Jump to content


Photo

HijackThis log file and Bug report


  • Please log in to reply
1 reply to this topic

#1 esoterik

esoterik

    Member

  • Full Member
  • Pip
  • 2 posts

Posted 27 June 2004 - 12:34 AM

http://www.spywarein...849543da3287f3a

My browswer starts up with the "solongas" or "here4search" or "C:\windows\system\hp.uti" page. Please help me fix this problem.

The following is my log file.

Logfile of HijackThis v1.97.7
Scan saved at 5:40:18 PM, on 6/26/04
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\RPCSS.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\HKCMD.EXE
C:\WINDOWS\RUNDLL.32.EXE
C:\WINDOWS\RUNDLL32.EXE
C:\WINDOWS\SYSTEM\WWMZHR.EXE
C:\WINDOWS\SYSTEM32\PCS\PCSVC.EXE
C:\PROGRAM FILES\COMMON FILES\DPI\DPI.EXE
C:\WINDOWS\WINH.EXE
C:\WINDOWS\SYSTEM32\DEINST_QFE002.EXE
C:\WINDOWS\SYSTEM\ROU8DMOD.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM32\SYSTEM_18387.DAT
C:\WINDOWS\SM56HLPR.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\MY DOCUMENTS\MYOWNMUSICK\NEW SONGS\HIJACKTHIS.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchURL = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mail.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://solongas.com/hp.htm?id=80
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mail.com
R1 - HKLM\Software\Microsoft\Internet Explorer,SearchURL = http://www.mail.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.mail.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mail.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mail.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mail.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mail.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.mail.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = http://aifind.info/
R1 - HKCU\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)
R1 - HKLM\Software\Microsoft\Internet Explorer,Search = http://nkvd.us (obfuscated)
O2 - BHO: (no name) - {A9A674BF-771F-42E5-A440-D20DDA85A862} - C:\WINDOWS\SYSTEM\E33AS2PU4EHM.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\PROGRAM FILES\MYWAY\MYBAR\1.BIN\MYBAR.DLL (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: Search - {2CF0B992-5EEB-4143-99C0-5297EF71F444} - C:\WINDOWS\SYSTEM\STLBDIST.DLL
O3 - Toolbar: Band Class - {C5183ABC-EB6E-4E05-B8C9-500A16B6CF94} - C:\PROGRAM FILES\SEP\SEP.DLL
O3 - Toolbar: MSN Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\PROGRAM FILES\MSN TOOLBAR\01.01.1601.0\EN-US\MSNTB.DLL
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [NAV Agent] C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\SYSTEM\hkcmd.exe
O4 - HKLM\..\Run: [LoadProfile] C:\windows\Rundll.32.exe
O4 - HKLM\..\Run: [jopa] C:\WINDOWS\SYSTEM\SYSSTARTUP.EXE
O4 - HKLM\..\Run: [{2CF0B992-5EEB-4143-99C0-5297EF71F444}] rundll32.exe C:\WINDOWS\SYSTEM\STLBDIST.DLL,DllRunMain
O4 - HKLM\..\Run: [qaorrrcedxqlg] C:\WINDOWS\SYSTEM\wwmzhr.exe
O4 - HKLM\..\Run: [Pcsv] C:\WINDOWS\system32\pcs\pcsvc.exe
O4 - HKLM\..\Run: [Dpi] C:\PROGRAM FILES\COMMON FILES\DPI\DPI.EXE
O4 - HKLM\..\Run: [Winhost] C:\WINDOWS\winh.exe
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKCU\..\Run: [jopa] C:\WINDOWS\SYSTEM\SYSSTARTUP.EXE
O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll
O4 - HKCU\..\Run: [SpywareGuard] C:\WINDOWS\SYSTEM32\DEINST_QFE001.EXE
O4 - HKCU\..\Run: [Windows Update Checker] C:\WINDOWS\SYSTEM32\DEINST_QFE002.EXE
O4 - HKCU\..\Run: [byomRWZmU] ROU8DMOD.EXE
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra 'Tools' menuitem: MaxSpeed (HKLM)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O13 - Home Prefix: http://%6E%6B%76%64%2E%75%73/
O13 - Mosaic Prefix: http://%6E%6B%76%64%2E%75%73/
O15 - Trusted Zone: *.greg-search.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = aa
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 203.122.63.154,203.122.63.152


The following is the bug report from Spybot Search and Destroy.


--- Search result list ---

--- Spybot-S&D version: 1.2 ---
2003-03-16 Includes\Temporary.sbi
2003-03-16 Includes\Cookies.sbi
2003-03-16 Includes\Dialer.sbi
2003-03-16 Includes\Hijackers.sbi
2003-03-16 Includes\Keyloggers.sbi
2003-03-16 Includes\Malware.sbi
2003-03-16 Includes\plugin-ignore.ini
2003-03-16 Includes\Security.sbi
2003-03-16 Includes\Spybots.sbi
2003-03-16 Includes\Tracks.uti
2003-03-16 Includes\Trojans.sbi


--- System information ---
Windows 98 (Build: 2222) A


--- Startup entries list ---
Spybot-S&D Startup list report, 6/27/04 10:31:10 AM

Located: HK_CU:Run, jopa
file: C:\WINDOWS\SYSTEM\SYSSTARTUP.EXE
MD5: 9DB9FFA8F8895914558B6521B05D344D

Located: HK_CU:Run, uninstal
file: regsvr32 /u /s image.dll

Located: HK_CU:Run, SpywareGuard
file: C:\WINDOWS\SYSTEM32\DEINST_QFE001.EXE

Located: HK_CU:Run, Windows Update Checker
file: C:\WINDOWS\SYSTEM32\DEINST_QFE002.EXE
MD5: CCBFBEECC22168E907543F78E207F077

Located: HK_CU:Run, byomRWZmU
file: ROU8DMOD.EXE

Located: HK_CU:Run, msnmsgr
file: "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

Located: HK_CU:Run, msnmsgr (DISABLED)
file: "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background

Located: HK_LM:Run, ScanRegistry
file: C:\WINDOWS\scanregw.exe /autorun

Located: HK_LM:Run, SystemTray
file: SysTray.Exe

Located: HK_LM:Run, NAV Agent
file: C:\PROGRA~1\NORTON~1\NAVAPW32.EXE
MD5: 89EDB06C1EA1A7F4A513FF1DBECBF73B

Located: HK_LM:Run, LoadPowerProfile
file: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

Located: HK_LM:Run, HotKeysCmds
file: C:\WINDOWS\SYSTEM\hkcmd.exe
MD5: 318B39089FF44D57368EFF1EC81BDEFD

Located: HK_LM:Run, LoadProfile
file: C:\windows\Rundll.32.exe
MD5: DE7AC7AC50114A44CBCB16B414501EB1

Located: HK_LM:Run, jopa
file: C:\WINDOWS\SYSTEM\SYSSTARTUP.EXE
MD5: 9DB9FFA8F8895914558B6521B05D344D

Located: HK_LM:Run, {2CF0B992-5EEB-4143-99C0-5297EF71F444}
file: rundll32.exe C:\WINDOWS\SYSTEM\STLBDIST.DLL,DllRunMain

Located: HK_LM:Run, qaorrrcedxqlg
file: C:\WINDOWS\SYSTEM\wwmzhr.exe
MD5: 0A71D97E357DE7529A417C16CA296D9B

Located: HK_LM:Run, Pcsv
file: C:\WINDOWS\system32\pcs\pcsvc.exe
MD5: 26E2D1FAB18A38ED48CDC594CF696CC1

Located: HK_LM:Run, Dpi
file: C:\PROGRAM FILES\COMMON FILES\DPI\DPI.EXE
MD5: 0782D3416735CA91C24837B80C4ACF6C

Located: HK_LM:Run, Winhost
file: C:\WINDOWS\winh.exe
MD5: 397511AE31ECA152F6B2347807A71C17

Located: HK_LM:Run, 84nn.exe (DISABLED)
file: C:\WINDOWS\TEMP\84NN.EXE
MD5: 6D3A72776CD4E36E806E14490CF85061

Located: HK_LM:Run, ClrSchLoader (DISABLED)
file: \Program Files\ClearSearch\Loader.exe

Located: HK_LM:Run, Bakra (DISABLED)
file: C:\WINDOWS\SYSTEM\IEHost.exe
MD5: 40CDAD20387104C08A88E6416966BB8C

Located: HK_LM:Run, IgfxTray (DISABLED)
file: C:\WINDOWS\SYSTEM\igfxtray.exe
MD5: C0CA97B06360872117E472EBA3D25242

Located: HK_LM:Run, AutoUpdater (DISABLED)
file: "c:\Program Files\AutoUpdate\AutoUpdate.exe"

Located: HK_LM:Run, RunWindowsUpdate (DISABLED)
file: C:\WINDOWS\UPTODATE.EXE
MD5: 5BED39E954CE657CD4899890D900FB00

Located: HK_LM:Run, LoadQM (DISABLED)
file: loadqm.exe

Located: HK_LM:RunServices, ScriptBlocking
file: "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg

Located: HK_LM:RunServices, LoadPowerProfile
file: Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

Located: HK_LM:RunServices, Machine Debug Manager (DISABLED)
file: C:\WINDOWS\SYSTEM\MDM.EXE
MD5: 95D85D69FFC099C516D99CB9581E3FE2

Located: HK_LM:RunServices, SchedulingAgent (DISABLED)
file: mstask.exe



--- Browser helper object list ---
Spybot-S&D Browser helper object report, 6/27/04 10:31:10 AM

{A9A674BF-771F-42E5-A440-D20DDA85A862}
Class file: E33AS2PU4EHM.DLL
Attributes: archive
Date: 5/31/04 2:11:52 PM
MD5: 80C589A989F6920455C1B78B43F8E4A5
Path: C:\WINDOWS\SYSTEM\
Short name: E33AS2~1.DLL
Size: 63488 bytes
Version: 0.1.0.0


--- ActiveX list ---
Spybot-S&D ActiveX report, 6/27/04 10:31:10 AM

Microsoft XML Parser for Java
Download location: file://C:\WINDOWS\Java\classes\xmldso.cab
Name: Microsoft XML Parser for Java
Version: 1,0,9,2

DirectAnimation Java Classes
Download location: file://C:\WINDOWS\SYSTEM\dajava.cab
Name: DirectAnimation Java Classes
Version: 5,1,15,1014

Internet Explorer Classes for Java
Download location: file://C:\WINDOWS\SYSTEM\iejava.cab
Name: Internet Explorer Classes for Java
Version: 5,0,2614,3500

{D27CDB6E-AE6D-11CF-96B8-444553540000}
Class file: FLASH.OCX
Attributes:
Date: 2/24/03 4:20:36 PM
MD5: E61DB5468D6CCC46397C1A918C1A1AA4
Path: C:\WINDOWS\SYSTEM\MACROMED\FLASH\
Short name: FLASH.OCX
Size: 827392 bytes
Version: 0.6.0.0
Class name: Shockwave Flash Object
CLSID database: legitimate software
Description: Macromedia Shockwave Flash Player
Download location: http://download.macr...ash/swflash.cab
Last modified: Wed, 26 Feb 2003 19:22:35 GMT
Version: 6,0,79,0

{32564D57-0000-0010-8000-00AA00389B71}
Download location: http://codecs.micros...i386/wmv8ax.cab
Last modified: Mon, 05 Mar 2001 20:07:04 GMT
Version: 0,0,0,1

{31564D57-0000-0010-8000-00AA00389B71}
Download location: http://codecs.micros.../i386/wmvax.cab
Last modified: Tue, 09 May 2000 02:16:31 GMT
Version: 0,0,0,1

{0000000A-9980-0010-8000-00AA00389B71}
Download location: http://codecs.micros...86/wmsp9dmo.cab
Last modified: Thu, 12 Dec 2002 21:28:24 GMT
Version: 0,0,0,1

{33564D57-9980-0010-8000-00AA00389B71}
Download location: http://codecs.micros...386/wmv9dmo.cab
Last modified: Thu, 12 Dec 2002 21:29:19 GMT
Version: 0,0,0,1


--- Process list ---
Spybot-S&D process list report, 6/27/04 10:31:10 AM

PID: 4292872985 (4294869545) C:\WINDOWS\SYSTEM\SYSTRAY.EXE
PID: 4292907289 (4294869545) C:\WINDOWS\RUNDLL.32.EXE
PID: 4292907553 (4294869545) C:\WINDOWS\SYSTEM\HKCMD.EXE
PID: 4292956241 (4294869545) C:\WINDOWS\SYSTEM\RPCSS.EXE
PID: 4292988193 (4294869545) C:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
PID: 4293018877 (4292907553) C:\WINDOWS\SYSTEM\DDHELP.EXE
PID: 4293056817 (4294869545) C:\WINDOWS\WINH.EXE
PID: 4293069957 (4294869545) C:\PROGRAM FILES\COMMON FILES\DPI\DPI.EXE
PID: 4293094465 (4294869545) C:\WINDOWS\SYSTEM32\DEINST_QFE002.EXE
PID: 4293110353 (4294869545) C:\WINDOWS\SYSTEM\WWMZHR.EXE
PID: 4293110681 (4294869545) C:\WINDOWS\RUNDLL32.EXE
PID: 4293120721 (4294869545) C:\WINDOWS\SYSTEM32\PCS\PCSVC.EXE
PID: 4293174705 (4292872985) C:\WINDOWS\SYSTEM\WMIEXE.EXE
PID: 4293180873 (4294869545) C:\WINDOWS\SYSTEM\MSTASK.EXE
PID: 4293198201 (4294869545) C:\WINDOWS\SYSTEM\ROU8DMOD.EXE
PID: 4293253497 (4294869545) C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
PID: 4293266865 (4294869545) C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE\WINWORD.EXE
PID: 4293334361 (4294869545) C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
PID: 4293370449 (4293266865) C:\WINDOWS\SYSTEM\SPOOL32.EXE
PID: 4293473341 (4294869545) C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
PID: 4293599153 (4294869545) C:\PROGRAM FILES\SPYBOT - SEARCH & DESTROY\SPYBOTSD.EXE
PID: 4293888309 (2123438309) C:\WINDOWS\SYSTEM\KERNEL32.DLL
PID: 4294841969 (4294954445) C:\WINDOWS\SYSTEM\mmtask.tsk
PID: 4294869545 (4294954445) C:\WINDOWS\EXPLORER.EXE
PID: 4294870817 (4294836701) C:\WINDOWS\RUNDLL32.EXE
PID: 4294954445 (4293888309) C:\WINDOWS\SYSTEM\MSGSRV32.EXE
PID: 4294965885 (4294954445) C:\WINDOWS\SYSTEM\MPREXE.EXE


--- Browser start & search pages list ---
Spybot-S&D browser pages report, 6/27/04 10:31:10 AM

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL
http://solongas.com/sp.htm?id=80
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SearchURL
http://www.mail.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Page
http://solongas.com/sp.htm?id=80
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Search Bar
http://solongas.com/sp.htm?id=80
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page
http://solongas.com/hp.htm?id=80
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.mail.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.mail.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://solongas.com/sp.htm?id=80
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://www.mail.com
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl\@
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchURL
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Page
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Search Bar
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Start Page
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Page_URL
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\Default_Search_URL
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\SearchAssistant
http://www.mail.com
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search\CustomizeSearch
http://www.mail.com


--- Winsock Layered Service Provider list ---
Spybot-S&D winsock LSP report, 6/27/04 10:31:10 AM

NS Provider ( 1) DNS Name Space Provider. ({FF017DE2-CAE9-11CF-8A99-00AA0062C609})
Protocol ( 1) MS.w95.spi.osp ({FF017DE1-CAE9-11CF-8A99-00AA0062C609})
Protocol ( 2) MS.w95.spi.tcp ({FF017DE0-CAE9-11CF-8A99-00AA0062C609})
Protocol ( 3) MS.w95.spi.udp ({FF017DE0-CAE9-11CF-8A99-00AA0062C609})
Protocol ( 4) MS.w95.spi.raw ({FF017DE0-CAE9-11CF-8A99-00AA0062C609})
Protocol ( 5) MS.w95.spi.rsvptcp ({ECBDCBA0-334A-11D0-BD88-0000C082E69A})
Protocol ( 6) MS.w95.spi.rsvpudp ({ECBDCBA0-334A-11D0-BD88-0000C082E69A})


Kindly advise me further.

#2 Daemon

Daemon

    Security Expert

  • Emeritus
  • PipPipPipPipPip
  • 3,350 posts

Posted 27 June 2004 - 05:41 AM

Could you click here to download CWShredder by Merijn Bellekom and run it, hit 'fix' as opposed to 'scan only'. If you already have CWShredder, click 'Check for update' and make sure you are running version 1.59. Reboot when done.

Click here to download Ad-Aware and install. Before scanning click on "check for updates now" to make sure you have the latest reference file. Then click the gear wheel at the top and check these options:

General> activate these: "Automatically save log-file" and "Automatically quarantine objects prior to removal"

Scanning > activate these: "Scan within archives", "Scan active processes", "Scan registry", "Deep scan registry", "Scan my IE Favorites for banned sites" and "Scan my Hosts file"

Tweaks > Scanning Engine> activate this: "Unload recognized processes during scanning."

Tweaks > Cleaning Engine: activate these: "Automatically try to unregister objects prior to deletion" and "Let Windows remove files in use after reboot."

Click "Proceed" to save your settings, then click "Start", make sure "Activate in-depth scan" is ticked green then scan your system. When the scan is finished, the screen will tell you if anything has been found, click "Next". The bad files will be listed, right click the pane and click "Select all objects" - this will put a check mark in the box at the side, click "Next" again and click "OK" at the prompt "# objects will be removed. Continue?".

Reboot when done. Rescan with HJT and post a new log here for a final check over.
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button