Posts by caperjack

OK give me about 1 hr ,will look over log ,but also have to have breakfast !:)
Also please unzip hijack this to its own folder something like C:\HJT\hijackthis.exe ,for when it makes backups .

Ok some baddies in there we will start by removing the Coolwebsearch one with CWShredder ,download and update it and run it hitting FIX and not scan ,after that,reboot computer and then post a fresh hijackthis log thanks

You can fix all or any of these .make sure to close all window programs and IE browsers before fixing .

If you didn't put this in you host file you can fix it .
O1 - Hosts: 12.129.205.209 search.netscape.com12.129.205.209 sitefinder.verisign.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://rd.yahoo.com/customize/ymsgr...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/customize/ymsgr...//www.yahoo.com

R3 - URLSearchHook: (no name) - _{5D60FF48-95BE-4956-B4C6-6BB168A70310} - (no file)

R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)

this one is releated to ebay toolbar ,you can remove it
O3 - Toolbar: (no name) - {46AE04C0-BCFA-4728-90E7-00EB4A8B3863} - (no file)

I would go to control panel ,add/removeprograms and uninstall this as it is not needed .
O4 - HKLM\..\Run: [P2P NETWORKING] C:\WINDOWS.000\SYSTEM\P2P NETWORKING\P2P

O16 - DPF: {F5192746-22D6-41BD-9D2D-1E75D14FBD3C} - http://download.rfwnad.com/cab/crack.CAB

you can saftely fix any of the 016's as they will come back when you go to the site again ,most are no problem the one above should be fixed .
After you fix them reboot the computer and post a fresh log .

still checking on this one .
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS.000\SYSTEM\blank.htm

EDIT : safe to fix above R0

No guarentees, as it could be a couple things, but please do these:

Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/
After installing AAW, and before running the program, FIRST update the reference file following these instructions.
http://www.lavahelp.com/howto/updref/index.html
Now do the following:
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
check: "Unload recognized processes during scanning."
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
Check: "Let Windows remove files in use after reboot."
Press "Scan Now"
- Check option "Use Custom scanning options"
- Check option "Activate In-Depth Scan"
- Press "Select drives\folders to scan"
- Select the active partition which is usually C:
Now press "Next" to let Ad-aware scan your drives...
It will find a number of "bad" files and registry keys.
Right-click in that pane and choose "select all"
Now press "Next" again.
It will ask you whether you'd like to remove all checked items. Click OK.
Finally, close Ad-Aware, and reboot.

Then:
Download 'Hijack This!'. http://www.computercops.biz/downloads-file-328.html
Unzip (extract) it to a folder of its own. Then Doubleclick HijackThis.exe (in the new folder), and hit "Scan".
When the scan is finished, the "Scan" button will change into a "Save Log" button.
Press that, then Ctrl-A to Select All, and copy its contents here.for hijackthis …

i restarted my computer and now its back to using "http://66.103.153.158" as the home page... how do i get rid of this.

Don't see anything bad in you new log ,have you tried changing it back in IE Tools/internet options .
Make sure all windows programs and browser windows are closed and run hijackthis and post a new log again ,thanks

also, the part of your message that says "this needs attention for safer surfing"... im not sure what you mean by this or what you want me to do... please explain

that was in reference to the windows updates .

Scan saved at 8:46:54 PM, on 3/13/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

you now have IE SP1

I think to do that you would have to write a program to turn off the bar on my computer , and load it on the My computer when I go to the site .how else could you have control over what my computer does .

Hi ,you might be better served by doing a Google Search

just format the one you are not using .
Format drive
or if you are running one as slave and not using it ! just go into mycomputer and right click the slave drive and clcik format .

Disable your firewall and, if applicable, its code blocking features.
For more info:
http://forums.zonelabs.com/zonelabs/board/message?board.id=gen&message.id=9686

Grace and Peace,
Tollie
tollie.org

your first post, and you used it to respond to a post from OCT 2003 :)???

have you tried right clciking on the little bar !:)
And don't come back some day and ask how to get that great little feature back .LOL

so you fix everything hijackthis finds !and nothing happens to your computer !:)

but nobody helped You !:)

what did you do to fix it ,always nice to know

First put hijackthis.exe in it own folder on the desktop,for backups.

run hijack and fix this
O4 - HKLM\..\Run: [f899MCESF] C:\WINDOWS\imWl2X.exe

The NPDocBox entry is an Adobe Acrobat plugin
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll

Reboot into safe mode and delete this file

C:\WINDOWS\ imWl2X.exe>>> file only

Reboot and then post a fresh log

you could run the online virus scan in my signature

for the address book in outlook express click the address book in the toolbar and open the address book and go to file and export and back it up to disk,For were the emails are stored go to ,tools /options/maintenence /and partway down you will see store folder ,click it and it will show you where they are stored .then go there and backup that folder

Might i suggest Ad-Aware
Download the latest version of Ad-Aware at http://download.com.com/3000-2144-10045910.html?part=69274&subj=dlpage&tag=button

After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions. http://www.lavahelp.com/howto/updref/index.html

Now do the following:

- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
check: "Unload recognized processes during scanning."

- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
Check: "Let Windows remove files in use after reboot."

Press "Scan Now"

- Check option "Use Custom scanning options"
- Check option "Activate In-Depth Scan"
- Press "Select drives\folders to scan"
- Select the active partition which is usually C:

Now press "Next" to let Ad-aware scan your drives...
It will find a number of "bad" files and registry keys.
Right-click in that pane and choose "select all"

Now press "Next" again.
It will ask you whether you'd like to remove all checked items. Click OK.

Finally, close Ad-Aware, and reboot.
That ought to get rid of most of your spyware.

And after that, please do the following:

Go to http://computercops.biz/downloads-file-328.html , and download Hijack This.

Unzip to a folder other than your Desktop or the Temp folder, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" …

contact Yahoo and paypal

A trip to wimdows updates wouldn't hurt .

Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Also I would be a little suspisious of this ,do you know what it is.
O4 - HKLM\..\Run: [ClocX] F:\Clockx\ClocX.exe

all you need to know about svchost.exe

>:)

is you anti viri program setup to scan on startup and also is it set to scan the floppy drive

This is taken from the memtest86 site .

Troubleshooting Memory Errors
Please be aware that not all errors reported by Memtest86 are due to bad memory. The test implicitly tests the CPU, L1 and L2 caches as well as the motherboard. It is impossible for the test to determine what causes the failure to occur. However, most failures will be due to a problem with memory module. When it is not, the only option is to replace parts until the failure is corrected.

No, the best way is to place a shortcut IN THE Startup folder. The easiest way to do this is to right-click on the icon for the program or script you want to start with Windows and then Send to -> Desktop. This will place a shortcut on the Desktop. Left-click and drag the icon over the Start button. While continuing to hold the left mouse-button, the Start menu will pop up. Simply drag the icon into the Startup folder and let go of the button -- voila!

all Right it's been said a couple times now that i am wrong ,i did mean a short cut and not move the exe it just came out wrong

No guarentees, as it could be a couple things, but please do these:

Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/
After installing AAW, and before running the program, FIRST update the reference file following these instructions.
http://www.lavahelp.com/howto/updref/index.html
Now do the following:
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
check: "Unload recognized processes during scanning."
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
Check: "Let Windows remove files in use after reboot."
Press "Scan Now"
- Check option "Use Custom scanning options"
- Check option "Activate In-Depth Scan"
- Press "Select drives\folders to scan"
- Select the active partition which is usually C:
Now press "Next" to let Ad-aware scan your drives...
It will find a number of "bad" files and registry keys.
Right-click in that pane and choose "select all"
Now press "Next" again.
It will ask you whether you'd like to remove all checked items. Click OK.
Finally, close Ad-Aware, and reboot.
then post a new hijack this log here .

Log looks good now !
Not sure what the exe was another i was going to sudmitt it to a site that checks them to see where they orignate

i need help with error messages on windows xp

i keep getting a wupdater.exe message when i log off windows xp can you help get rid of this or fix it please
:confused:

Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/
After installing AAW, and before running the program, FIRST update the reference file following these instructions.
http://www.lavahelp.com/howto/updref/index.html
Now do the following:
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
check: "Unload recognized processes during scanning."
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
Check: "Let Windows remove files in use after reboot."
Press "Scan Now"
- Check option "Use Custom scanning options"
- Check option "Activate In-Depth Scan"
- Press "Select drives\folders to scan"
- Select the active partition which is usually C:
Now press "Next" to let Ad-aware scan your drives...
It will find a number of "bad" files and registry keys.
Right-click in that pane and choose "select all"
Now press "Next" again.
It will ask you whether you'd like to remove all checked items. Click OK.
Finally, close Ad-Aware, and reboot.

