Popcorn.net

Hi there I have a problem with Popcorn.net I have downloaded Hijack this to a new folder in the C: drive, but it will not open when I double click on it. Is there something that I have done wrong. Please help me Thanks

Welcome to the forum

Please re-download it from one of the links below:

Links to Hijack This! v 1.99.1:

Hijack This! (© Merijn) at tools.radiosplace.com

Hijack This! (© Merijn) at spywarewarrior.com

And try to run it again.

Hi, I've just tried downloading it from these links but still nothing happens. When I try to start the program, a box flashes up but disappears straight away. Please advise

Rename HijackThis.exe to look.exe then try to run it.

Sounds like you might have a more serious infection as well….

No, It's just the same Thanks again in advance

Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop.

Run it.

When finished, it will produce a log for you.

Post that log in your next reply.


Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Here is the log from combofix How does it look? Kieran McLean - 06-09-28 20:06:11.35 Service Pack 2 ComboFix 06.09.28 - Running from: "C:\Documents and Settings\Kieran McLean\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\bszip.dll C:\WINDOWS\system32\cmd.com C:\WINDOWS\system32\ping.com C:\WINDOWS\system32\regedit.com C:\WINDOWS\system32\tasklist.com C:\WINDOWS\system32\tracert.com C:\Program Files\winsupdater C:\Program Files\winupdates ((((((((((((((((((((((((((((((( Files Created from 2006-08-28 to 2006-09-28 )))))))))))))))))))))))))))))))))) 2006-08-28 10:13 178,408 –a—— C:\WINDOWS\system32\muweb.dll 2006-08-28 10:13 127,208 –a—— C:\WINDOWS\system32\mucltui.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-09-27 18:05 ——– d——– C:\Program Files\Common Files 2006-09-23 09:06 ——– d——– C:\Program Files\Common Files\Symantec Shared 2006-09-12 01:23 ——– d——– C:\Program Files\Championship Manager 2006 2006-09-11 22:24 ——– d——– C:\Program Files\GameShadow 2006-08-27 07:51 ——– d——– C:\Program Files\Windows Live Toolbar 2006-08-27 07:46 ——– d——– C:\Program Files\MSN Messenger 2006-08-22 16:28 ——– d——– C:\Program Files\limewire 2006-08-21 13:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll 2006-08-21 10:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe 2006-08-21 10:14 128896 –a—— C:\WINDOWS\system32\drivers\fltmgr.sys 2006-08-17 14:07 ——– d——– C:\Program Files\AOL 9.0a 2006-08-10 03:01 ——– d——– C:\Program Files\Internet Explorer 2006-08-09 09:57 ——– d——– C:\Program Files\PartyGaming 2006-08-09 09:14 ——– d——– C:\Program Files\Windows Media Player 2006-07-29 19:32 48936 –a—— C:\WINDOWS\system32\sirenacm.dll 2006-07-27 14:24 679424 –a—— C:\WINDOWS\system32\inetcomm.dll 2006-07-21 09:24 72704 –a—— C:\WINDOWS\system32\hlink.dll 2006-07-01 01:16 49498 –a—— C:\Program Files\popcorn Terms.html 2006-07-01 01:15 126976 –a—— C:\WINDOWS\system32\entry.dll 2006-06-16 09:52 1004 –a—— C:\Documents and Settings\Kieran McLean\Application Data\wklnhst.dat (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "evolsux"="c:\\windows\\evolsux.exe" "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "Internet"="C:\\windows\\system32\\drivers\\helpsys\\internet.exe" "License Manager"="\"C:\\Program Files\\License_Manager\\license_manager.exe \" /silent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "hpWirelessAssistant"="C:\\Program Files\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe" "HP Software Update"="C:\\Program Files\\Hp\\HP Software Update\\HPWuSchd2.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "ccApp"="\"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start" "LSBWatcher"="c:\\hp\\drivers\\hplsbwatcher\\lsburnwatcher.exe" "Cpqset"="C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe" "AOLDialer"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe" "DSLSTATEXE"="C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslstat.exe icon" "DSLAGENTEXE"="C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslagent.exe" "%FP%Friendly fts.exe"="\"C:\\Program Files\\VoyagerTest\\fts.exe\"" "Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe /Consumer" "HostManager"="C:\\Program Files\\Common Files\\AOL\\1136490419\\ee\\AOLHostManager.exe" "Internet"="C:\\windows\\system32\\drivers\\helpsys\\internet.exe" "RealTray"="C:\\Program Files\\Real\\RealPlayer\\RealPlay.exe SYSTEMBOOTHIDEPLAYER" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,fe,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" "WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - Kieran McLean.job C:\WINDOWS\tasks\Symantec NetDetect.job Completion time: 28/09/2006 20:07:08.52 ComboFix.txt

Copy and paste the contents of the quote box below into notepad.

Save it as file name: "fixme.reg" (not including the quotes). Save as file type: *All files* and save it on your Desktop.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"evolsux"=-
"Internet"=-
"License Manager"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Internet"=-

Then, locate fixme.reg on your desktop and it.

You will receive a prompt similar to: "Do you wish to merge the information into the registry?".

Answer 'Yes' and wait for a message to appear similar to "Merged Successfully".

Reboot.

Can you make/post a HijackThis! log now?

When I try to do this process, it comes up with an error message "The specified file is not a registry script. You can only import binary registry files from within the registry editor." Am I doing something wrong?

Open the fixme.reg file you made with Notepad, and paste it back into your next post, please.

REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "evolsux"=- "Internet"=- "License Manager"=- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Internet"=- Is this wrong?

Looks good to me. Can you run HijackThis! yet? What operating system is it, XP, ME, Windows 2000, etc?

Its Windows XP. Also, I don't know if this makes a difference, but you said to save it under "all files", but there wasn't this option in notepad. No I still can't run Hijack this

Download Killbox from here:

Killbox.zip © Option^Explicit

Unzip it, but don't run it yet.

Copy the file names in the quote box below to the clipboard by highlighting them and pressing
C (hold the key down, then press C):

c:\windows\evolsux.exe
C:\windows\system32\drivers\helpsys\internet.exe
C:\Program Files\License_Manager\license_manager.exe

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Killbox.

In Killbox select "Delete on Reboot".

Click File (in the upper left of Killbox), and choose "Paste from Clipboard".

Click the red dot with the white X in it, in the upper right of Killbox, then click "Yes", and "Yes" again.

After the reboot, try to run HijackThis!.

Hijack this! now opens up. Which option do i need to select from the main screen? Thanks