Close ALL windows and browsers except HijackThis and click "Fix checked"
Restart in Safe Mode:
Restart your computer.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab. Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders." Clear "Hide protected operating system files."
Click Apply, and then click OK.
Search for and delete these files if listed:
C:\WINDOWS\System32\pc32.exe
Do this also if these Temp Folders are part of your OS.
Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.
Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.
Empty the Recycle Bin
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
Hey, Its me again….I did just update AdAware to AdAware SE and it found 232 bad things, so I did go ahead and delete them. Hopefully this will help. I will post new log if you need me to.
Lizzy
Logfile of HijackThis v1.99.0
Scan saved at 7:19:35 PM, on 1/19/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Close all windows and browsers.
Open HijackThis
Click on Config
Click on Misc Tools
Click on Open Process Manager
Click once on the file below to select it: C:\WINDOWS\System32\pc32.exe bg
Click: Kill Process to end process
Click on the Back button to exit Process Manager
Now, back at the main screen of HijackThis, proceed to Scan.
and put a check by these.
Here goes.
Things seem to be a little better but still slow switching from one screen to another. Oh well, maybe this is the best I can do…Lizzy
Logfile of HijackThis v1.99.0
Scan saved at 9:51:14 PM, on 1/19/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
You need to update both Windows XP and Internet Explorere as they are both well behind in updates. They are both missing Service Pack 1 which is leaving you open to all kinds of problems.
I DO NOT suggest you go to Service Pack 2, at this time.
Hi, I thought I already did that, I will try it again, and today I ran Trojan Hunter and I found the following:
In Memory Scan:
Found trojan module guard.tmp loaded into process rundll32.exe(1160):AdwareVX2.100
Found trojan module guard.tmp loaded into process explorer.exe(2252):Adware VX2.100
I did put a check and fixed. Was that ok to do?
Liz
I always forget to copy, her it is, so sorry, Lizzy
Logfile of HijackThis v1.99.0
Scan saved at 10:05:26 AM, on 1/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
Hi, There is one more thing I have noticed. You told me to empty the recycle bin. After I deleted the item you told me to, I went to my recycle bin on the desktop and there were no objects in the recycle bin. I also just a few minutes ago deleted some old documents out of Word, it asked if I wanted to send to recycle bin, I said yes, but when I clicked on the REcycle Bin, it had nothing in it. So I then did a disk cleanup and when the box came up, there were "0" in the recycle bin. In the past, the recycle bin always showed the items that I deleted and then I would just click empty the recycle bin under File. What could have happened with this? Liz
Download Find_It.zip: http://forums.tomcoyote.org/index.php?act=…=post&id=110741
Unzip its contents to its own folder
Open the folder and double click on Find.bat (File with a gear symbol)
Ignore any File not found messages
It runs for a minute, and produces a log
Please copy and paste the log on your next response.
Download VX2Finder(126).exe: http://downloads.subratam.org/VX2Finder(126).exe
Save the program in its own folder.
Run VX2Finder(126).exe
Select: Click to Find VX2.Betterinternet
When the scan is done, select the Make Log
It will open the log in Notepad.
Copy and paste the log to on your response.
Will wait for the Find_It log, and the VX2Finder log, as well as the information requested for guard.tmp. Also include a new HijackThis log in your reply, since we need to have all the information as current as possible.
After providing the logs requested, please do not reboot or shutdown/restart the computer. Just leave it on. If you restart, any information provided may change, and we are back to square one.
Logfile of HijackThis v1.99.0
Scan saved at 9:33:00 PM, on 1/20/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
If you have not rebooted or shutdown/restarted, proceed as follows:
First, Disconnect from the Internet!!
(Please copy these instructions to NotePad for copy/paste use, since you will be off the Internet.)
____
Next, launch Notepad, and copy/paste all the blue REGEDIT below to it
Save in: Desktop
File Name: fixme.reg
Save as Type: All files
Click: Save
Back on the Desktop, double-click on the fixme.reg file you just saved and click on Yes when asked to merge the information.
____
Now, extract KillBox (downloaded earlier) from the zip file and double-click on KillBox.exe to run it.
In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.
Back at the main screen of KillBox, select the option: Delete on Reboot
In the Full Path of File to Delete box, copy and paste this entry: C:\\WINDOWS\\system32\\i8600ijme8oa0.dll
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select No.
Do the same as above for each of the files that follow, and select No when asked to reboot! Press the button with a red circle and a white X.
Finally, in the Full Path of File to Delete, copy and paste the following: C:\WINDOWS\System32\guard.tmp
Press the button with a red circle and a white X.
When asked to Reboot, select Yes!!
__
__
Run Hijack This again and put a check by these.
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
Close ALL windows and browsers except HijackThis and click "Fix checked"
First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.
From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.
When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)
Also, check the Recycle Bin to see if it works properly. A side effect of VX2 is to sometimes damage the Recycle Bin operation.
Create an blank Notepad file on the Desktop: right click the Desktop, select New>Text Document
Right click the text document and delete it.
When a file is deleted, it should ask if you want to send it to Recycle Bin.
Does it ask if you want to send the file to the Recycle Bin, or, does the file just get deleted?
Post back what it does.
When done with all of the above, close all windows and browsers, run HijackThis, Scan, post a new HijackThis log, and a new Find_It log.
If you encounter any problems with the steps above, please describe them.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
