hi all…
_________________________________
Welcome to the Forums.
The fixes we will use are specific to your problems and should only be used for this issue on this machine.
Please only use this topic to reply to.
Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!
Save and quit any work your doing before beginning the fix. All hijackthis logs I ask for should be done in normal mode ( not safe mode) These logs should be done last after you have followed my instructions in the previous post.
Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time.
If you have any questions about any advice given here please STOP and ask!
__________________________________
Please download
Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware , then click Finish . If an update is found, it will download and install the latest version. Once the program has loaded, select Perform full scan , then click Scan . When the scan is complete, click OK , then Show Results to view the results. Be sure that everything is checked, and click Remove Selected . When completed, a log will open in Notepad. Please post the contents of that log.edit/ format / be sure word wrap is ; not checked. A new HJT log The report from Malwarebyes
hi…report frm malwarebytes: hijackthis log :
after doing this, firefox seems to be working fine and i am also able to download things onto the desktop..
but the problem with IE still persists..
i also notice a weird file called 'thumbs' (of type 'data base file') in several folders across all the drives( C:;D:;E:)
______________________________
RUN HJT
HJT
Run hijackthis and choose scan only and place a check by the following lines
if present .
Close all other windows and browsers except HJT before clicking on Fix Checked
O17 - HKLM\System\CCS\Services\Tcpip\..\{6CD6FE2B-FB9E-4903-8B86-51739B67CD72}: NameServer = 85.255.113.123 85.255.112.184
Close that.
_____________________________
Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath, copy and paste this filepath in there.
If theres is more than one file to scan, insert them 1 at a time.
C:\Program Files\WinDriveGuard\DriveGuard.exe
Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.
You may recieve a message stating "
"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file"
Just let me know if that is what you saw.
If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html
________________________________________________
Download Random's system information tool (RSIT) by random/random from here Double click on RSIT.exe to run RSIT Click Continue at the disclaimer screen. Once it has finished, two logs will open. Please post the contents of both log.txt (<info.txt (<
Did you scan again with Malwarebytes antiMalware once you were able to update it ?
If not please do so.
_________________________
In your next reply I would like to see:
A new HJT log The report from Jottis/Virus total The report from RSIT Descibe exactly what IE is doing wrong. Thumbd files are usually legitimate files.
hi…malware bytes log file: HJT log file: RSIT logs: log.txt: info.txt:
Navigate to and delete this folder
if present
C:\Program Files\
WinDriveGuard
______________________________
RUN HJT
HJT
Run hijackthis and choose scan only and place a check by the following lines
if present .
Close all other windows and browsers except HJT before clicking on Fix Checked
O4 - Global Startup: DriveGuard.lnk = C:\Program Files\WinDriveGuard\DriveGuard.exe
Close that.
_______________
Java needs updating to be more secure
Please download
JavaRa and unzip it to your desktop.
***Please close any instances of Internet Explorer before continuing!*** Double-click on JavaRa.exe to start the program. From the drop-down menu, choose English and click on Select . JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer. Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK . A logfile will pop up. Please save it to a convenient location.
Then download and install
Java Runtime Environment (JRE) 6 Update 10 .
__________________
With that I'm pretty sure your clear of Malware.
Internet explorer /Gmail
I know next to nothing about Gmail
So I will need the exact error message your seeing.
You may try repairing internet explorer first.
or upgrading to Internet explorer 7 from
http://www.microsoft.com/windows/downloads/ie/getitnow.mspx
Don't go for internet explorer 8 yet as it's still in Beta.
How to Reinstall or Repair Internet Explorer and Outlook Express
in Windows XP:
http://support.microsoft.com/default…;EN-US;q318378
http://www.windows-help.net/WindowsXP/howto-03.html
______________________________
You may write down the exact error message or do the following.
Guessing at what the error message says will be of no help.
Download
screenshot.exe by
AutoIT Team to your desktop.
Right Click on a blank space on your tool bar (
red Arrow ) to get the following menu.
click
Toolbars /
Desktop . (Black Arrow)
[external image: Posted Image]
You should now see Desktop on your toolbar next to the clock.
[external image: Posted Image]
By clicking on the arrows next to "Desktop" you should see the desktop contents . With the error your receiving showing ( or any directions needed for the screen shot you need) Scroll or place your pointer on screenshot.exe and click once. A new file will appear on your desktop called screenshot.jpg Add that (Screenshot.jpg ) as an attachment to your next post.
_________________________
In your next reply I would like to see:
A new HJT log Screen shot.JPG
Due to inactivity this topic will be closed.
If you need help please start a new thread and post a new HJT log
