Hello. I was attempting to create a new hijack log to save as a good copy and ran into all kinds of problems trying to run the log.
I first got this message:
For some reason your system denied write access to the Hosts file. If any Hijacked domains are in this file, HijackThis may NOT be able to fix this. If that happens, you need to edit the file yourself. To do this,
click Start, Run and type:
notepad "C:\Windows\system32\drivers\etc\hosts"
Press Enter. Find the line(s) HijackThis reports and delete them. Save the file as "hosts." (with quotes) and reboot.
Then I got this message:
An unexpected error has occurred at procedure:
modMain_CheckOther1Item0
Error #75 - Path/File access error
Please email me at
[removed], reporting the following:
What you were trying to fix when the error occurred, if applicable
How you can reproduce the error
A complete HijackThis scan log, if possible.
windows version: Windows NT 6.00.1904
MSIE version 7.0.6000.16473
Hijack this version: 1.99.1
This message has been copied to your clipboard. Click OK to continue the rest of scan.
When I run the log, the running processes don't appear in the log. It does not allow me to copy and paste (so I cannot bring over a copy) and it doesn't allow me to save a file, telling me:
Cannot find the C:\program Files\Hijack this\2.txt.file
Do you want to create a new file?
If I click yes, it only brings up a blank page.
I followed the directions above and went into Start, Run…
# Copyright © 1993-2006 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host
127.0.0.1 localhost
::1 localhost
there was one match to the Hijack log:
01 - Hosts ::1 localhost
I'm not sure if I should delete this?
I hope something here makes sense to someone because it sure doesn't to me. Thanks for any help.
Hello Alicia_O
Welcome, sorry for the delay. You may have better luck with the new version by TrendMicro
TrendMicro HJT Go to C:\Program Files and create a New Folder and name it TM HJT. Download the executable file from the above link to C:\Program Files\TM HJT. Open HJT Scan and Save a Log File, it will open in Notepad Go to Format and make sure Wordwrap is Unchecked Go to Edit> Select All…………..Edit > Copy and Paste the new log into this thread. DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
Thank you. Sorry for the delayed response, I was out of town.
Hello Alicia,
Not a problem on the replies, been away myself the past month or so.
Go to C:\Program Files and once inside the folder , you can right click inside the folder and go to New> Folder and name the folder Hijackthis, then go to where you have HJT on your desktop, right click on it and choose CUT, then paste it into the new folder you just created.
Open
HijackThis > Do a System Scan Only, close your browser and all open windows, the only program or window you should have open is
HijackThis , check the following entries and click on
Fix Checked.
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
The rest of your log looks fine
What issues are you having to make you post in a malware removal forum.
Ken
Hello. I ran another file and tried to remove the entries you suggested but for whatever reason they won't delete. Any ideas how to remove those two lines or why it won't allow me to remove them?
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
I keep getting spyware named 'Zedo' that causes pop ups. I remove this several times a day but it always returns.
Thanks again.
You have Spybot Search and Destroy installed, you can set it up this way and run it to remove Zedo.
If you have the older version 1.3 , remove it via the
Add-Remove Programs in the
Control Panel.
During Installation, just follow all the defaults. Go to Mode and click on Advanced Mode Then to Updates Search for Updates If you get a Bad Checksum Error , just choose a different download location. Then to Settings/ File Sets and take the checkmark out of Usage Tracks Then to Tools/ Hosts Files click on Add Spybot S&D Hosts Files. Then to Tools/ IE Tweeks and put a checkmark in Lock the Hosts Files Then to Immunize. Up at the top by the GREEN SIGN , click on Immunize. Then to Search and Destroy/ Check for Problems Let it scan your system Then to Fix Problems and fix all it finds. Reboot your computer.
Go to
C:\Program Files and once inside the folder , you can
right click inside the folder and go to
New> Folder and name the folder
Hijackthis , then go to where you have HJT on your
desktop, right click on it and choose CUT, then paste it into the new folder you just created.
Then do this C:\Program Files\hijackthis\
hijackthis.exe <—Right click on this and rename it to Scanner.exe and post a new HJT log.
Thank you again. The only problem I had was finding hijackthis.exe to rename it.
Good Morning Alicia,
Lets forget about renaming HJT at the moment, I am not sure its related to your problem. But we need to disable these two programs as they are interfering with HJT fixing those entries.
You need to disable
Spyware Guard as it may interfere with the fix.
Double click on the Red SG Icon in your system tray. Go to Options and remove the Three security checkmarks. OK your way out of the program Dont forget to re enable this when we are done fixing your computer
We need to disable the
Tea Timer in
Spybot Search and Destroy as to not interfere with the fix.
Open Spybot and go to Mode> Advanced Mode> Tools> Resident and take the checkmark out of Tea Timer
Then try fixing these with HJT, its not earth shattering , there more clutter than anything else but they should be removed.
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
Did Spybot S&D remove Zedo ??
Hi. I did exactly as you described, but I'm still not able to remove those two lines. I click Fix, everything disappears to a blank log. When I re-run HJT they still come up.
Also, I got another Zedo popup today. When I ran Spybot it showed 5 hits of Zedo.
Alicia
Alicia,
You should only use either the TeaTimer in Spybot Search and Destroy or Spyware Guard, by using them both they will conflict with each other.
Zedo is just a tracking cookie, its not malware. Here are a couple of options for you to try.
Open
Internet Explorer and go to Tools and make sure the
Pop Up Blocker is enabled.
Then while in Internet Explorer, go to
Tools > Internet Options and on the
General Tab under
Browsing History ( Delete Temporary Files> History> Cookies and saved passwords )
click on Delete. Then go to the
Privacy Tab and under
Sites, make sure
Zedo.com is blocked , if its not listed, just
type in Zedo.com and click on
Block.
As far as these, they are more clutter and not malware but with spybot and spyware guard being disabled they should remove. You can try booting to Safemode and see if they will go that way.
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
Don't let this scare you, once your done you just hit Start/ Restart and you will boot right back into normal windows. It may take you a time or two to get the timing right .
To Enter Safemode Go to Start> Shut off your Computer> Restart As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, Use the Up and Down Arrow Keys to scroll up to Safemode Then press the Enter Key on your Keyboard Tutorial if you need it
How to boot into Safemode
How to boot into
Safemode
Bleeping Computer Tut
Let me know how you did?
Good afternoon.
That's fine, your log looks good.
Hers is some reading for you to help keep you more secure.
How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
Tutorial for System Restore Tom Coyote TonyKlein CastleCops Grinler BleepingComputer Geeks To Go Dslreports
Ken
Thank you Ken for all your help! Haven't had Vista for very long and it's been a bit confusing. Thanks again for helping
~Alicia
Alicia,
I just got a new laptop with Vista Home Premium and I am loving it. Windows is windows, same things still there, just have to hunt for them.
Its been a pleasure helping you.
Ken
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Coyote's Installed programs for prevention:
http://forums.tomcoyote.org/index.php?showtopic=31418
The help you receive here is free. If you wish to show your appreciation, then you may donate
Visit the CoyoteStore
http://TomCoyote.org/coyotestore.php
