What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Wwwcoolwebsearch And Www.ad-w-a-r-e

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
:P

Here is another one for you to look at …


Logfile of HijackThis v1.98.2
Scan saved at 10:08:31 AM, on 12/19/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\C\WINXP\System32\smss.exe
C:\C\WINXP\system32\winlogon.exe
C:\C\WINXP\system32\services.exe
C:\C\WINXP\system32\lsass.exe
C:\C\WINXP\system32\svchost.exe
C:\C\WINXP\System32\svchost.exe
C:\C\WINXP\system32\spoolsv.exe
C:\C\WINXP\System32\svchost.exe
C:\Program Files\Trend Micro2004\Tmntsrv.exe
C:\Program Files\Trend Micro2004\tmproxy.exe
C:\Program Files\Trend Micro2004\PccPfw.exe
C:\C\WINXP\Explorer.EXE
C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE
C:\Program Files\Trend Micro2004\pccguide.exe
C:\Program Files\Trend Micro2004\PCClient.exe
C:\Program Files\Trend Micro2004\TMOAgent.exe
C:\C\WINXP\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijack this\HijackThis.exe
C:\C\WINXP\system32\taskmgr.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theglobeandmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ———>Weatherbee**
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB003" /M "Stylus C64"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro2004\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro2004\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro2004\TMOAgent.exe" /run
O4 - HKCU\..\Run: [EPSON Stylus C64 Series] C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 EPSON Stylus C64 Series /M Stylus C64 /EF HKCU
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll



Warning! This utility will find legitimate files in addition

to malware.
Do not remove anything unless you are sure you know

what you're doing.

——- System Files in System32 Directory ——-

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32

09/08/2004 12:56 PM dllcache
08/13/2003 01:52 PM 32

{EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat
08/02/2003 11:12 PM Microsoft
09/30/1999 06:21 PM 166,672 mstext35.dll
09/28/1999 08:42 PM 1,050,896 msjet35.dll
09/09/1999 09:06 PM 168,720 msltus35.dll
09/09/1999 09:06 PM 252,688 msexcl35.dll
08/25/1999 01:57 PM 415,504 msrepl35.dll
06/07/1999 05:59 PM 250,128 mspdox35.dll
04/25/1999 04:00 PM 287,504 Msxbse35.dll
8 File(s) 2,592,144 bytes
2 Dir(s) 12,821,741,056 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32

09/08/2004 12:56 PM dllcache
08/19/2003 11:12 PM GroupPolicy
08/13/2003 01:52 PM 32

{EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat
08/02/2003 06:05 PM 488 logonui.exe.manifest
08/02/2003 06:05 PM 488

WindowsLogon.manifest
08/02/2003 06:05 PM 749 wuaucpl.cpl.manifest
08/02/2003 06:05 PM 749 sapi.cpl.manifest
08/02/2003 06:05 PM 749 ncpa.cpl.manifest
08/02/2003 06:05 PM 749 nwc.cpl.manifest
08/02/2003 06:05 PM 749 cdplayer.exe.manifest
09/04/1992 02:26 PM 44,669 Pleap.wav
9 File(s) 49,422 bytes
2 Dir(s) 12,821,739,008 bytes free

———- Files Named "Guard" ————-

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32


——— Temp Files in System32 Directory ——–

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32


—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\C

urrentVersion\Internet Settings\User Agent\Post

Platform]
"{79566745-D0FB-48AE-AF41-6713B6D718E8}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


—————- Xfind Locked Files —————–


————– XFind Qoologic Results ————–


————– XFind Aspack Results —————

* resultC:\C\WINXP\System32\NTDLL.DLL

————– Locate.com Results —————

No matches found.

Post #17
Double-click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\C\WINXP\System32\NTDLL.DLL
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select Yes.


When done with all of the above, close all windows and browsers, run HijackThis, Scan, post a new HijackThis log, and a new Find_It log.
Post #19
Hi :P

Another log file. Anything else I should do ??

:D That download worked to fix my Quick Launch

Do you know what these two are for ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file


Thanks for all your help.



Logfile of HijackThis v1.98.2
Scan saved at 10:40:09 PM, on 12/19/2004
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\C\WINXP\System32\smss.exe
C:\C\WINXP\system32\winlogon.exe
C:\C\WINXP\system32\services.exe
C:\C\WINXP\system32\lsass.exe
C:\C\WINXP\system32\svchost.exe
C:\C\WINXP\System32\svchost.exe
C:\C\WINXP\system32\spoolsv.exe
C:\C\WINXP\System32\svchost.exe
C:\Program Files\Trend Micro2004\Tmntsrv.exe
C:\Program Files\Trend Micro2004\tmproxy.exe
C:\C\WINXP\Explorer.EXE
C:\Program Files\Trend Micro2004\PccPfw.exe
C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE
C:\Program Files\Trend Micro2004\pccguide.exe
C:\Program Files\Trend Micro2004\PCClient.exe
C:\Program Files\Trend Micro2004\TMOAgent.exe
C:\C\WINXP\system32\wuauclt.exe
C:\C\WINXP\system32\taskmgr.exe
C:\Program Files\Hijack this\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theglobeandmail.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ———>Weatherbee**
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB003" /M "Stylus C64"
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro2004\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Program Files\Trend Micro2004\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Program Files\Trend Micro2004\TMOAgent.exe" /run
O4 - HKCU\..\Run: [EPSON Stylus C64 Series] C:\C\WINXP\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 EPSON Stylus C64 Series /M Stylus C64 /EF HKCU
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\TV\EXPLBAR.DLL
O9 - Extra button: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\Program Files\ICQ\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll







