This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

How to "open Log in Notepad & other problems

6 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

I'll skip the miserable experience trying to navigate your excellent site ("error, not entitled to post", etc./finding email address after "help" not helpful enpough, etc.) . Admittedly all due to my inexperience (read ignorance). I cannot understand how at my email site I received the longest message ever to reach me, from YONEX5. Do not know the gentleman and far from qualifying to help him re his enormous undecipherable LOG, I'm simply trying yo get some advice re my own. OK, I downloaded/installed/ran HijackThis and created Log. Problem now is precisely how I "…Open the Log in Notepad …" I tried COPY entire (highlighted) Log from the site where it was. When I tried to PASTE here the item paste is blued out. I will appreciate response covering these frustrating problems. Thank you. RO
Hello rodell,
I will try to help you here but it is difficult to explain. First of all I have no idea why you received an email from Yonex5, other than you may have subscribed to the HijackThis Logs and Spyware/Malware Removal forum. That means that you would receive a copy of every email that was sent to anyone posting in that forum including your own. I will try to explain the steps to remove this:

Click My Controls top middle of the forum page. On the Next Page about a third of the way down the left hand side will be
  • "Subscriptions" then under Subscriptions you will see
  • "View Topics"
  • "View Forums"
Click on "View Topics" and you will be taken to a new page

On the right hand side of the new page you will see a list (may only be one) of names of topics with a check box to the right of it.

Put a check mark in the box to the right of each topic EXCEPT "How to open Log in Notepad & other problems"AND "STOP POSTINGS emailed to me, Need specific path to STOP postings" because those are YOUR topics and you will want to be notified when someone has answered them!

Once you have a check mark in all topics you want to remove go to the bottom of the list and you will see "Unsubscribe" in a drop down box with a button beside it that says "With Selected (a number will be in brackets on the button". Click on that button and all topics except the ones that are yours will stop sending you email.

NOW please use the BACK button on your browser to return to the previous page and find a third of the way down the left hand side will be :
  • "Subscriptions" then under Subscriptions you will see
  • "View Topics"
  • "View Forums"
This time choose "View Forums" and click on it

On the right hand side of the new page you will see a list (may only be one) of names of topics with a check box to the right of it. Put a check mark in every box on the right hand side of the page

Go to the bottom of the list and and you will see "Unsubscribe" in a drop down box with a button beside it that says "With Selected (a number will be in brackets on the button". Click on that button and all forums will stop sending you email.


===============================================
Now to give you instructions for getting and posting a new HijackThis log.

Download to your desktop HijackThis

Double click on HijackThis.exe on your desktop

Click on the top button in the window that opens:
"Do a system scan and save a log file"

HijackThis will then scan your system showing you a window as it scans with check boxes on the left followed by the information about your computer

When it is done, a notepad window will open with the log file inside it.

Select Edit from the top menu and then select all to highlight the contents of the notepad window

Now select Edit again and then Copy

Open your browser and click the following link
HijackThis Logs and Spyware/Malware Removal forum at Tom Coyote

Right-Click inside the blank space for a post and choose Paste . Your hijackthis log should be pasted into the space. scroll down and click Add Reply and your post will be entered for a helper to reply to.

Good Luck!
I am much obliged for your clear instructions on both my problems. On the first, I have been to both sites and clicked and unclicked items all over the place – which of course were acknowledged – but the deluge continued. (In the last few houes, 36 more!) Perhaps I was impatient and/or clicking wrong because I simply was unclear re the descriptions of what action results from each of them. On the second, the "openbrowser … click …link" is what I'm unfamiliar with but will try to do it. Cordially, RO PS: Illustrating confusion/uncertainty, why not a simple "SUBMIT"? Does Close Fast Reply mean it's sent when Closed? Does Add Reply bring a new box, or is this message Sent? Only hope this reaches you.
Hi DQOSLING: 2nd Reply: FYI, results re first problem: At TOPICS none but the one specified as EXCEPTION and at next to UNSUBSCRIBE, no number. At FORUS also none except own topic to which am subscribed and again no number. Presumably this indicates the deluge should stop coming (after the 36 just reported). I certainly hope so. Does this website not offer an opportunity to send messages to individuals, meaning those who are willing to provide personal email addresses? Cordially, RO
I join the multitude of others hoping some kind soul will have a look at this LOG and
advise which items should be deleted. It should be noted this is not only my first
experience with this process, but also that I am about as unfamiliar (read ignorant) of
computers as is possible to be. Thanks. Cordially, RO


