What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hijack This

27 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
Alright, here's the reason why I'm not able to run the windowsecurity scan - I get a notice saying that this scan may require me to download ActiveX 'a-squared Web Malware Scanner' from Emsi Software Gmbh'. This is what I need, correct? I want to be sure before I allow it.
Post #32 last edited
Yes, sorry I did not mention it. The information is in my normal canned message for that scan but I am making this up as we go. :blink: You will need to allow ActiveX and if it locates anything that needs to go a2 will remove it for you for free. This is the way all ActiveX should work, ask you first. If you ever get asked and don't know what it is that is trying to access your computer, always deny it and then investigate. I hope that helps…Phil What can you tell me about the way the computer is running now? Do you think we have removed the problem?
Post #33
Hello again, I think it might be too soon to know how it is running. I will have to let you know in the next couple of days. Is there any need to run another HJT log or anything? Also, I went in and heightened the security on the cookies. Hopefully that will make a big difference. Is it rather complicated to override so that you can view cookies if needed? Anyway, all for now. Thanks. You are fabulous. Sarah
Post #34
Why Thank you Sarah :unsure: I will let your post set for a few days, if I do not hear from you I will know all is well and close the post. Thanks

Cookies: Internet Explorer > Tools > Internet Options > Privacy > Edit. Block the bad one and allow the good ones. When you tighten cookies, for a while you get requests and have to block the bad ones, but after a while that goes away once most of the bad sites get blocks. Look to SpywareBlaster, SpywareGuard and IE-Spyad information in the all clean links for great freeware programs to keep you safe.

Thanks…Phil :wavey:

TomCoyote forum
Slyware Warrior
The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.
If you are reading this information…thank a teacher, If you are reading it in English…thank a soldier.
Post #36 last edited
Hi Sarah, Here is what I would like for you to try, we know the item: C:\WINDOWS/system32/hclean32.exe is bad, we established that fact here: http://www.bleepingcomputer.com/startups/h….exe-11624.html so let's hit it with a baseball bat :angry:

Download the Killbox.
Unzip it to the desktop

Double-click Killbox.exe to run it.

Select "Delete on Reboot".
Place the following line (complete path) in bold in the "Full Path of File to Delete" box in Killbox:
C:\WINDOWS/system32/hclean32.exe
Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.

Let me know if it works :)
Post #37
Hi Phil, I have done what you recommended, so I'll just wait and see if I get any more notices from Norton and Ewido. Quick question - I've heard that Norton isn't necessarily that great and have been told that AVG is a good thing to download. Do you have any experience with that? Thanks. Sarah
Post #38
Concerning the Norton/Avg question. Sarah, I have never used the Norton product, but folks who do use it are generally happy with it. The feedback I get from some experts is that it is very resource demanding but the benefits outweigh the resources used according to many. I have not said much have I? I tend to use a lot of words in my efforts to explain to the best of my limited abilities. I will ask this, are you satisfied with Norton? Understand that AVG is a very good product, the company is a very respected one and they do give away the product for personal users. I have yet to see Norton do this. With Norton you are supposed to have technical support if you need it, this is not true of AVG, there is no tech support. I will point out that it is rarely needed and there is a support forum where help is available from your peers if you need it. If you want to look at AVG, you can do this here:
http://free.grisoft.com/freeweb.php and the help forum is here: http://forum.grisoft.cz/freeforum/index.php?0 I also need to make you aware that if you decide to use AVG that Norton must be removed first. I will say one more thing, if any of my local clients ask for a free antivirus program, AVG is what I install for them.
I hope this helps…Phil
Post #39
Hi Phil, Thanks for the input. I think that I may switch programs. My mom has switched, and she seems satisfied with it. So just before i read your last post, the Ewido and Norton alerts came up again for hclean. I decided to run the killbox again. At the part where you said I should click 'no' at the pending operations prompt, i got this message (both times): "Pending File Rename Operations" - 'Pending File Rename Operations Registry Data has been Removed by External Process!' and only had 'ok' for me to click. I do not know what that means. So I'm not sure if it actually sought to remove upon reboot. :scratch: I'm going to be so much more educated by the time this is over! Sarah
Post #40
Hi Phil, I just wanted to let you know that when Norton did its automatic scan tonight, it detected hclean and quarantined it…. perhaps that'll be the end of it. I hope so!
Post #41
Thanks for that information Sarah. I am still searching the forums for information about that item and I will file whatever I find in the event we need it. In case I have not suggested it, if it shows up again, try following the Killbox instructions in safe mode. Perhaps if the item is not running Killbox might have better luck. It would not hurt to run the Killbox a couple of times back to back either. Let's hope that piece of junk is gone. Thanks again…Phil
Post #42
Well, it doesn't look as though it's gone because I've had 2 more notifications that it has been detected. I'll work more with Killbox. Thanks.
Post #43
Hi Sarah, Trying something else while I search for information. This is what we found when we searched for: hclean32.exe
http://castlecops.com/s10544-hclean32_exe.html Please read the description line. That takes me to here: http://www.doxdesk.com/parasite/WareOut.html I keep seeing CoolWebSearch, so let's run CWShredder just in case it is CWS.

You can download it from here, make sure you update and then choose FIX not scan. Let me know the results please. Thanks…Phil
http://www.softpedia.com/get/Internet/Popu…WShredder.shtml
Post #45
OK Sarah, I did not think it was CWS but now we are sure. To answer your question about Killbox, as long as you are dealing with that same line: C:\WINDOWS/system32/hclean32.exe You can try anything, but I fear something in hidden somewhere that is putting it back when we delete it. First I will give you some Killbox information, then we will run a tool to see if we can find what is putting C:\WINDOWS/system32/hclean32.exe back.
First Killbox info and tutorials:
http://forum.malwareremoval.com/viewtopic.php?t=320

Please RIGHT-CLICK HERE and Save As (in IE it's "Save Target As") to download Silent Runners.
  • Save it to the desktop.
  • Run Silent Runner's by doubleclicking the "Silent Runners" icon on your desktop.
  • You will see a text file appear on the desktop - it's not done, let it run (it won't appear to be doing anything!)
  • Once you receive the prompt "All Done!", double-click the new text file on the desktop, copy that entire log, and paste it here.
*NOTE* If you receive any warning message about scripts, please choose to allow the script to run.


Thanks…Phil

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI