I had Java/ByteExploit!… I read a forum removed what was needed on my hijackthis scan. All of my spyware/virus scans are coming up clean but im still getting a billion pop ups. Hope you can help. Thanks.
Welcome to the forum
Please make a
PERMANANT folder for Hijack This!
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
MOVE (drag-and-drop) HijackThis into this folder.
If required a tutorial is here =
Hijackthis Folder Tutorial
Please download
FixWareout from one of these links:
Fixwareout.exe Fixwareout.exe
Save it to your desktop.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "
Do a systen scan only ".
Then "check" the box to the left of these item(s):
Then click "
Fix checked " and close Hijack This!.
* Run Fixwareout on the desktop.
* Click
Next , then
Install , make sure
"Run fixit" is checked and click
Finish.
* The fix will begin;
follow the prompts.
* You will be asked to reboot your computer;
please do so.
* Your system may take longer than usual to load;
this is normal.
* Once the desktop loads a text will open
(report.txt) . We'll need that in a bit.
"Copy/paste" a new HijackThis! log file into this thread .
Also open this file with Notepad:
C:\fixwareout\report.txt
And paste it's contents into your next post.
Here it is Micah:
You did everything perfectly.
We always run the "clean" until no infected files show up.
Delete this folder:
C:\Program Files\
KillAndClean <–
FOLDER
Delete this file:
C:\WINNT\system32\
{A0FD124F-17E6-4C75-9DC0-2E8655BE0C6B}.exe <– file
Close all windows/programs.
Fix these using HijackThis!:
Browse to the C:\fixwareout folder.
Fixit.bat
This will start Fixwareout again.
After the reboot,
post the fixwareout report, and a new HijackThis! log .
Also do this:
Please download/unzip this:
Registry Search by Bobbi Flekman
on
regsearch.exe , and search for this:
Make sure all the boxes are checked under "Search".
It may take a while to run, so be patient. When finished, the search results will appear in your text editor,
Paste the contents of the search results into your next post.
Sorry I thought we were done!… I had a problem locating the Kill and Clean Folder. Cant find it anywhere. So i skipped that and did the rest.
Sorry I thought we were done!
When it looks "clean" to me, I'll give you the "How's it running?" speech.
Please make a
PERMANANT folder for Hijack This!
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
MOVE (drag-and-drop) HijackThis into this folder.
If required a tutorial is here =
Hijackthis Folder Tutorial CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "
Do a systen scan only ".
Then "check" the box to the left of these item(s):
Then click "
Fix checked " and close Hijack This!.
Reboot in
"safe" mode .
Delete all of the following
noted (in red) file(s)/
FOLDER(s) you can find:
c:\program files\
altpayments <—
FOLDER
Some malware files may be "hidden".
Be sure to
show hidden files when looking for these file(s) and/or folder(s).
Reboot in normal mode and "copy/paste" a new HijackThis! log file
into this thread .
Is this something you recognize as "friendly"?
O4 - HKCU\..\Run: [fimf] C:\Program Files\Common Files\fimf\fimfm.exe
Please run the registry search tool once more.
MAKE SURE ALL THE BOXES ARE CHECKED UNDER "SEARCH".
Search for:
{64BD330A-0AEF-1033-0924-020204250001}
It has to be in there, because this is in your log:
C:\Program Files\Common Files\{64BD330A-0AEF-1033-0924-020204250001}\Update.exe
I made sure all the hidden files were shown but again there was no folder but this time for the altpayments. I dont believe that the 04-hku\..\Run.fimf…..was friendly so i got rid of it. So here's the latest:
Copy and paste the contents of the quote box below into Notepad.
Save it as file name: "
fixme.reg " (not including the quotes). Save as file type: *All files* and save it on your Desktop.
REGEDIT4
Then, locate
fixme.reg on your desktop and it.
You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
Answer '
Yes ' and wait for a message to appear similar to "Merged Successfully".
Reboot.
Delete this folder:
C:\Program Files\Common Files\
{64BD330A-0AEF-1033-0924-020204250001} <–
FOLDER
Reboot and post a new HijackThis! log.
This program is purported to be "spyware":
O4 - HKLM\..\Run: [MediaPipe P2P Loader] "C:\Program Files\p2pnetworks\mpp2pl.exe" /H
See this link:
MediaPipe P2P Loader
It is suggested that you remove it (uninstall).
Logfile of HijackThis v1.99.1
It's been running ten times better, even after the first post. You rock. Thank you soooo much!
Thank you for choosing TomCoyote for your malware removal solutions.
M68
Securing Your PC After An Attack This topic is now closed.
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post."Reopen" will be deleted without being looked at.