Logfile of HijackThis v1.99.1
Scan saved at 11:11:43 AM, on 6/5/2005
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\PROGRAM FILES\EXECUTIVE SOFTWARE\DISKEEPER\DKSERVICE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\PWRTRAY.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\VPTRAY.EXE
C:\PROGRAM FILES\WANADOO\TASKBARICON.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE
C:\WINDOWS\RunDLL.exe
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INCREDIMAIL\BIN\IMAPP.EXE
C:\WINDOWS\SYSTEM\RNAAPP.EXE
C:\WINDOWS\SYSTEM\TAPISRV.EXE
C:\PROGRAM FILES\WANADOO\ESPACEWANADOO.EXE
C:\PROGRAM FILES\WANADOO\COMCOMP.EXE
C:\PROGRAM FILES\WANADOO\WATCH.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\LEXBCES.EXE
C:\WINDOWS\SYSTEM\LEXPPS.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://home.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\SYSTEM\OOBE\BLANK.HTM
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\WINDOWS\SYSTEM\OOBE\BLANK.HTM
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:7180
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;*windowsupdate.microsoft.com;*windowsupdate.com;download.microsoft.com;
codecs.microsoft.com;activex.microsoft.com;liveupdate.symantecliveupdate.com;
liveupdate.symantec.com;services.wanadoo.fr;secure.wanadoo.fr;
webgen.wanadoo.fr;images.wanadoo.fr;images2.wanadoo.fr;wanadoo.wha.com;
wha.wanadoo.fr;pay.www.wanadoo.fr;www.wanadoo.fr;webmail*.wanadoo.fr;
iapref.wanadoo.fr;wip2.wanadoo.fr;vip.voila.fr;maj.wanadoo.fr;qos.wanadoo.fr;
guidejuniorscontroleparental.wanadoo.fr;wip2pro.wanadoo.fr;wpms.wanadoo.fr
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\WANADOO\SEARCH~3.DLL
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O2 - BHO: YBIOCtrl Class - {004A5840-FF59-11d2-B50D-0090271D3FD4} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\SBCIE028.DLL
O2 - BHO: ALTAVISTA - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\PROGRA~1\DYNAMI~1\ALTAVI~1\ALTAVI~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O2 - BHO: URLLink Class - {4A2AACF3-ADF6-11D5-98A9-00E018981B9E} - C:\Program Files\NewDotNet\newdotnet6_38.dll
O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\PROGRAM FILES\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\PROGRAM FILES\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL
O3 - Toolbar: ALTAVISTA - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\PROGRA~1\DYNAMI~1\ALTAVI~1\ALTAVI~1.DLL
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1601.0\EN-US\MSNTB.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [PowerTray] PwrTray.EXE
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [vptray] c:\PROGRA~1\NORTON~1\vptray.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\WANADOO\TaskbarIcon.exe
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\WANADOO\Watch.exe
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - HKLM\..\RunServices: [DkService] C:\Program Files\Executive Software\Diskeeper\DkService.exe
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [IncrediMail] C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Taskbar Display Controls] RunDLL deskcp16.dll,QUICKRES_RUNDLLENTRY
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE
O4 - Startup: PowerReg SchedulerV2.exe
O4 - Startup: Booster Wanadoo.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: MyPoints - file://C:\PROGRAM FILES\MYPOINTS_POINTALERT\Sy800\Tp800\scri800a.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\PROGRAM FILES\AOL TOOLBAR\TOOLBAR.DLL/SEARCH.HTML
O8 - Extra context menu item: Fill Forms &] - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: Save Forms &[ - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Customize Menu &4 - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: AltaVista Search - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
O8 - Extra context menu item: Translate - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxmk142YYFR
O8 - Extra context menu item: Afficher l'image non compressée - res://C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE/227
O8 - Extra context menu item: Afficher toutes les images non compressées - res://C:\PROGRAM FILES\BOOSTER WANADOO\WANADOO_BOOSTER.EXE/250
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS\DOWNLOADED PROGRAM FILES\SBCIE028.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: PRDIE - {B3D70460-2C27-11D9-9D3C-444553540001} - C:\PROGRAM FILES\PRIVACY DEFENDER\PRD.EXE
O9 - Extra button: ICQ Pro - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ - {6224f700-cba3-4071-b251-47cb894244cd} - C:\PROGRA~1\ICQ\ICQ.exe
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Toolbar &2 - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms &] - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms &[ - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Point Alert - {67B50696-04BA-48ea-A697-28AA0EAA9C26} - file://C:\PROGRAM FILES\MYPOINTS_POINTALERT\Sy800\Tp800\scri800a.htm (file missing) (HKCU)
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O10 - Hijacked Internet access by New.Net
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://lw11fd.law11.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {4E888414-DB8F-11D1-9CD9-00C04F98436A} - https://webresponse.one.microsoft.com/oas/ActiveX/winrep.cab
O16 - DPF: {A97608DD-6999-11D5-9C8C-0010A4F2D6BF} (QCOMCont Class) - http://www.quicken.com/qw2001/qcominst.cab
O16 - DPF: {BE5431D2-0F30-11D4-89D9-00C04F509C0A} (SDCInstaller Class) - http://www.stamps.com/download/us/cab/stam…file=stamps.cab
O16 - DPF: {0837121A-6472-43BD-8A40-D9221FF1C4CE} - http://download.sidestep.com/get/k00719/sb028.cab
O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup…p1/imloader.cab
O16 - DPF: {93B32602-A185-498B-9EA2-0518EBE72DE3} (MSN Money Portfolio Manager) - http://fdl.msn.com/public/investor/v13/invinstl.exe
O16 - DPF: {963BE66B-121D-4E6C-BF9F-1A774D9A2E41} - http://moneycentral.msn.com/cabs/pmupdate2.exe
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aol.com/computercheckup/qdiagcc.cab
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…84/mcinsctl.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/m…,21/mcgdmgr.cab
O16 - DPF: {9732FB42-C321-11D1-836F-00A0C993F125} (mhLabel Class) - http://www.pcpitstop.com/mhLbl.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EP…l_v1-0-3-17.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {01FE8D0A-51AD-459B-B62B-85E135128B32} (DD_v4.DDv4) - http://www.drivershq.com/DD_v4.CAB
O16 - DPF: {3DC2E31C-371A-4BD3-9A27-CDF57CE604CF} (MSN Money Charting) - http://moneycentral.msn.com/cabs/pmupd806.exe
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - https://www-secure.symantec.com/techsupp/asa/SymAData.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/asa/LSSupCtl.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwe…up1.0.0.8-2.cab
Hi again DQOSLING. 3rd Reply Re second problem, I cannot find "…following LINK…" on my browser taskbar. No Links at all to be able to clink. I hope you can educate me on this. I succeeded without it by simply going to Forum and opening new post and clicking Paste (having of course already COPY all). Still like to know how to do it per your instructions. Notice on left side of the LOG there are no small boxes to be used to CLICK. Is this something that comes up later in the Reply, assuming I get one? On the first problem, at my TOPICS there are entries, one of which I'd like to delete (a posting on this subject from someone unknown to me). Not only is there no number in the appropriate box, but the UNSUBSCRIBE box is not displayed at all. Same situation at FORUMS. Cordially, RO
4th Reply (hopefully the last one) In last hour received 11 more Forum New Postings. When will they stop? Cordially, RO
rodell I have moved your log into this thread so that you will only receive email from this thread when someone answers or you post to it. I would like you to open the email and look at the top. Can you copy the information from the top of the email to here using "Add Reply" the same way you made each post appear in this thread. What I would like to see is the From, To, Subject, Envelope To, xmailer - all those lines. —————————————————————————– Add Reply: If you are in the topic seeing each post and click 'Add Reply' a page will open for you to write a new post. After writing a new post, just below the post will be another button marked 'Add Reply' and you need to click on that to make sure what you have written appears in the main thread. SO there is one to open a place to type, and one to send the post you have typed into your thread .
Rodell has been receiving help at TechGuy Support forums since May 31, 2005 in this thread which is on-going. and at PCPitStop
This topic is now closed to prevent duplication of services.


If you need this topic reopened because of continued malware problems, please request this by sending an email to the following link
(Click for address)

Please make the subject of the Email: "Reopen" and provide a valid link to this post in the body. Your username and your reason for requesting a reopen should also be included.



Any emails which do not include all of the above will be deleted without being looked at.



If this is thread was not started by you, please start a New Topic. Any bad links or emails that are not from the original poster will be deleted without response.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI