found .

C:\WINDOWS\System32\cosine.exe,,,,,,,,deleted file

C:\WINDOWS\System32\windupdts.exe ,,,,,,,deleted file

C:\WINDOWS\System32\crsss.exe ,,,,,,,deleted file

to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

I booted the Windows Xp cd with just the 60gb connected and it went into the usuall startup (blue and white). i went to repair and did the 60gb. All it gives me is C:\windows>

What do i type in there or what do i do....
I typed help to get my commands but my graphics is messed so it doesnt display all the characters right so i miss type.

... the Novell Netware thing comes Right after the detecting of the drives at the begining if the 60gb is the master. or boot.

this is so frustrating please help... and thanx for the help so far.

it should be, 1 c:\windows > right, type in the numper 1
anyway ,check this out .
Microsoft

how is that piggybacking? we are on the sp2 subject

This is a help fourm ,not a discusion fourm !

http://www.trials-shack.co.uk/posting.html

!!!!!Spyware!!

If one of the drive is a maxtor,MAXBLAST will make [The copy feature lets you make an exact duplicate of your existing hard drive.]a copy

This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

This problem could occur because of Spyware , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Spyware & Trojans and Other Nasties
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. HijackThis
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

In safe mode you should scan with you anti virus checker

Hey all. Just want to know wether or not it is possible to extract sounds from a windows executable (.exe)? If so how do i do it? The reason i ask is because i have a cool little game with mad sounds and i would really like to put some on my cell!

cheers

Install the game,go to its install folder and you should see a folder called sounds or sound files ,if you will be able to transfer them to your cel is another ?

[IMG]http://www.spywareinfo.com/forums/html/emoticons/smashcomp.gif[/IMG]Don't give up !![IMG]http://www.spywareinfo.com/forums/html/emoticons/wall.gif[/IMG]

Hi!
Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!

1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please delete your temporary files by deleting all files and folders that are in those folders (do not delete the temp folder itself) like for example
C:\WINDOWS\Temp\
C:\Temp\
C:\Documents and Settings\username\Local Settings\Temp\
Also delete your Temporary Internet Files, be sure to also select delete all offline content.

Do a virus scan

I turned it off, but now I have a red shield system tray icon warning me that they should be turned on. It clutters up the tray and keeps making stupid speech ballons every five minutes, minimizing full screen programs. I had no choice but to turn the updates back on.

ok ,mine is off and i don't have the red shield in the sys tray any more ,i think if you right or just click on the red shield you get options ,you can close the security

Try to do a repair of IE.Repair IE

just look over her shoulder and say gottcha!,or hook up a display projector and point it to the celing abover her workstation.LOL

I haven't see anything around to do that .