caperjack 875 I hate 20 Questions Team Colleague

SP2 is good, in my opinion best installed on a fresh install of windows from the free disk that microsoft sent me !
But i have installed it on a old install with out any problems.

caperjack 875 I hate 20 Questions Team Colleague

If ,"programatically" means 3rd pardy software i've never heard of such a program .now that doesn't mean there isn't a way to do it .!

caperjack 875 I hate 20 Questions Team Colleague

Is it possible to save an entire folder during a system reboot? I have some rather large applications that would be a hassle to download if I coudlnt save them. Is it possible to drag a program file into a special place to where it would be saved if I completely restarted my entire computer to factory settings?

Any help appreciated,
JT

No ,unless you had you hard drive setup with 2 partitions ,first one with windows on it and the second for storage ,you could save it to the second partition ,because when you do a full restore of windows the partition with windows installed on it gets wiped clean .
you could get another hardrive and install it as a slave and copy the files to it ,and after you restore copy them back.

caperjack 875 I hate 20 Questions Team Colleague

download rhe home editon of htis program and it will tell you what display chipse you haveand may even have a kink it the intel site if not go to Intel.com and search for the chipset it says you have ;,
http://www.lavalys.com/products.php?lang=en

caperjack 875 I hate 20 Questions Team Colleague

That would be great!

Thanks

give me a couple of days to get it all together.really busy right now !

caperjack 875 I hate 20 Questions Team Colleague

Err... I guess I just need to put this out here-

I don't agree with that statement in cases where suspect files have already been identified in the Restore folder:

a) The infected files could get restored at some point during out troubleshoot.

b) I've been active here long enough to trust in the fact that our crew of security responders (you, crunchie, dlh6213, etc.) all know their stuff well enough that if a member follows our instructions exactly; they will not have to resort to a restore. I cannot recall any thread in which someone here has gotten to that point as a result of the advice we've given.

I mean the above as a compliment more than anything else at all; I hope it isn't taken the wrong way...

- Dave

opinion well taken,There's always a first time!! hehe :)

caperjack 875 I hate 20 Questions Team Colleague

ok but i should be very careful doingn anything without system restore on because it deletes past records right?

No ,you already lost past records if you turned it off !
In my opinion it better to wait until its fixed before you turn off system restore ,just in case ,a bad restore is better than no restore !if something go wrong with the Fixes

caperjack 875 I hate 20 Questions Team Colleague

surely i am not an expert but i would suggest not to use norton its really not worth !!instead theres a new type of firewll just released its clled blackice firewall. i dont know on which site it is found but just use any search engine and type blackice firewall guess this could give you a lead. the best antivirusi know is avg, panda and mcafee. so if you can a copy or just buy any ooone of these it can solve your problem. also a firewall is necessary nowadays.

hope i was of any help
any further doubts just post it right here

oops 4got 2 tell u. u can subcribe to the macafee web site and thay can email u as new softwares crop up!1 :mrgreen:

just wanted to say I have been on the net since 1997,and BlackIce was around then And wasn't concidered any good and the last i checked still isn't!
By those who know how to us a fiewall ZoneAlarm is concidered the best and the one I liked the best when i used a firewall other than the XP one !

caperjack 875 I hate 20 Questions Team Colleague

hey,
i'm trying to install norton antivirus 2003 again as someone uninstalled it a while ago trying to install some other anti-virus. but it says that Norton WMI Update program still exist on this computer. and it won't let me install it.
i've tried deleating the registry files that have to do with norton as advised by a friend, but i can't solve this problem.
i'd appritiate the help
thankyou

Look in Control panel /add and remove programs for the notons WMI updates and if there unindtall it from there or go into c:\programs files and delete any folder called norton if there

caperjack 875 I hate 20 Questions Team Colleague

Jack (or others)

How didyou fix this..I have the same exact computer and issue, even tried a new cd rom..Help please

Not sure how to fix the problem ,i didn't fix it i swaped the 48x for a 12x .
I think it might be a problem with the IED chnnel difference !

caperjack 875 I hate 20 Questions Team Colleague

most important thing would be to get the CWShredder program and run it .it should clean most of what is bad in the hijack log .

caperjack 875 I hate 20 Questions Team Colleague
caperjack 875 I hate 20 Questions Team Colleague

help please i down loded xp2 since then i cant get into my yahoo account to answer my mail did i install this thing worong should i remove this update also i have address in my mail box i dont even know lol just what is this xp2 suppose to do thanx for the help

You really should fix one problem at a time and stop downloading programs until you fix you first problem ,.
Device manager is in the Hardware section ,when you right click on mycomputer /properties/hardware /device manager !

caperjack 875 I hate 20 Questions Team Colleague

hi i think the code28 means win xp didn't have the required drivers in it driver dadabase for the device ,did you not get drivers with the device !!

In device manager try uninstall it ,and rebooting computer and inserting the device again !

caperjack 875 I hate 20 Questions Team Colleague

Do as suggested above and then run this program and then rerun hikackthis and posta new log .
,,,,,,,,,,,,,,,,,,,,,
Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
[

We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT/tsgen...001052409420406

caperjack 875 I hate 20 Questions Team Colleague

Thats good lets see a fresh log just to see if all is gone
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

  1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  4. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer …
caperjack 875 I hate 20 Questions Team Colleague

Run hijack again make sure all other windows are closed excpt hijack and fix this one

O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\WINDOWS\msopt.dll (file missing)

Log looks good othaer than that one .!good luck :)

caperjack 875 I hate 20 Questions Team Colleague

You go into Device manager by right clicking on mycomputer /properties /,hardware/device manager /and you will see usb in the list , hit the + and hilite each one in the list ,and delete all what there and reboot computer and windows will reinstall them ,

caperjack 875 I hate 20 Questions Team Colleague

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,


Scanning in Spybot Search and Destroy:

1. Downloaded and Install Spybot S&D, accepting the Default Settings

2. In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.

3. Close ALL windows except Spybot S&D

4. Click the button to ‘Search for Updates’ then download and install the Updates.

5. Next click the button ‘Check for Problems’

6. When Spybot is complete, it will be showing ‘RED’ entries bold 'Black' entries and ‘GREEN’ entries in the window

7. Make certain there is a check mark beside all of the RED entries ONLY.

8. Choose ‘Fix Selected Problems’ and allow Spybot to fix the RED entries.

9.REBOOT to complete the scan and clear memory.


Finally if you are going to run both Spybot SD and Ad-Aware SE, leave the rescan with HijackThis until you have completed running both tools. If only running Spybot SD then RESCAN with HijackThis and POST your logfile in the same thread using ‘Add Reply’. Please do not attempt to fix anything in HijackThis yourself!


Scanning With Ad-Aware SE :

1. Download and Install Ad-Aware SE, keeping the default options. However, some of the settings will need to be changed before your first scan

2.Close ALL windows

caperjack 875 I hate 20 Questions Team Colleague

Lets start with this .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

You have a pepper infection

the uninstaller is available from these locations:-
http://www.memorywatcher.com/uninst.exe
http://www.mjc1.com/files/peperpage/uninst.exe
http://www.downloads.subratam.org/uninst.exe

When you run the uninstaller, you MUST have an internet connection active for it to work.

Please run this twice with a reboot in between.

caperjack 875 I hate 20 Questions Team Colleague

O16 - DPF: {8F24DE00-0D66-4F93-9405-3F21E97AEE99} (TestingCtl Control) - http://esb.alcena.com/ESBAdultInstaller.ocx
lol, porn. Im glad your problem is sovled, but stay away from them dirty sites! There are some porn sites that are clean but ill fail to mention them.

We don't acuse people of intentionally visiting those type of sites ,as a lot of other sites can be hacked and un-intentionally take the person to porn sites .!:)

caperjack 875 I hate 20 Questions Team Colleague

Hi ,check the link in my signature of Rouge Spyware tools it makes the list .
this is what it says about it .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
aggressive, deceptive advertising (1, 2); questionable license terms; false positives work as goad to purchase (1, 2, 3, 4); same app as SpyBurn; Ad-aware knockoff - (Note: other domains associated with XoftSpy -- most of which were formerly associated with SpyHunter -- include: adware-destroyer.com, adware-elimination.com, adwarekillers.com, adwares.net, anti-adware.net, antispywares.com, deletespyware.net, removespyware.net, softspy.net, softwho.com, spyware-detection.net, spywareprof.com, spywarepurge.com, spywarerem.com, spywareremoval.net)

caperjack 875 I hate 20 Questions Team Colleague

just putting the link in so it will work without copy/ past.
Linksys Router

caperjack 875 I hate 20 Questions Team Colleague

Sorry for my late reply. Thanks for your advice, Crunchie. When I deleted it my problems were solved. I still have Windows Adcontrol, I see no reason why I should delete it.

AdControl is considered Malware!keep it if you wish ,but why I don't know !!

Malware definition =

caperjack 875 I hate 20 Questions Team Colleague

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

  1. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  2. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  3. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  4. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new …
caperjack 875 I hate 20 Questions Team Colleague

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O4 - HKLM\..\Run: [Windows TaskAd] C:\Program Files\Windows TaskAd\WinTaskAd.exe


Now reboot into safe mode and delete the following files and folders if found .

C:\Program Files\Windows TaskAd,,,,,,,delete this folder

to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

caperjack 875 I hate 20 Questions Team Colleague

Your Hijackthis is outdated please download a new version .and also you are running it from a temp folder not a good idea, please foll the instructions below !

,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,


Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

caperjack 875 I hate 20 Questions Team Colleague

You might find an answer here

caperjack 875 I hate 20 Questions Team Colleague

Glad to have helped .

caperjack 875 I hate 20 Questions Team Colleague

PROS: Very ,Very Nice
Con : the Scull is a little twisted to my left .and tiped down a little to far .But i really think you did a great job !:)

caperjack 875 I hate 20 Questions Team Colleague

just copy it .exe into you strtup folder .both can be found in c:\windows

caperjack 875 I hate 20 Questions Team Colleague

The top of you log is missing please include it in the next log .
Also Hijackthis should be run from a folder of its own ,create a new folder on you c:\,call it HJT and copy hijackthis.exe from where you have it now and run it from there and then fix the following .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

R3 - Default URLSearchHook is missing

O2 - BHO: &EliteBar - {28CAEFF3-0F18-4036-B504-51D73BD81ABC} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O3 - Toolbar: &EliteBar - {825CF5BD-8862-4430-B771-0C15C5CA8DEF} - C:\WINDOWS\EliteToolBar\EliteToolBar version 58.dll

O4 - HKLM\..\Run: [kalvsys] C:\windows\system32\kalvfeu32.exe

If you didn't add AOL here ,have hijackthis fix it .

O15 - Trusted Zone: http://free.aol.com

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/156e899...ip/RdxIE601.cab

If you know these to be you IP then leave it if not fix.

O17 - HKLM\System\CCS\Services\Tcpip\..\{15A215F4-EA59-49FB-A45C-C2D7F4626BD6}: NameServer = 165.21.83.88 165.21.100.88

O17 - HKLM\System\CS1\Services\Tcpip\..\{15A215F4-EA59-49FB-A45C-C2D7F4626BD6}: NameServer = 165.21.83.88 165.21.100.88


Now reboot into safe mode and delete the following files and folders if found .

C:\windows\system32\kalvfeu32.exe,,,,delete file in red


to delete the above files and folder you will need to do the following
go to

caperjack 875 I hate 20 Questions Team Colleague

Please run these free online Virus scan

Be sure to Check off Auto Fix on this site

http://housecall.trendmicro.com/housecall/start_corp.asp
please run this one also to be sure .

http://www.pandasoftware.com/activescan/com/activescan_principal.htm

caperjack 875 I hate 20 Questions Team Colleague

Hello everyone!

I am using PartitionMagic 8.0 to convert the current format (NTFS) of partition into FAT32. But whenever I apply the changes and restart my computer, it says something like that:

Error 100. Partition table is bad.

Does anyone know what is the problem?

Thanks in advacne!

And you could find my computer specification in my profile...

Your not alone !
http://www.google.com/search?sourceid=navclient-menuext&ie=UTF-8&q=%22Error+100%2E+Partition+table+is+bad%2E%22

caperjack 875 I hate 20 Questions Team Colleague

Then please boot to safe mode (tap f8 while bios loads) the scan with hijackthis again and put a check besdie these lines and choose FIX.
. Make sure all browser and all Windows Explorer windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://win-eto.com/sp.htm?id=9

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://win-eto.com/sp.htm?id=9

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=9

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=9

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://win-eto.com/hp.htm?id=9

O4 - HKLM\..\Run: [ComcastSUPPORT] C:\Program Files\Support.com\bin\tgkill.exe /cleaneahtioga /start

O4 - HKLM\..\Run: [Control handler] C:\WINDOWS\System32\uuj3lfs26crythd.exe

O4 - Global Startup: winlogin.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Help - {05A5E11B-30C4-46AA-8986-28699DD0C93D} - http://www.comcast.net/memberservices/ (file missing) (HKCU)

O9 - Extra button: ComcastHSI - {276F582B-DFE6-4982-AFCC-2D9E1726F873} - http://www.comcast.net (file missing) (HKCU)

O9 - Extra button: Support - {7C9E75A9-04DD-4FC1-8A4B-4268092A846D} - http://www.comcastsupport.com (file missing) (HKCU)

O20 - AppInit_DLLs: 9dowygkzcivtyxll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.

while still in safe mode and delete the following files and folders if found .

C:\WINDOWS\System32\uuj3lfs26crythd.exe,,,,,,,delete this file


winlogin.exe<<<Delete this file. PLEASE NOTE Notice this bad file has an i where the real file has an o which can be seen here >>> winlogon.exe. Do not delete the file with the O but the one with the i or you will not be able to logon anymore.


caperjack 875 I hate 20 Questions Team Colleague

Download then unzip and run CWShredder to clean up clicking "FIX" to have it remove all it finds.

CWShredder available from these places :-

http://www.zerosrealm.com/downloads.php
http://www.aluriasoftware.com/tools/cwshredder.zip
Or this as a full download without any unzipping required
http://www.downloads.subratam.org/CWShredder.exe
http://www.spywareinfo.com/downloads/tools/CWShredder.exe

We have found that some of the CWS infections can be removed better from safe mode, rather than normal mode.
To get to safe mode use the F8 key while booting the machine. Detailed instructions from here :-
http://service1.symantec.com/SUPPORT/tsgen...001052409420406

caperjack 875 I hate 20 Questions Team Colleague

Nope! I searched all of it and I can't find it. I would be nice to install with VPC and mess around with it.

I have 3.11 on floppies ,i could zip them up and email them to you if you want .

caperjack 875 I hate 20 Questions Team Colleague

I have no windows sound scheme set and I just checked mine and it makes a beep from the computer case internal speaker ,that may well be you noise.

I just set a windows sound scheme and the beep from the case speaker goes away !!

caperjack 875 I hate 20 Questions Team Colleague

Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary.
,,,,,,,,,,,,,,,,,,
The very top of you log is missing the part that tell you OS ,please put in the next log .
,,,,,,,,,,,,,,,,,,,,,,,,,

Do ALT+CTRL+DEL /go to process and right click on these 2 and end process .
C:\Program Files\Windows TaskAd\WinTaskAd.exe
C:\Program Files\Windows TaskAd\WinSched.exe

Then do the following

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k


O4 - HKLM\..\Run: [Windows Task Manager] C:\windows\system32\taskmgn.exe

Cant find any info on this ,not sure if it a legit windows update wating to be downloaded or what do you know ,have hijack fix it if you don't have windows updated waiting to be downloaded .

WindowsUpdate82465[1].exe

And this one ,but I would fix them all just to be safe as the good one will download when you go back to that site .
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} …

caperjack 875 I hate 20 Questions Team Colleague

Well before checking here ,I would check with your new Host !!:)

caperjack 875 I hate 20 Questions Team Colleague

A specific device or all the usb ports ,if all you could try going into Device manager and reinstall the usb ports .

caperjack 875 I hate 20 Questions Team Colleague

This problem can occur because of Spywar , go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Security
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

caperjack 875 I hate 20 Questions Team Colleague

This problem can occur because of Spywar , if you had Spyware/trojans problem lately and something got fix wrong it could have caused the winsoc error .go on over to the Security section of this fourm and post you problem along with a hijackthis log .
Security
,,,,,,,,,,,,,,,,,,,,,,,,
Please Don't post the hijackthis log in this section Thanks .
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,

Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

caperjack 875 I hate 20 Questions Team Colleague

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O2 - BHO: IEHelper - {246d1884-0e55-440a-abc4-1f21339ad82a} - C:\WINNT\system32\Q299068327.dll

O4 - HKLM\..\Run: [MSNSysRestore] C:\WINNT\system32\pc32.exe bg

This one is baddie , the 016s' fix them all and the good ones will download again when you visit that site.

O16 - DPF: {8F24DE00-0D66-4F93-9405-3F21E97AEE99} (TestingCtl Control) - http://esb.alcena.com/ESBAdultInstaller.ocx
-EasySearchBar

O19 - User stylesheet: (file missing)

O19 - User stylesheet: (file missing) (HKLM)

Now reboot into safe mode and delete the following files and folders if found .

C:\WINNT\system32\pc32.exe bg........delete file,,pc32.exe bg

to delete the above files and folder you will need to do the following
go to
Show hidden files & folders

"Fix Checked"...Reboot to SAFE mode to delete files
How to start computer in safe mode

reboot computer and post a new log

caperjack 875 I hate 20 Questions Team Colleague

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
===Is for Adobe Reader != OK

,,,,,,,,,,,,,,,,,,,,,,,,
{AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

Is for Google tool Bar= OK
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
=== is for Internet Explorer Radio Bar =OK
,,,,,,,,,,,,,,,,
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html=
Is for Google ,when you right click on a web site its in the menu ,BackWard Links =OK

,,,,,,,,,,,,,,,,,,,
You log looks OK actually the only thing I notice is You haven't been to Windows updates ,lately and got any of the Security Updates ,but that OK ,if you keep a tight ship it won't leak Anyway!!
,,,,,,,,,,,,,,,,,,,,,,
And This in the Running process [C:\WINNT\TEMP\_INS0432._MP] in a temp folder makes it look suspisious !! only info I find on it is it seems to be related to and error report !GOOGLE Search

Sphyenx commented: Great, and helpful! +1
caperjack 875 I hate 20 Questions Team Colleague

Please do this.
Download 'Hijack This!'. http://www.spywareinfo.com/~merijn/files/HijackThis.exe
Save it in a convenient permanent folder such as C:\HJT\, double click HijackThis.exe, and hit "Scan".

Your copy of HijackThis needs to be in a folder of it's own. When HJT fixes anything, it makes backups of the original files in the folder it is in. Since Temporary folders are emptied now and then (the files are DELETED), it would not be a good idea to have your backups there. Those backups would be VITAL to restoring your system if something went wrong in the FIX process!


1. Please go to you're 'My Documents' folder, right-click and select 'New > Folder' then name the folder 'HJT'.

2. Copy and paste HijackThis.exe to the new folder.

3. Close ALL windows except HJT

4. SCAN with HJT

5. POST the new log in this thread using 'Add Reply'

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH

caperjack 875 I hate 20 Questions Team Colleague

like will Dirct x 9c still work?
all my printer drivers,
any vital drivers that are important, will they still work?

I load these type of windows software BETA!!!,and do so to see if things will work .Just do it more fun to find out fur yer Self !!:)

caperjack 875 I hate 20 Questions Team Colleague

Sounds good but how do you make the DOS boot disk? I could do it on my computer and then take it to hers but I have no idea what to do to make the DOS boot disk.

Ally

go into mycomputer /control panel /add and remove programs ,and you will see create boot disk ,just put a clean floppy in you drive and click OK

caperjack 875 I hate 20 Questions Team Colleague

Hey I am running windows ME and I have nero burning 5. I need to know how to format a cd. I see the icon in the taskbar for formatting but when i put a blank cd in and then i get to about the third step and it tells me to insert a blank cd, and it wont read the one i have in there, and it wont let me go any further, if anybody knows how to do this it would be greatly appreciated.

Im almost sure it for formating CD-RW 's[ReWritables] but i thought you would need neros INCD for that .Im using nero 6 and InCd ,but the ReWritables I use are about 5 yrs old and I formated them with EasyCd Creators programs .

caperjack 875 I hate 20 Questions Team Colleague

Wait, it couldnt be sasser, lol. Every AV picks it up. Also I dont thinmk sasser is a boot sector virus. It could be a problem with some hardware, (maybe). but Definatly windows. Well thats BOD for you. Good luck removing the problem. Hint, i know formatings a bit*h, but heres what you do, make a DOS boot up disk on another PC, and stick it in that bad boy on reboot, type this FORMAT $driveletter: and then type Y to question, get out windows disks and your good to go!

You should change you nicname to FORMAT ,seems to be your favoite topic!:) LOL