Fast question. Other than AVG do you have any other antispyware/virus programs on your sysem. Things like Adwatch, winpatrol, Teatimer etc…? If you do these can block the fix and will need to be disabled.
Also, are these logs from safe mode or regular mode?
Click http://www.eudaemonia.me.uk/downloads/Files/DllCompare.exe to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.
Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.
Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.
Siggy,
The log files that were posted in my other post were from safe mode, including the HJT. I saved the logs, then rebooted so I'd have internet access and posted them up.
The only antivirus/spyware I have besides AVG is Norton/Symantec and Adaware SE. I have realtime protection disabled on Norton and Adaware is an active program, so we should be fine there.
I'll post the DLL compare results while running in regular mode, and post here in a few minutes.
Thanks,
Chris
* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________
O^E says: "There were no files found "
________________________________________________
1,458 items found: 1,458 files, 0 directories.
Total of file sizes: 298,010,150 bytes 284.20 M
Administrator Account = True
——————–End log———————
There was nothing in the lower pane. The scan was run with the system booted up noramally/not safe mode.
An interesting little anamoly is that I can visit most any site after I get rid of the pop ups from the high jack. And if I "create a new window" in IE, I can then type in any address I want and I wont get hijacked…. with the exception of EBAY… don't know what the deal is with that, but I went to go check on an auction and I cannot access Ebay. The page will load and then it gets re-directed to about blank after a second or two. Doesn't matter how I try and access ebay(typing the url, following a link, opening a new window through IE, etc.) it will always get redirected to about blank.
Thanks again for your assistance,
Chris
Logfile of HijackThis v1.99.0
Scan saved at 10:08:39 PM, on 1/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Be sure that all windows are closed. Click on START-> RUN. Copy paste the following as it is and click OK.
regsvr32.exe /U hfnn.dll
You should get a message that it has been uninstalled succesfully.
Then be sure that all windows are still closed. Run hijackthis. Hit None of the above, just start the program button. .Put a check mark on these entries.Hit FIX CHEKED button.
Logfile of HijackThis v1.99.0
Scan saved at 1:06:02 PM, on 1/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
When I ran regsvr32.exe /u hfnn.dll, it came back with the installed successfully. When I opened HJT with the "none of the above" option, there were no entries in the pane, so I ran a scan but didn't save a log, and all the entries you specified were there and subsequently removed/fixed. All of this was done with no other windows open.
Per your request, I rebooted, cleared my temporary internet files (online and offline, as well as cookies) then rescanned. It looks like the entries you asked me to remove didn't come back with the reboot, so I take it that is a good sign. While I was cleaning my temporary internetfiles, I changed the home page from about:blank to google. This was done before the scan. When I open webpages, now, I have a bookmark to this site, open it first, and never get the about:blank. Then I go to if I need to go to other sites. This way at least my machine isn't hitting the about blank site and possibly picking up other nasties.
Thanks again for all your assistance, and let me know what you need next.
Siggyx,
After rebooting, everything looks nice and clean. Ebay is acting normally, I'm able to open my work related websites without getting jacked etc. I can't thank you enough. I'm pd on commision and just started with a new company, but as soon as my first check comes in, you guys WILL get a donation from me. I really appreciate the time that you all devote to helping out.
I'm going to move all the spyware related tools into their own little folder and off the desktop I had a question about AVG vs. Norton/Symantec. When this laptop gets back into the office the protocol is to run Norton. Will I be missing vital protection by uninstalling AVG?
I have to add that I have never picked up a bug like this before. I used to work in Software QA and was the lead test engineer for systems level tests ( I was responsible for the entire data networking infrastructure to replicate a metropolitan area network) I give my laptop over to my wife for less than a week and she managed to ruin an otherwise spotless record I'd very much like to hear what types of preventative measures I can employ to keep this machine clean if I have to let her use it in the future.
Thanks a million and have a nice evening,
Chris
Glad I could help. You can uninstall AVG now if you want. I had you install and run it because it has better luck targeting some of the nasties as some of the experts here talk with the AVG people. Norton is a good program so no harm with it.
I would also suggest FireFox for casual browsing as it doesnt have that many hijacks written for it.
If you dont have these three programs I would recommend that you get them. Spywareblaster,Spywareguard and IESPY AD. They will add 1000's of sites to your resticted zone and block some hijacks from happening. I also have a FREE FIREWALL and FREE ANTI VIRUS if you need one.
It is critical to have both a firewall and anti virus to protect your system.
Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.
If you need this topic reopened, please request this by sending an email to us at the following link (Click for address) Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.
If this is not your thread please start a New Topic.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
"
________________________________________________
1,458 items found: 1,458 files, 0 directories.
Total of file sizes: 298,010,150 bytes 284.20 M
Administrator Account = True
——————–End log———————
There was nothing in the lower pane. The scan was run with the system booted up noramally/not safe mode.
An interesting little anamoly is that I can visit most any site after I get rid of the pop ups from the high jack. And if I "create a new window" in IE, I can then type in any address I want and I wont get hijacked…. with the exception of EBAY… don't know what the deal is with that, but I went to go check on an auction and I cannot access Ebay. The page will load and then it gets re-directed to about blank after a second or two. Doesn't matter how I try and access ebay(typing the url, following a link, opening a new window through IE, etc.) it will always get redirected to about blank.
Thanks again for your assistance,
Chris
Any issues so far? Let me know if not I will give you some links to programs that will help stop this happening again.