Warning! This utility will find legitimate files in addition

to malware.
Do not remove anything unless you are sure you know

what you're doing.

——- System Files in System32 Directory ——-

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32

09/08/2004 12:56 PM dllcache
08/13/2003 01:52 PM 32

{EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat
08/02/2003 11:12 PM Microsoft
09/30/1999 06:21 PM 166,672 mstext35.dll
09/28/1999 08:42 PM 1,050,896 msjet35.dll
09/09/1999 09:06 PM 168,720 msltus35.dll
09/09/1999 09:06 PM 252,688 msexcl35.dll
08/25/1999 01:57 PM 415,504 msrepl35.dll
06/07/1999 05:59 PM 250,128 mspdox35.dll
04/25/1999 04:00 PM 287,504 Msxbse35.dll
8 File(s) 2,592,144 bytes
2 Dir(s) 12,802,104,320 bytes free

——- Hidden Files in System32 Directory ——-

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32

09/08/2004 12:56 PM dllcache
08/19/2003 11:12 PM GroupPolicy
08/13/2003 01:52 PM 32

{EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat
08/02/2003 06:05 PM 488 logonui.exe.manifest
08/02/2003 06:05 PM 488

WindowsLogon.manifest
08/02/2003 06:05 PM 749 wuaucpl.cpl.manifest
08/02/2003 06:05 PM 749 sapi.cpl.manifest
08/02/2003 06:05 PM 749 ncpa.cpl.manifest
08/02/2003 06:05 PM 749 nwc.cpl.manifest
08/02/2003 06:05 PM 749 cdplayer.exe.manifest
09/04/1992 02:26 PM 44,669 Pleap.wav
9 File(s) 49,422 bytes
2 Dir(s) 12,802,102,272 bytes free

———- Files Named "Guard" ————-

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32


——— Temp Files in System32 Directory ——–

Volume in drive C is WEATHERBEE
Volume Serial Number is 0C8A-9D36

Directory of C:\C\WINXP\System32


—————- User Agent ————

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\C

urrentVersion\Internet Settings\User Agent\Post

Platform]
"{79566745-D0FB-48AE-AF41-6713B6D718E8}"=""


———— Keys Under Notify ————

REGEDIT4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows

NT\CurrentVersion\Winlogon\Notify]
"Asynchronous"=dword:00000000
"DllName"=""
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"


—————- Xfind Locked Files —————–


————– XFind Qoologic Results ————–


————– XFind Aspack Results —————

* resultC:\C\WINXP\System32\NTDLL.DLL

————– Locate.com Results —————

No matches found.

Post #20
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file

Those are ok. It's a bug in HijackThis.


Double-click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINXP\System32\NTDLL.DLL
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select Yes.