Then:
Download 'Hijack This!'. http://www.computercops.biz/downloads-file-328.html
Unzip (extract) it to a folder of its own. Then Doubleclick HijackThis.exe (in the new folder), and hit "Scan".
When the scan is finished, the "Scan" button will …

http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q178/0/84.asp&NoWebContent=1

I don't see how you could print the scrolling page unless these is a print command in the program and you can choose to print all the pages .

go back into the bios and set the defaults and save changes and exit the bios

Log is clean now .
As for how hard is it relly hard for me .I 50 nad my memory isn't what it use to be and most of it is remembering what you read and getting familiar with the bad one like this one [O4 - HKLM\..\Run: [Antivirus] C:\WINDOWS\av.exe]and many others that look like good exe's .I use 3 programs and 4 or 5 websites to search exe'sand all the others in the logs .
I also am in BootCamp training for hijack logs HERE
In my signature are links to HiJack help sites.

thx :-D, one more thing, these r the only poroigrams i have set to startup cuz im not sure if not letting them startup is the same as ending them. which once can safely not be started up from this list

go HEREand download the toolBar list and look up the programs in the list and it will tell you if it safe to remve from msconfig,
Actually the best way to stop the program from starting isin the properties of most properties .

Unfortunately, the problem is still there. There is hardly any difference in boot time, actually it looks a bit longer.

Did you want me to clean the log or were you just commenting that the log is clean. I was going to delete everything hijackthis has found.

sorry meant to say it is a clean log ,don't delete everythin hijack finds .

Have Hijack This fix the following by placing a check in the appropriate boxes

and selecting fix checked. Make sure all browser and all Windows Explorer

windows are closed before fixing.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.

clientapps.yahoo.com/cus...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.

clientapps.yahoo.com/cus...//www.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.

clientapps.yahoo.com/cus...://my.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.

clientapps.yahoo.com/cus...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.

clientapps.yahoo.com/cus...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://

red.clientapps.yahoo.com/cus...://my.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http

://red.clientapps.yahoo.com/cus...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red

.clientapps.yahoo.com/cus...//www.yahoo.com

O4 - HKLM\..\Run: [Antivirus] C:\WINDOWS\av.exe

O4 - HKLM\..\Run: [RunDLL] rundll32.exe "C:\WINDOWS\Downloaded Program

Files\bridge.dll",Load

O4 - HKLM\..\Run: [ikcohcaa] C:\WINDOWS\System32\yyaxrpad.exe

If you don't want these in you right click list fix them

O8 - Extra context menu item: Yahoo! Dictionary - file:///C:\Program

Files\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! Search - file:///C:\Program Files\Yahoo!

\Common/ycsrch.htm

Reboot to safe mode[hitting the f8 key on bootup] and delete:the following files

C:\WINDOWS\av.exe >--- file only

C:\WINDOWS\Downloaded Program Files\bridge.dll>-- file only

C:\WINDOWS\System32\yyaxrpad.exe >-- file only '
to find the above …

Do a search for winlogon.exe ,if you find more than one you have avirus\trojan .The good one is in c:\windows\system32 ,folder
So do a virus scan if you find more than one file .

Clean LOG,
any difference in you computers boottime .

Greetings,
I said at the top of the page in my first post that neither spybot or ad aware helped me and do not want to uninstall programs i am unsure about so i was asking if those 4 programs were okay to be uninstalled.
Thanks,
Brian

Download 'Hijack This!'.http://www.computercops.biz/downloads-file-328.html
Unzip to a permanent folder,Like C:\HJack\Hijackthis.exe, doubleclick HijackThis.exe, and hit "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log" button.

Press that, save the log, load it in Notepad, and copy its contents here. Most of what it lists will be harmless or even essential, don't fix anything yet.
then post the log here

Have Hijack This fix the following by placing a check in the appropriate boxes and selecting fix checked. Make sure all browser and all Windows Explorer windows are closed before fixing.

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/f...etup1.0.0.5.cab
-FunWebProducts

O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://dload.ipbill.com/del/loader.cab
-Coulomb Dialer Variant

reboot and post a new hijack log

hijackhthis ,is not recomended for a novice computer user ,and is a removal tool used after spybot and ad-aware by someone who knows how to use it right .

Hi, this is my first post :)

It takes my laptop about 5 minutes to complete startup (till hard disk light stops continuous flashing and I can quickly open any application). I have had this problem now for several months.

I don't think I can reformat my system (unless there is no other way) because backing up my files and reinstalling the sofware (too many I have) is a nightmare.

I have a toshiba satellie laptop, 2.2 GHz and 512 RAM, running WinXP home edition service pack 1 with the latest windows updates. I have Trend Micro Internet Security 11 (PC-cillin). A quick look at my "All Programs" is enclosed here as it might help.

Thanks

SoFar_SoGood

No guarentees, as it could be a couple things, but please do these:

Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/
After installing AAW, and before running the program, FIRST update the reference file following these instructions.
http://www.lavahelp.com/howto/updref/index.html
Now do the following:
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
check: "Unload recognized processes during scanning."
- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Cleaning Engine:
Check: "Let Windows remove files in use after reboot."
Press "Scan Now"
- Check option "Use Custom scanning options"
- Check option "Activate In-Depth Scan"
- Press "Select drives\folders to scan"
- Select the active partition which is usually …

http://www.usbnews.net/news/more_and_more_usb_devices_suppor.htm

Greetings,
My problem has not been fixed. I have seen the message
WYSIWYG Editor initialized for internet explorer on 0.141 seconds as well.
I see I have a program called search assistant- my search and when i tried to uninstall it, windows does not! Hmmm...Here are a list of fishy programs I have found in add/remove programs:
genedisk .73MB
NPO none given
Search assistant- My Search .12MB
Web Savings from Ebates none given
When trying to unintall my search and web savings, the screen flickers and doesn't unintall them...i dont know what the other two are. anyone have an idea?
Thanks so much...

So tell me if you can !When you run the programs like Ad-Aware and Spybot does you computer remain the Same !

Looks like I should have read these sites the other day Fat32
NTFS

I begining to think the best thing for people with IE problems it time to start useing Mozilla browser .http://www.mozilla.org/

visit you add/removeprograms and remove programs like Newnet.net,SaveNow,and the like .

some Adware tools and online virus scan, in my signature

ntfs,which makes it good for video editing

I was refering to using the winxp cd to boot toand do the Repair ,not floppies

try booting to winxp cd and do a repair

want to try this ,download hijackthis from here -don't fix anything yet ,post a log
!http://computercops.biz/downloads-file-328.html

check the link in my signature on how to download and run hijackthis

I have a problem with Windows XP Pro Internet Explorer that I can't solve. When on line with IE, it will change my Windows Explorer display format from the "List" file display to the "Tiles" display. At the same time my IE Encoding will be changed from Western European (Windows) to Western European (ISO). If I manually change the Encoding back to Western European (Windows), the Windows Explorer display will remain in the "List" mode until I change to a web site that changes my Encoding back to (ISO). Another symptom is advertising boxes often display the "Action Canceled" message rather than the ad.

I have tried resetting every selection I can find and have removed IE and all its directories and reloaded, but the problem remains. There must be a settings file or registery setting that retains IE's settings. I've had the problem for some time and don't remember when it started. I run the same setup on other computers with no problems.

Help!
Snead

Might i suggest Ad-Aware ,your problem could be Adware releated .
Download the latest version of Ad-Aware at http://www.lavasoftusa.com/support/download/

After installing AAW, and before running the program, you NEED to FIRST update the reference file following these instructions. http://www.lavahelp.com/howto/updref/index.html

Now do the following:

- Under Ad-aware 6 > Settings (Gear at the top) > Tweaks > Scanning Engine:
check: "Unload recognized processes during scanning."

- Under Ad-aware 6 > Settings (Gear at the …

hello can someone please help l am getting a
error loading c:\winnt\system32\bridge.dll

Do a Fourm search on bridge dll ,and then start by creating a new Thread ,this one is started by someone else with a different problem .

Registry - Restore

Press F8 at boot up and you will se the option to load last good configuration (this restores the registry). If you have system restore on then you can restore system files just by booting into safe mode, right click My Computer and selecting properties, now select the restore tab.