After I did step 2, and I double clicked the Appinit.bat file on the desktop, I couldnt open it any more. It pops open for a second and then disappears, when I right click the icon I can copy it, so here is that try…
and it doesnt work, it only pops up for a second then disappears
will work on the next step in a few the zipped part, gotta feed the 6mo old
Try going to Start>All Programs>Accessories>Wordpad and use wordpad to open the windows.txt file not AppInit.bat. The AppInit.bat file is supposed to do exactly what it did, open and close very quickly. Your copy of Notepad appears to be infected by the pest.
You should have a copy of notepad that is not infected in C:\Windows\System32\dllcache . It should be 68kb. Copy this one to both C:\Windows and C:\Windows\System32\ - we will probably have to repeat this when you are clean but for the time being do this.
hmmm it should have made one when you double clicked on AppInit.bat and the window opened and closed again fast. Can you please try to do Start>Search>Windows.txt?
Wel here it is October 12th, and somehow the computer got fixed…LOL…I have no idea what I did but I left the modem on all day and still havent found any bugs…by the way there is a file from wordpad on my desktop intitled "desktop"…my highjack log has been clean for over 8 hrs….I thank all of you who helped (I hope this isnt premature)…you are honestly a great service to many mnay people.
This is what is in the desktop file(wordpad)
[LocalizedFileNames]
Windows Media Player.lnk=@C:\WINDOWS\inf\unregmp2.exe,-4
and this is the highjack log I have had all day…
Logfile of HijackThis v1.98.2
Scan saved at 3:57:56 PM, on 10/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
So far so good, I never was able to do that last task you asked for…but if there is something I can do still let me know….My "Ubber Virus" probrably is just morphed somewhere
Hello MI-Fireman897
That wordpad file looks like a link to Windows Media Player that changed it's extension to .txt and opened in wordpad for some reason. Try checking the properties of it and see what they say. I have that file in that directory on my copy of XP . If you find that it appears to be a link for windows media player in the properties, then delete it and then make a new shortcut to windows media player.
Your log looks clean Congratulations! However have you tried opening IE yet? I would try opening IE and see what happens after a reboot. If nothing is changed in the HJT log then consider it clean. IF you want to post it here I'll be happy to look at it
You were right, but it seemed to take awhile for them to get me..the "Uber Virus" is back….
Logfile of HijackThis v1.98.2
Scan saved at 10:06:58 PM, on 10/12/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
You know I had an old computerm that I put together from spares….never had a problem (till it caught on fire 3 years later) ….bought this Dell, and since day once I've had software issues of somesort or the other…maybe my brother was right, he swears by Apple
So I guess Im back to square one, hope your still here with me
Well we have a new variant this time, it is the one with the hidden dll and now we are back to square one with trying to find it again. First of all find out the condition of notepad.exe check both copies, the one in C:\Windows and the one in C:\Windows\System32. If notepad works then try using AppInit.Bat again and see if you get a Windows.txt file appearing on your Desktop. If you do, please post the contents of it.
If notepad doesn't work try copying the notepad.exe from C:\Windows\System32\dllcache\ to both C:\Windows and C:\Windows\System32.
If that fails you can download notepad.exe from Merijn's Files Click on Windows Files on the left side of the page and then you will find notepad.exe in the center of the page.
There is another tool that I would like you to download and use and then post the log from. I think we may have a complicated infection here. This tool will tell us how complicated the fix is.
Extract the file to the c:\ drive. Then navigate to the c:\getservices and double-click on the getservices.bat file. A notepad will open up. Please paste the contents of that notepad as a reply to this post.
If this doesn't produce the logs that I need then we will have to go into the registry being very cautious and check out some settings there.
This topic will be closed because it has been inactive for 21 days.
If you need it reopened, please send an email to the following (Click for address) with the Subject line of the email "Reopen".
To receive a response, please include in your email: your post user name, details of why you need it reopened, and a valid link to your post.
Emails with bad links to the post, emails that are not from the original poster, and emails that do not have "ReOpen" as the subject line, will be deleted without being opening.
Please start a New Topic if this is not your thread. Thank-you for your co-operation.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
