Isn't this FUN. They're all back
Restart your computer in
Safe Mode.
Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.
Use
ALT/CTRL/DEL and see if it's listed there. If so, end the process for it.
Run regedit again and lets search for
mszx23.exe !! Click My Computer> Edit> Find type in mszx23.exe !! Delete all found
search for
snim.dll <–Delete all found.
Do these again if found.
Ok, I found a bunch of files with familiar names (mhtml, TIBS, etc.) and deleted them all. I also found the mszx23.exe file I couldn't find earlier and deleted it
After regedit:
Before rebooting:
Find the
Prefetch folder and delete
ALL files in that folder.
Run Hijack This again and put a
check by these.
O2 - BHO: (no name) - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINNT\System32\snim.dll
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe snim.dll, DllRegisterServer
O4 - HKLM\..\Run: [secboot] C:\WINNT\System32\mszx23.exe !!
O18 - Protocol hijack: mhtml -
O18 - Filter: text/html - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINNT\System32\snim.dll
O18 - Filter: text/plain - {B72F75B8-93F3-429D-B13E-660B206D897A} - C:\WINNT\System32\snim.dll
Close
ALL windows and browsers
except HijackThis and click
"Fix checked"
Search for and delete these files if listed:
mszx23
snim.dll
mhtml
Note: This will remove all previous Restore Points
Turn off System Restore:
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer, turn it back on.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.
"copy/paste" a new log file into this thread.
