Hi,
New member Some guy in Austria has bugged my "Dial up network" properties imposing his properties over mine.
I can't copy and paste my HJT log. When I try to open it I get a Jewel Case Creator dialogue box with the message "The selected file is not a valid Jewelcase document.
Would you please advise?
Regards
Iain Cheyene Cumming Wilson
Greetings and welcome to TomCoyote.org!
Please try this:
Navigate to your log file, on it, choose "Open with" > "Notepad". Then you should be able to paste it in here.
If that doesn't work, try attaching it to this post. Not usually recommended, but in this case, just might be necessary.
Hi Micah 6 : 8
Thanks for tying to help me with your suggestions but:- in the meantime, I wrote out the HJT log to word and copied it from there. Thankfully the log was not too long. I'm hoping that I can get some help with this from you guys.
I've been using Quick Heal for the past decade and this is the first time a hacker has managed to invade my PC. My only wish is that somehow we can get these idiots of the net.
HijackThis Log:- 12/13/2004
• R1-HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar=http://lookfor.cc/sp.php?pin=28129
• R1-HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://lookfor.cc/sp.php?pin=28129
• R0- HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.startsiden.no/
• R0- HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=http://www.startsiden.no
• R1-HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar=http://lookfor.cc/sp.php?pin=28129
• R1-HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://lookfor.cc/sp.php?pin=28129
• R1-HKLM\Software\Microsoft\Internet Explorer\Main,Default_ Page_URL=http://lookfor.cc?pin=28129
• R1-HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://lookfor.cc/sp.php?pin=28129
• 03-Toolbar:My &Web Search-{07B18EA9-A523-4961-B6BB-170DE4475CCA}-C:\PROGRAM FILES\MY WEBSEARCH\BAR\1.BIN\MWSBAR.DLL
• 04-HKLM\..\Run: [Quick Heal Startup Scan] D:\PROGRA~1\QUICKH~1\QHSTRT32.EXE/LOADRUN
• 04-HKLM\..\Run: [Quick Heal Scheduler] D:\PROGRA~1\QUICKH~1\QHSched.EXE/startup
• 04-HKLM\..\Run: [Quick Heal On-Line Protection] D:\PROGRA~1\QUICKH~1\CATEYE.EXE/start
• 04-HKLM\..\Run: [explorer] C:\WINDOWS\system32\explorer.exe-go-c85-w3
• 04-HKLM\..\RunServices: [Quick Heal On-Line Protection] D:\PROGRA~1\QUICKH~1\CATEYE.EXE
• 04-HKCU\..\RUN:[ctfmon.exe] ctfmon.exe
• 04-HKCU\..\RUN:[SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe/0
• 04-HKLM\..\RUNONCE:[Quick Heal Startup Scan] D:\PROGRAM FILES\QUICKHEAL\QHSTRT32.EXE/check
• 015- Trusted Zone:*.05p.com
• 015- Trusted Zone:*.searchmiracle.com
• 015- Trusted Zone:*.clickspring.net
• 015- Trusted Zone:*.blazefind.com
• 015- Trusted Zone:*.mt-download.com
• 015- Trusted Zone:*.flingstone.com
• 015- Trusted Zone:*.slotch.com
• 015- Trusted Zone:*.xxx toolbar.com
• 015- Trusted Zone:*.my-internet.info
• 015- Trusted Zone:*.scoobidoo.com
• 015- Trusted Zone:*.searchbarcash.com
• 015- Trusted Zone:*.amwdabest.com
• 015- Trusted Zone:*.frame.crazywinnings.com
• 015- Trusted Zone:*.static.topconverting.com
• 016- DPF:{D27CDB6E-AE6D-11CF-96B8-444553540000}[Shockwave Flash Object]-http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
• 016- DPF:{11111111-1111-1111-1111-111111113457}-file://c:\ied_s7_cab
• 016- DPF:{11111111-1111-1111-1111-511111113457}-file://c:\x.cab
• 016- DPF:{11111111-1111-1111-1111-511111113458}-file://c:\x.cab
• 016- DPF:{9F1C11AA-197B-4942-BA54 47A8489BB47F} (Update Class)-http://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?38332.0671527778
Cheers from Reindeer land
Logfile of HijackThis v1.97.7
Scan saved at 6:10:42 PM, on 12-Dec-04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "Scan".
Then "check" the box to the left of these item(s):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://lookfor.cc/sp.php?pin=28129
Logfile of HijackThis v1.97.7
Scan saved at 1:01:05 PM, on 16-Dec-04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Logfile of HijackThis v1.97.7
Scan saved at 8:46:00 PM, on 16-Dec-04
Platform: Windows 98 Gold (Win9x 4.10.1998)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.
Follow safe Internet practices:
1. Keep your virus definitions up to date, and scan your system regularly.
2. Don't open email, or download attachments from unrecognized email addresses.
3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.
4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.
5. Keep your Windows and IE current with all the latest patches and updates.
If you want me to help solve your Notepad (or copy/paste) problem, please post in this thread and let me know.
Hi M 6:8
Seasons greetings to you and everyone at TC too
I'm amazed . Thank you for helping me. I've implemented all your recomendations and shall adhere to your advice.
I could do with your help with Notepad. I've looked in accessories and its not there and I've checked my Windows 98 CD and its not there either, so it looks as though I've never used Notepad.
After udating IE, when I open Outlook the following dialog box appears:-
A program is trying to access e-mail addresses you have stored in Outlook. Do you want to allow this? If this is unexpected, it may be a virus and you should choose "no"
Needless to say I choose no. Am I correct in doing so?
Hi M 6:8
Wow! You're assuming I have computer expertise when you wish me to use Registrar Lite.
I think I did what you told me to. The value box showed empty
The complete box showed:-
Keyname: HKEY_DYN_DATA
Value Name: (default)
Type: REG_SZ TYpe no: 00000001
Size: 1
The other boxes showed empty
I downloaded Notepad.exe but still can't use it. I got the following message when I tried to open HJT log with it.
"Cannot find the file "C:\Windows\Notepad.exe(or one of it's components)
Cheyene
Hi M 6:8
"NOTEPAD.EXE" does not exist in "C Windows " folder
cheyenne
Here's a puzzle for you (maybe I can stomp you with this)
ST ND RD "What are the next two letters?"
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
Some guy in Austria has bugged my "Dial up network" properties imposing his properties over mine.
I can't copy and paste my HJT log. When I try to open it I get a Jewel Case Creator dialogue box with the message "The selected file is not a valid Jewelcase document.
Would you please advise?
Regards
Iain Cheyene Cumming Wilson
cheyenne
Is the use of Notepad something you just recently lost? 
. Thank you for helping me. I've implemented all your recomendations and shall adhere to your advice.
Wow! You're assuming I have computer expertise when you wish me to use Registrar Lite.
I think I did what you told me to. The value box showed empty
The complete box showed:-
Keyname: HKEY_DYN_DATA
Value Name: (default)
Type: REG_SZ TYpe no: 00000001
Size: 1
The other boxes showed empty
I downloaded Notepad.exe but still can't use it. I got the following message when I tried to open HJT log with it.
"Cannot find the file "C:\Windows\Notepad.exe(or one of it's components)