Post a new Find_It log.
Post #21
:D I was not avaible for a couple days but am back Here is the log file. NTDLL.DLL seems to be still there I tried to delete it several times with killbox but it won't go away What it is and what does it do anyway ? Trake :wavey: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 09/08/2004 12:56 PM dllcache 08/13/2003 01:52 PM 32 {EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat 08/02/2003 11:12 PM Microsoft 09/30/1999 06:21 PM 166,672 mstext35.dll 09/28/1999 08:42 PM 1,050,896 msjet35.dll 09/09/1999 09:06 PM 168,720 msltus35.dll 09/09/1999 09:06 PM 252,688 msexcl35.dll 08/25/1999 01:57 PM 415,504 msrepl35.dll 06/07/1999 05:59 PM 250,128 mspdox35.dll 04/25/1999 04:00 PM 287,504 Msxbse35.dll 8 File(s) 2,592,144 bytes 2 Dir(s) 12,703,055,360 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 09/08/2004 12:56 PM dllcache 08/19/2003 11:12 PM GroupPolicy 08/13/2003 01:52 PM 32 {EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat 08/02/2003 06:05 PM 488 logonui.exe.manifest 08/02/2003 06:05 PM 488 WindowsLogon.manifest 08/02/2003 06:05 PM 749 wuaucpl.cpl.manifest 08/02/2003 06:05 PM 749 sapi.cpl.manifest 08/02/2003 06:05 PM 749 ncpa.cpl.manifest 08/02/2003 06:05 PM 749 nwc.cpl.manifest 08/02/2003 06:05 PM 749 cdplayer.exe.manifest 09/04/1992 02:26 PM 44,669 Pleap.wav 9 File(s) 49,422 bytes 2 Dir(s) 12,703,053,312 bytes free ———- Files Named "Guard" ————- Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 ——— Temp Files in System32 Directory ——– Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{79566745-D0FB-48AE-AF41-6713B6D718E8}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] "Asynchronous"=dword:00000000 "DllName"="" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" —————- Xfind Locked Files —————– ————– XFind Qoologic Results ————– ————– XFind Aspack Results ————— * resultC:\C\WINXP\System32\NTDLL.DLL ————– Locate.com Results ————— No matches found. 
Post #22
:P Hi I tried again this morning I disconnected from the internet and then ended as many processes as I could from task manager, then ran killbox. Here is a new log file Have to go Christmas shopping now.. Will be back later :wavey: Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ——- System Files in System32 Directory ——- Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 12/23/2004 03:31 AM dllcache 08/13/2003 01:52 PM 32 {EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat 08/02/2003 11:12 PM Microsoft 09/30/1999 06:21 PM 166,672 mstext35.dll 09/28/1999 08:42 PM 1,050,896 msjet35.dll 09/09/1999 09:06 PM 168,720 msltus35.dll 09/09/1999 09:06 PM 252,688 msexcl35.dll 08/25/1999 01:57 PM 415,504 msrepl35.dll 06/07/1999 05:59 PM 250,128 mspdox35.dll 04/25/1999 04:00 PM 287,504 Msxbse35.dll 8 File(s) 2,592,144 bytes 2 Dir(s) 12,972,230,656 bytes free ——- Hidden Files in System32 Directory ——- Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 12/23/2004 03:31 AM dllcache 08/19/2003 11:12 PM GroupPolicy 08/13/2003 01:52 PM 32 {EFE48D05-B5B5-4E0B-9380-50521AC3710B}.dat 08/02/2003 06:05 PM 488 logonui.exe.manifest 08/02/2003 06:05 PM 488 WindowsLogon.manifest 08/02/2003 06:05 PM 749 wuaucpl.cpl.manifest 08/02/2003 06:05 PM 749 sapi.cpl.manifest 08/02/2003 06:05 PM 749 ncpa.cpl.manifest 08/02/2003 06:05 PM 749 nwc.cpl.manifest 08/02/2003 06:05 PM 749 cdplayer.exe.manifest 09/04/1992 02:26 PM 44,669 Pleap.wav 9 File(s) 49,422 bytes 2 Dir(s) 12,972,228,608 bytes free ———- Files Named "Guard" ————- Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 ——— Temp Files in System32 Directory ——– Volume in drive C is WEATHERBEE Volume Serial Number is 0C8A-9D36 Directory of C:\C\WINXP\System32 —————- User Agent ———— REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\C urrentVersion\Internet Settings\User Agent\Post Platform] "{79566745-D0FB-48AE-AF41-6713B6D718E8}"="" ———— Keys Under Notify ———— REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] "Asynchronous"=dword:00000000 "DllName"="" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" —————- Xfind Locked Files —————– ————– XFind Qoologic Results ————– ————– XFind Aspack Results ————— * resultC:\C\WINXP\System32\NTDLL.DLL ————– Locate.com Results ————— No matches found. 
Post #25
check the Recycle Bin to see if it works properly. A side effect of VX2 is to sometimes damage the Recycle Bin operation. Create an blank Notepad file on the Desktop: right click the Desktop, select New>Text Document Right click the text document and delete it. When a file is deleted, it should ask if you want to send it to Recycle Bin. Does it ask if you want to send the file to the Recycle Bin, or, does the file just get deleted? Post back what it does. You can delete the C:\!Submit folder. It is created by KillBox, and that is where its removals go. Let me know if everything is ok. We'll do a final cleanup.
Post #26
Nothing goes to the recycle bin the file just get deleted, does not ask if I want to send it to the Recycle Bin ! I thought we already fixed that once ..
Post #27

I thought we already fixed that once ..

We did, it can do that again until all bad guys are dead :)

go to Start>Run, and type in: cmd
Select: OK
At the cmd prompt, type the following commands and press Enter after each:

cd\
attrib -h -s c:\recycler
del c:\recycler

Check to make sure it works. If all is ok.


Log looks good :D :thumbup: How is it running any issues?

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

If you dont have these three programs I would recommend that you get them. Spywareblaster, Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Safe Surfing. :D
Post #28
I followed your instructions from one of your previous post's to fix my recycle bin and it's working now !


" At the cmd prompt, type the following commands and press Enter after each:

cd\
attrib -h -s c:\recycler
del c:\recycler "
Post #29
OK

I turned off sysyem restore rebooted and them turned it back on.

Computer seems to be working good now :thumbup:

I will download all your recomended programs.

Merry Christmas and thanks for all your help….

:wavey:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI