What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] please help

3 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
hello, thanks for listening.

i apologize if i didnt post this correctly. i'm new here, i'm not a tech person, it's confusing.

anyway,
i'm currently working in safe mode on my comp.

when i tried to log in regularly, i was notified that i couldnt
login under my user profile, so a default one was being used
because i dont have enough space.

my space is showing to be zero mg. i cant even download
hijackthis 2 for that matter, i cant download regcure, or anything
to clean up this mess.

it also reads error not a valid win 32 app.

heeeellllp!! thanks, sdcast

add-on
ok i was able to download hijackthis 1.99.1
and heres a log

update with log fileLogfile of HijackThis v1.99.1
Scan saved at 4:08:52 PM, on 10/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

http://www.kingdomofpets.com/affiliates/general.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

c:\windows\SYSTEM\blank.htm
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program

Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk =

C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Global Startup: Hewlett-Packard Pavilion Registration.lnk =

C:\HP\Register\REMIND32.EXE
O9 - Extra button: RealGuide -

{CD67F990-D8E9-11d2-98FE-00C0F0318AFE} -

C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3}

(MUWebControl Class) -

http://www.update.microsoft.com/microsoftu…ontrols/en/x86/

client/muweb_site.cab?1210304376572
Post #2 last edited
[external image: Posted Image]

Stay with this topic until I give you the all clean post.

Click: Start > All Programs> Accessories
Open Notepad, click on Format and uncheck Word Wrap.


Next:

1. Open My Computer
2. Right click on your hard drive that you wish to clean (C drive, for example)
3. In the context menu that opens, select properties
4. Under the general tab you should select Disk Cleanup
5. Windows will scan your drive which will take a few seconds/minutes
6. A box will display the various files you can remove.
Check all boxes except compress old files (If listed)
7. Click OK and windows will comply.

Restart your computer in Normal Mode

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.
Post #3
this message is for LDTATE
thanks for your quick response. i did
everything as instructed. unchecking word wrap
disk cleanup from my comp., reboot, etc.
after i did the disk cleanup, it is still showing
0 mg. i am operating in normal mode, i am
able to check email and so forth. but this
other website i logged onto looks crazy
meaning the tables and html is out of sync.
thanks, sdcast



Logfile of HijackThis v1.99.1
Scan saved at 5:58:07 PM, on 10/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Hp\Register\Remind32.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\WINDOWS\SYSTEM32\CLEANMGR.EXE
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kingdomofpets.com/affiliates/general.php
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\MSWorks\Calendar\WKCALREM.EXE
O4 - Global Startup: Hewlett-Packard Pavilion Registration.lnk = C:\HP\Register\REMIND32.EXE
O9 - Extra button: RealGuide - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1210304376572
Post #4
You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #5
hi LDTATE, thanks continually. ok i got past the show hidden files but when i try to run the atf cleaner it gives me this: C:\documentsandsettings\hpauthorizedcustom\localsettings\temporaryinternetfiles\content.IES\4t8z8f0z\aft-cleaner[1].exeis not a valid win 32 application
Post #7
Hi LDTATE ok its now more complex. this morning i cant even log into my computer. i'm using a public comp. right now. it will boot up a little then display "insufficient system resources exist to complete API" then close, it doesnt shut off completely, it just sounds like its trying to boot completely up, but something keeping it from doing so. what the heck does this mean. time to chuck it? this library closes at 5pm i'll check back, hopefully you've responded. and i can get back on, take it for repair, or chuck it. thanks sharon
Post #8
It sounds like your windows software os is corrupt.

You can use windows sfc (system file checker) You'd need your XP CD to make this work.
Click Start> Run> type sfc /scannow Note the space.
(Note that there is a space between sfc and /scannow)
Post #9
hi LDTATE i bought this computer off someone, didnt think to get the cd. if you mail me one, i'll pay u thru paypal. let me know how much first, then i'll send u the address through email. unless u can tell me a quicker way and where to download. thanks sharon
Post #11
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI