Logfile of HijackThis v1.99.1
Scan saved at 12:32:16 PM, on 8/27/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Welcome to the forum, you have a collection of real nasty stuff and I suggest you stay offline until we get it cleaned up, this junk will attract other. Follow these directions.
Thanks to Atribune and any others who helped with this fix.
Please print out or copy this page to Notepad . Make sure to work through the steps in the exact order in which they are mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fix.
You did not follow the instructions to move HJT from the Desktop:
Please do this before you start: Move HJT from the Desktop for safety. I prefer C:\HJT\HijackThis.exe, if you need additional instructions use these: http://russelltexas.com/malware/createhjtfolder.htm Do that before you proceed this time!
Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
Close all programs but HJT and all browser windows, then click on "Fix Checked"
Enable hidden files&folders..reverse the process when finished:
Windows ME
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
Click Start, Programs and Accessories and open Windows Explorer.
Select a hard drive from the left hand side of the Windows Explorer window.
Select View the Entire contents of this drive.
RIGHT Click on Start then click on Explore. Locate and delete these items:
c:\windows\system\zpfujj.exe <<< delete that file
Post a last HJT log and let me know how the computer is running now.
HJT is a Process Manager, when you delete that line with HJT above it ends the process so you can delete that file. This must be done BEFORE a reboot. Did you correctly follow all steps.
If so then try this: Press Ctrl, Alt and Delete keys at the same time. When the Task Manager opens in the Processes Tab, locate highlite and end process on: c:\windows\system\zpfujj.exe Then navigate to the file and delete it.
Another way is: http://www.bleepingcomputer.com/tutorials/…l42.html#delreb How to use the Delete on Reboot tool
Start Hijackthis
Click on the Config button
Click on the Misc Tools button
Click on the button labeled Delete a file on reboot…
A new window will open asking you to select the file that you would like to delete on reboot. Navigate to the file and click on it once, and then click on the Open button.
You will now be asked if you would like to reboot your computer to delete the file. Click on the Yes button if you would like to reboot now.
Then remove the line from your log with HJT. ME seems to work like no other Operating System and I have never used it, but if you follow directions, one of those methods should work.
Thanks for returning this information, for some reason you have these two lines:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
They would apply if you have your Home Page set to "blank" Follow me for a second:
Open Internet Explorer > Tools > Internet Options > General Tab. Under Home Page you have three choices. If you do not choose to set a Home Page, instead choose Use Blank, then those lines will appear. I would set the Home Page you want your browser to start on and then use HJT to remove those two lines.
ok did all of that but when i try to change my homepage all 3 options are greyed out. here is the new hjt. i appreciate your help
Logfile of HijackThis v1.99.1
Scan saved at 3:24:05 PM, on 9/2/2006
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\PROGRAM FILES\HIJACKTHIS\HIJACKTHIS.EXE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHELPER.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .wvx: C:\PROGRAM FILES\NETSCAPE\COMMUNICATOR\PROGRAM\PLUGINS\npdsplay.dll
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
We still have a little work to do, this one: C:\WINDOWS\SYSTEM\ZPFUJJ.EXE is a trojan see this: