Jump to content



  • This topic is locked This topic is locked
7 replies to this topic

#1 zastrozzi



  • Full Member
  • Pip
  • 9 posts

Posted 25 May 2004 - 09:34 AM

hi. i recently removed a browser hijack and somehow it broke the link .txt files had to notepad. I can direct them there manually by typing in the path each time but they will not find it on their own. Also if I just try a right-click and select "open with" there is only the generic application icon for an .exe file called NOTEPAD.exe instead of the normal flip-pad icon. How do i fix this prob ? Also i just noticed two established connections to deploy.akamaitechnologies.net. I can't believe it, I just can't keep them off my comp no matter what i do. Who the hell are these folks and why are they connecting to me ? I would post a hijackthis log if i could but now i cant seem to get notepad to work at all, even manually.

Edited by zastrozzi, 25 May 2004 - 03:10 PM.

#2 zastrozzi



  • Full Member
  • Pip
  • 9 posts

Posted 25 May 2004 - 10:43 AM

ok i used wordpad to post a hijackthis log:

Running processes:
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Port Explorer Evaluation\PEDemo.exe
C:\Documents and Settings\Bacchus\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ca.msn.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O9 - Extra button: Messenger (HKLM)
O9 - Extra 'Tools' menuitem: Messenger (HKLM)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupd...8131.5097916667
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macr...ash/swflash.cab

#3 zastrozzi



  • Full Member
  • Pip
  • 9 posts

Posted 25 May 2004 - 02:59 PM


#4 digital



  • New Member
  • Pip
  • 1 posts

Posted 25 May 2004 - 03:50 PM

I seem to be having the same problem with Notepad. It just started for me about 5 days go. I am not sure myself what the problem is. have you found anything out about it at all?

#5 d4vr0s



  • Full Member
  • Pip
  • 7 posts

Posted 25 May 2004 - 03:56 PM

If you are running XP check the windows directory for a notepad.exe that's about 66kb and dated 8/29/2002 if it's there then check the system32 directory for the same file. I've seen the latter being replaced with a smaller .exe. If this is the case copy the one from the windows directory to the system32 directory.

#6 Kevin_b_er


    Gliding through the clutter

  • Retired Staff - Helper
  • Pip
  • 36 posts

Posted 25 May 2004 - 05:46 PM

What version of windows are you using?

Check and [Fix] this in hijackthis while you're at it.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*

Merijn, who has made several great programs that we use, including hijackthis and cwshredder has this webpage with some windows XP files for english versions of Windows XP.

If it stuff does not work at that point, copy what's in the quote box into wordpad.


"Content Type"="text/plain"


@="Text Document2"









Save it as txt reg restore.reg. Change file type from RTF to "Text Document" then click the save button. Wordpad will complain about saving it in "text-only" format, just click yes. You can then load the registry file into regedit by just double-clicking the registry file. (If you've done it right, the .reg file will have an icon with a green-ish block being disassembled in one corner)

After doing both, text files should be working quite well.

#7 zastrozzi



  • Full Member
  • Pip
  • 9 posts

Posted 25 May 2004 - 07:37 PM

thanks for your interest guys and thank you kevin for your solution, the reg restore seems to have cleaned up the problem nicely.

#8 Daemon


    Security Expert

  • Emeritus
  • PipPipPipPipPip
  • 3,350 posts

Posted 29 May 2004 - 08:10 AM

Glad we could help :D

As this problem has been resolved the topic will be closed. If you need this topic reopened, please click here to email the moderating team - be sure to include the address of the thread and the name you posted under.
Posted Image

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

Member of ASAP and UNITE
Support SpywareInfo Forum - click the button