What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

PSGuard hijack and damage

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #17
Ok. eventually have IE replaced using procedure advised and will monitor things to see what improved stability this has given. I think all of my other ancilliary programs are now working again except:- During one and a half hours of download of IE6 I think a malware may have slipped in also, so have run Ad-aware and Spybot and removed a couple of entries. During updating at MS after new IE6 loaded, I had some other search page jumped in at the page opening, but I refreshed and it went Ok. I tried to run HijackThis and it would not start, but gave an error "an unexpected error has occured". I removed HijackThis and downloaded a new one, but the same thing happens. So it seems like HijackThis is the only program which will not work. How can we get around this error thing, would not want to be without HijackThis now ? BarryA
Post #19
No HJT will not run in Safe Mode either, same message "unexpected Error". I read about CoolWWWSearch and it sounded like I had that so I downloaded and ran CoolWWWSearch.Smartkiller but that said I did not have this parasite on my system. Have fully updated and run Ad-aware, Spybot and CWShredder but no difference to problem. BarryA
Post #21
Ran TrojanHunter and it found 5 trojans, however no clean dialog popped up even though this is enabled under the options menu. So cannot see how to activate the clean process. The report did say that the trojan file names had been changed, so has this somehow automatically cleaned them. I tried to send a further couple of possible trojan files for analysis and it said I had to clean the definate located trojan files first. Cannot see how to do that. Can you advise ? BarryA
Post #25
Ok. back now and have run the "RunThis.bat" which shows the Wininet.dll as clean. Still cannot run Hijackthis or CCleaner in Standard/ Safe Mode. Also when I go to Control Panel>Display> …..there is no Desktop tab. Since installing IEradicator, I have lost the Image Preview facility in picture folders and also cannot customise any folders. (this is a bit of a loss and you have to ask whether there is some other way than IEradicator?). Sometimes in IE and online the click operation gives a delayed reaction and also then sometimes the curser movement hangs for quite a little while. It does come back ok after a while almost as if something else is running and taking priority! regards…..BarryA
Post #26
Sorry nearly forgot here is the RunThis.bat log, I presume that each time that this is run a new log overites the old one in the C:\smitfiles.txt folder as there is only one log entry in there and there is no date until you enter one? :- 00:29 21/09/2005 smitRem log file version 2.3 by noahdfear ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Pre-run Files Present ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system folder ~~~ oleext.dll ~~~ Icons in system folder ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~~ wininet.dll ~~~~ wininet.dll Present!! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Post-run Files Present ~~~ Program Files ~~~ ~~~ Shortcuts ~~~ ~~~ Favorites ~~~ ~~~ system folder ~~~ oleext.dll ~~~ Icons in system folder ~~~ ~~~ Windows directory ~~~ ~~~ Drive root ~~~ ~~~~ wininet.dll ~~~~ wininet.dll Clean!! :)
Post #27
Ok, ME is a bit different in how it does the desktop properties. Try this path: From the Start menu, in Control Panel, click Display and then click the Web tab. > Uncheck "Security Info" if present. Let me know if that works.
Post #28
There is no such entry on the Web tab, so no go, but how important might this be? With regard to not being able to run Hijackthis, I read somewhere to try to run a previous version 1.97.7 and see if any problem entries can be removed, before trying the latest version again. Is this an option if the old version can be downloaded from somewhere and should the two versions be installed on the computer at the same time. Also I read somewhere that Visual Runtime Files required to run Hijackthis might be missing and can be downloaded from Ms as "Visual Basic Service Pack 5 Runtime Files". Again does this make any sense, or is Hijackthis just being halted by some Malware which needs removing. I did also read somewhere on another forum that there was another program similar to Hijackthis which could be run to allow things to be cleaned up and then go back to Hijackthis. Unfortunately I cannot for the moment find this again, but could it be another option? BarryA
Post #29
Ok, you can try downloading an older version from the official downloads section here:
http://www.richardthelionhearted.com/?url=…lionhearted.com

Please first save these directions to the desktop as a text file, because you will need to copy and paste part of them later, once we are in Safe Mode.
  • Please download the Killbox.
    Unzip it to the desktop but do NOT run it yet.
  • Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.
  • Once in Safe Mode, please run Killbox.
  • Select "Delete on Reboot".
  • Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:

    C:\WINDOWS\System\oleext.dll
  • Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
  • Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
Post #30
Ok, have run Killbox and removed the file in question. At least it could not be found in a file search, but I suppose it may not always show up in that if it is hiding. Now have Hijackthis latest version working again as if by magic. I read somewhere to download and install from Microsoft:- Visual Basic 6.0 Service Pack 5 Runtime Files. So I did and instantly it worked. I have no idea what they are for or what they do but obviously they are needed. Also I do not know how it worked before, or have I somehow lost those files from a Malware or Virus attack. So anyway below is the latest log. I can see a few entries are no longer there, due to installing IE separate from the Desktop Shell in some cases. Also I think the first line entry may be a search page hijack. I can see an entry is also missing for System Restore StateMgr, and upon checking can see no recent points have been set, so I will try to re-set that. BarryA Logfile of HijackThis v1.99.1 Scan saved at 18:47:38, on 22/09/2005 Platform: Windows ME (Win9x 4.90.3000) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\SYSTEM\KERNEL32.DLL C:\WINDOWS\SYSTEM\MSGSRV32.EXE C:\WINDOWS\SYSTEM\mmtask.tsk C:\WINDOWS\SYSTEM\MPREXE.EXE C:\PROGRAM FILES\TREND MICRO\INTERNET SECURITY 2005\PCCTLCOM.EXE C:\WINDOWS\EXPLORER.EXE C:\PROGRAM FILES\TREND MICRO\INTERNET SECURITY 2005\PCCIOMON.EXE C:\WINDOWS\SYSTEM\SPOOL32.EXE C:\PROGRAM FILES\TREND MICRO\INTERNET SECURITY 2005\TMPROXY.EXE C:\PROGRAM FILES\TREND MICRO\INTERNET SECURITY 2005\PCCGUIDE.EXE C:\WINDOWS\SYSTEM\SYSTRAY.EXE C:\WINDOWS\TASKMON.EXE C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\PSFREE.EXE C:\WINDOWS\SYSTEM\WMIEXE.EXE C:\WINDOWS\SYSTEM\STIMON.EXE C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS\HIJACKTHIS.EXE R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - C:\PROGRA~1\FRESHD~1\FRESHD~1\FDCATCH.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe" O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun O4 - HKLM\..\Run: [SystemTray] SysTray.Exe O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme O4 - HKLM\..\Run: [zSPGuard] c:\program files\startpageguard\spguard.exe /s /r O4 - HKLM\..\Run: [THGuard] "C:\PROGRAM FILES\TROJANHUNTER 4.2\THGUARD.EXE" O4 - HKLM\..\RunServices: [PcCtlCom] C:\PROGRAM FILES\TREND MICRO\INTERNET SECURITY 2005\PCCTLCOM.EXE O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRAM FILES\PANICWARE\POP-UP STOPPER\PSFREE.EXE"

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI