Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!
   
4 Pages V   1 2 3 > »   
 Closed TopicStart new topic
Aurora Pop-ups, how to remove? [CLOSED]
bulaklak_01
post Jul 23 2005, 10:01 AM
Post #1


Member
**
Posts: 30
OS: XP
helpsmilie.gif

These pop ups have been popping up on my computer for some time now, and they drive me crazy! ranting.gif

On the window when the Aurora pop up appears it says: Aurora - Part of the IBM network, they advertise all kinds of things, including party poker which is sooo annoying. The pop up keeps on asking me if I want to download things, which I don't.

I hope they can be sorted before they get out of hand.

Thanks,

Here is my HijackThis logfile ...

Logfile of HijackThis v1.99.1
Scan saved at 15:49:32, on 23/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atlul32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
c:\windows\system32\odolcun.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\MyWay\bar\1.bin\mwsoemon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\sysuu.exe
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\System32\wintask.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\WINDOWS\system32\arqanr.exe
C:\Program Files\Save\Save.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\system32\recwizc.exe
C:\WINDOWS\system32\exp.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\WINDOWS\system\sjkbj.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\cdfoops.exe
C:\Program Files\Cas\Client\casclient.exe
C:\PROGRA~1\COMMON~1\ofzr\ofzrm.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\AOL\Broadband CheckUp\bin\mpbtn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\PROGRA~1\CleanUp!\cleanup.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Common Files\Nullsoft\ActiveX\2.0\AOLMed~1.exe
C:\DOCUME~1\-Swede-\LOCALS~1\Temp\Temporary Directory 1 for HijackThis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\hcjfj.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/8SE/1?http://toolbar.msn....&CM=MsgrInstall
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {5B7AB13C-069E-0A96-369B-83180E283DCD} - C:\WINDOWS\atllf.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [274.tmp] C:\DOCUME~1\#swede#\LOCALS~1\Temp\274.tmp.exe 1 28129
O4 - HKLM\..\Run: [276.tmp] C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
O4 - HKLM\..\Run: [276.tmp.exe] C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
O4 - HKLM\..\Run: [sysuu.exe] C:\WINDOWS\sysuu.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.02.3000.1001\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitekpz32.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\arqanr.exe reg_run
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [07rU35Q] recwizc.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [qsqtxv] c:\windows\system32\odolcun.exe r
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Hw08RRc9l] cdfoops.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [180ClientStubInstall] "C:\temp\stubinstaller6480.exe"
O4 - HKCU\..\Run: [ofzr] C:\PROGRA~1\COMMON~1\ofzr\ofzrm.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Broadband Check-Up.lnk = C:\Program Files\AOL\Broadband CheckUp\bin\matcli.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\JetCar.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\JetCar.exe
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD...sharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/gamc7-gb/gbc7/games4.cab
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://D:\Resources\IntraLaunch.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game18.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {E154E3CC-0C3A-4101-91D8-6B4876F0FD64} (PrintScreen Class) - http://www.myemo.com/my_picture/Flash2Image.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D95F3B9B-9E93-43AA-A22E-A092CEDEA644}: NameServer = 205.188.146.145
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlul32.exe" /s (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 23 2005, 10:31 AM
Post #2


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


Hi bulaklak and welcome to the Geeks to Go Forums.

My name is Trevuren and I will be helping you with your log.

1. If you haven't logged in go to Geeks to Go and do so. Then proceed to item a.

If you already have logged in, go directly to item a.

a. Click on My Controls at the top right hand corner of the window.
b. In the left hand column, click "View Topics"
c. If you click on the title of your post, you will be taken there

2. Also, while at the My Controls page, check the box to the right of your post and then scroll down.
.Where it says "unsubscribe" click the pull-down menu and select "immediate email notification"


3. I see by your log that you have more serious problems than Nail/Aurora. There is an About:Blank infection and a few othrs that have to be dealth with before reaching the Aurora fix.

4. Please DELETE your current HJT program from its present location.

5. Download and run the following HijackThis autoinstall program from Here HJT needs to be in its own folder so that the program itself isn't deleted by accident. Having the backups could be VITAL to restoring your system if something went wrong in the FIX process!

A. Close ALL windows except HJT

B. SCAN with HJT and SAVE LOG. (a notepad window will open with the log in it when you click Save Log) (Ctrl-A to'select all', Ctrl-C to 'copy')

C. POST the log in this thread using 'Add Reply' (Ctrl-V to 'paste')


DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL WE CHECK THE LOG, AS MOST OF THE FILES ARE LEGIT AND VITAL TO THE FUNCTION OF YOUR COMPUTER


Regards,

Trevuren
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 26 2005, 10:37 AM
Post #3


Member
**
Posts: 30
OS: XP
I have done what you have told me with the HJT programme.

Here is my logfile ...

Logfile of HijackThis v1.99.1
Scan saved at 17:36:28, on 26/07/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\atlul32.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
c:\windows\system32\xnackby.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\PROGRA~1\MyWay\bar\1.bin\mwsoemon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\VoyagerTest\fts.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe
C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
C:\WINDOWS\sysuu.exe
C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-gb\msnappau.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\System32\wintask.exe
C:\PROGRA~1\VBouncer\VirtualBouncer.exe
C:\WINDOWS\system32\arqanr.exe
C:\Program Files\AutoUpdate\AutoUpdate.exe
C:\WINDOWS\system32\recwizc.exe
C:\WINDOWS\system32\exp.exe
C:\Program Files\BullsEye Network\bin\bargains.exe
C:\Program Files\NaviSearch\bin\nls.exe
C:\Program Files\Save\Save.exe
C:\WINDOWS\system\sjkbj.exe
C:\WINDOWS\system32\cdfoops.exe
C:\PROGRA~1\COMMON~1\ofzr\ofzrm.exe
C:\PROGRA~1\COMMON~1\ofzr\ofzra.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\AOL 9.0\waol.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\AOL\Broadband CheckUp\bin\mpbtn.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Common Files\AOL\aoltpspd.exe
C:\Program Files\Common Files\Nullsoft\ActiveX\2.0\AOLMed~1.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/8SE/1?http://toolbar.msn....&CM=MsgrInstall
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {4FD3C147-41DE-1F3D-33EC-2D9B34788A22} - C:\WINDOWS\system32\msvg32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [%FP%Friendly fts.exe] "C:\Program Files\VoyagerTest\fts.exe"
O4 - HKLM\..\Run: [DSLSTATEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslstat.exe icon
O4 - HKLM\..\Run: [DSLAGENTEXE] C:\Program Files\BT Voyager 105 ADSL Modem\dslagent.exe
O4 - HKLM\..\Run: [274.tmp] C:\DOCUME~1\#swede#\LOCALS~1\Temp\274.tmp.exe 1 28129
O4 - HKLM\..\Run: [276.tmp] C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
O4 - HKLM\..\Run: [276.tmp.exe] C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
O4 - HKLM\..\Run: [sysuu.exe] C:\WINDOWS\sysuu.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [msnappau] "C:\Program Files\MSN Apps\Updater\01.03.0000.1005\en-gb\msnappau.exe"
O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\elitekpz32.exe
O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\arqanr.exe reg_run
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
O4 - HKLM\..\Run: [07rU35Q] recwizc.exe
O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKLM\..\Run: [vwowfo] c:\windows\system32\xnackby.exe r
O4 - HKCU\..\Run: [Hw08RRc9l] cdfoops.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [180ClientStubInstall] "C:\temp\stubinstaller6480.exe"
O4 - HKCU\..\Run: [ofzr] C:\PROGRA~1\COMMON~1\ofzr\ofzrm.exe
O4 - Global Startup: AOL 9.0 Tray Icon.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: AOL Broadband Check-Up.lnk = C:\Program Files\AOL\Broadband CheckUp\bin\matcli.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\JetCar.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\JetCar.exe
O9 - Extra button: Money Viewer - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.freeserve.co.uk
O15 - Trusted Zone: *.awmdabest.com (HKLM)
O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
O16 - DPF: {4A3CF76B-EC7A-405D-A67D-8DC6B52AB35B} (QDiagAOLCCUpdateObj Class) - http://aolcc.aolsvc.aol.co.uk/computercheckup/qdiagcc.cab
O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppD...sharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/gamc7-gb/gbc7/games4.cab
O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://D:\Resources\IntraLaunch.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab31267.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game18.zylomgames.com/activex/zylomgamesplayer.cab
O16 - DPF: {E154E3CC-0C3A-4101-91D8-6B4876F0FD64} (PrintScreen Class) - http://www.myemo.com/my_picture/Flash2Image.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D95F3B9B-9E93-43AA-A22E-A092CEDEA644}: NameServer = 205.188.146.145
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlul32.exe" /s (file missing)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thanks
thumbsup.gif
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 26 2005, 11:30 AM
Post #4


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


Your computer is in a very, very, bad state. In addition to a very bad About:Blank infection, there is an Aurora/Nail infection, different hijacks and your choice of trojans. There is also the EliteBar infection as well as a Qoologic infection. I have to start with the About:Blank infection and I will be trying to get rid of a lot of the junk at the same time. We both need luck.

You may not see too much change after removing all of this. I had to leave numerous bad infections behind
=============================================

Your system is infected with a variant of the About:Blank infection.
  1. First we must STOP, and Disable a bad Added Service
    • Click Start>Run and type in: services.msc
    • Click OK
    • In the Services window find: Remote Procedure Call (RPC) Helper
    • Select/highlight and right click the entry, and choose: Properties
    • On the General tab, under Service Status click the Stop button
    • Beside: Startup Type, in the drop menu, select: Disabled
    • Click Apply, then OK
    Now do the same above procedure with the following service: System Startup Service

  2. Download CWShredder
    Click check for updates. Do not use it yet.

  3. Download Aboutbuster 5
    Unzip the file to its own folder (C:\AB) Do not use it yet.

  4. Download: HomeSearchfix. Unzip it to your desktop. Do not use it yet.

  5. Download Killbox
    Choose save as to your desktop. Unzip the file. Do not use it yet.

    Take care: some files can be hidden, so first go to start > control panel > folder options > view (tab) > mark “show hidden files en extensions >OK

    Please print out these directions for in safe mode you will have to be disconnected from the internet. You should entirely disconnect (UNPLUG) from the internet!!!

  6. Reboot your system into safe mode for all OS

  7. Close all windows and open HijackThis.
    • Click "scan only” in the main window
    • Put a checkmark beside the following entries and click “FIX checked”.


      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\pduyp.dll/sp.html#28129
      R3 - Default URLSearchHook is missing
      F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
      O2 - BHO: (no name) - {4FD3C147-41DE-1F3D-33EC-2D9B34788A22} - C:\WINDOWS\system32\msvg32.dll
      O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MyWay\bar\1.bin\mwsoemon.exe
      O4 - HKLM\..\Run: [274.tmp] C:\DOCUME~1\#swede#\LOCALS~1\Temp\274.tmp.exe 1 28129
      O4 - HKLM\..\Run: [276.tmp] C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
      O4 - HKLM\..\Run: [276.tmp.exe] C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
      O4 - HKLM\..\Run: [sysuu.exe] C:\WINDOWS\sysuu.exe
      O4 - HKLM\..\Run: [PSof1] C:\WINDOWS\System32\PSof1.exe
      O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
      O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\System32\wintask.exe
      O4 - HKLM\..\Run: [VBouncer] C:\PROGRA~1\VBouncer\VirtualBouncer.exe
      O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
      O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\arqanr.exe reg_run
      O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
      O4 - HKLM\..\Run: [AutoUpdater] "C:\Program Files\AutoUpdate\AutoUpdate.exe"
      O4 - HKLM\..\Run: [richup] C:\WINDOWS\system32\richup.exe
      O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\exp
      O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
      O4 - HKLM\..\Run: [NaviSearch] C:\Program Files\NaviSearch\bin\nls.exe
      O4 - HKLM\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
      O4 - HKLM\..\Run: [vwowfo] c:\windows\system32\xnackby.exe r
      O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
      O4 - HKCU\..\Run: [180ClientStubInstall] "C:\temp\stubinstaller6480.exe"
      O15 - Trusted Zone: *.awmdabest.com (HKLM)
      O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)
      O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
      O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
      O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
      O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
      O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
      O16 - DPF: {43331111-1111-1111-1111-611111195622} - file://c:\ex.cab
      O16 - DPF: {64311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
      O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/gamc7-gb/gbc7/games4.cab
      O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://game18.zylomgames.com/activex/zylomgamesplayer.cab
      O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll
      O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlul32.exe" /s (file missing)
      O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
  8. Run CWShredder and choose FIX

  9. Start AboutBuster and press START, and then OK. The program will start scanning.

  10. Doubleclick HomeSearchfix.reg to merge the info to the registry. You will be prompted to accept the merge, answer YES.

  11. Start Killbox
    • Place a checkmark next to [x] Delete On Reboot.
    • Highlight the following list and Copy it (Ctrl+C) to the windows clipboard.

      C:\WINDOWS\system32\atlul32.exe
      c:\windows\system32\xnackby.exe
      C:\PROGRA~1\MyWay
      C:\WINDOWS\sysuu.exe
      C:\WINDOWS\system32\exp.exe
      C:\WINDOWS\System32\wintask.exe
      C:\PROGRA~1\VBouncer
      C:\WINDOWS\system32\arqanr.exe
      C:\WINDOWS\system32\recwizc.exe
      C:\Program Files\BullsEye Network
      C:\Program Files\NaviSearch
      C:\Program Files\Save
      C:\WINDOWS\system\sjkbj.exe
      C:\WINDOWS\system32\cdfoops.exe
      C:\WINDOWS\system32\pduyp.dll
      C:\WINDOWS\Nail.exe
      C:\WINDOWS\system32\msvg32.dll
      C:\DOCUME~1\#swede#\LOCALS~1\Temp\274.tmp.exe 1 28129
      C:\DOCUME~1\#swede#\LOCALS~1\Temp\276.tmp.exe 0 28129
      C:\WINDOWS\System32\PSof1.exe
      C:\WINDOWS\cfgmgr52.dll
      C:\windows\system32\elitekpz32.exe
      C:\Program Files\Media Access
      C:\Program Files\AutoUpdate
      C:\WINDOWS\system32\richup.exe
      C:\WINDOWS\system32\exp
      C:\Program Files\Cas
      C:\temp\stubinstaller6480.exe
      C:\WINDOWS\System32\vbsys2.dll
      C:\WINDOWS\svcproc.exe
    • Back in Killbox, go > file > paste from clipboard,
    • Click the red highlighted X button and click yes to the prompt when all the files have been pasted.
    • Then click OK
    • Exit Killbox and Reboot your PC.
  12. After the reboot, Start AboutBuster AGAIN and scan AGAIN.

  13. Clean temporary files:
    • Go > start > run and type cleanmgr and OK
    • Scan your system for files to remove.
    • Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
    • Click OK to remove those files.
    • Click Yes to confirm deletion.
  14. Reboot your system into normal mode.

  15. Download Ewido scan
    • Check for updates.
    • Let it do a full run.
    • Copy the log. Past it to a blank Notepad file and save it to post here.
  16. Finally, run HijackThis, click SCAN, produce a LOG and POST it and the EWIDOscan log in this thread for review.
Regards,

Trevuren
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 26 2005, 11:41 AM
Post #5


Member
**
Posts: 30
OS: XP
Currently I dont know how to unzip files
or how to reboot in safe mode

I opologise for my lack on knowledge

Bulaklak
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 26 2005, 11:42 AM
Post #6


Member
**
Posts: 30
OS: XP
Where is windows clip board confused1.gif
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 26 2005, 12:07 PM
Post #7


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


1.

Please print out or copy this page to Notepad. It should make my instructions a bit easier to follow

Everything is fine. I'll walk you through this. When you downloaded CWShredder from the site that I indicated, it downloaded in the form of an executable file or a file with an .exe extension. With these files, you just click on them and they run. OK?

There are other ways of sending files and one of them is called in ZIP format. This is a file compression format. This system is used for many reasons none of which I will get into now. But to open this type of file you need a special program. Many exist on the market but one of the most popular is called WinZip.

Here is the link to obtain a trial version of this program: WinZip Evaluation

WinZip is downloaded as an executable file so you just have to click on it to start the installation process. Install it to the recommended folder (Usually C:\Program Files\System Security Suite) and make sure that you have a link to it on your desktop so you can easily find it again.

Now you should be able to open 3sss by double-clicking the 3sss zip folder. If a screen appears asking you what program you want to use to open 3sss or associate with this type of file, scroll down the list and you should find and choose WinZIp. If it isn't on the list, click on the Browsw button and find the files C:\Program Files\WinZip\winzip.exe

Now for our last problem. When you click on winhelp2002 and then you click on install, don't expect to see anything. It all happens in the background.

There, I hope I was able to make this a bit clearer for you.


2. How to use the F8 method to Start Your Computer in Safe Mode
    *Restart the computer.
    *as soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
    *Use the arrow keys to select the Safe mode menu item
    *press Enter.
3. The clipboard is like a hidden filing cabinet in your computer. In computer language, this filing cabinet is in "memory" so when you highlight something and right click and choose "Copy", everything you had highllighteded goes into memoye for later use.


Trevuren
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 28 2005, 08:15 AM
Post #8


Member
**
Posts: 30
OS: XP
I downloaded Winzip

And I think the programmes are now unzipped (guessing by the change if icon).

However when i tried to open Killbox for example,
The following message appeared:
This file has a potentially unsafe file of .EXE
KillBox.exe
Would you still like to open it?

confused1.gif

You said:
How to use the f8 method to start you cmputer in safe mode
*as soon as BIOS is loaded begin tapping the f8 key ...

What is BIOS?

Again sorry

Bulaklak
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 28 2005, 08:50 AM
Post #9


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


1. Open the file.

2. Here is another way to go into safe mode and you reverse the process to get back into Normal Mode. I guess you had better print it out so you can have it handy as we change from one to the other quite frequently.

How To Start To Safe Mode Using The System Configuration Utility Method in Windows 98/98SE/ME

*Close all open programs.
*Click Star > Run when the Run dialog box appears type 'msconfig' (without the quotes)
*click OK.
*the System Configuration Utility opens
*click "Advanced."
*put a check mark beside 'Enable Startup Menu'
*Click OK, then click OK again
*restart the computer when prompted
*The computer will restart in Safe mode.
*When you are finished troubleshooting repeat steps 1-5
*in step 6, uncheck "Enable Start-up Menu."
*Close all programs
*restart the computer


Trevuren
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 28 2005, 08:53 AM
Post #10


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


Some of these fixes can become quite complicated. If you find this too intimidating or frustrating, you may want to ask a friend to assisst you with these procedures.

Just a thought.

Regards,

Trevuren
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 28 2005, 08:56 AM
Post #11


Member
**
Posts: 30
OS: XP
I have windows XP

Bulaklak
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 28 2005, 09:52 AM
Post #12


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


Sorry about that my friend, my eyes must have strayed biggrin.gif

To use the System Configuration Utility to start Windows XP in Safe mode
  1. Close all open programs.
  2. Click Start > Run.
  3. In the Run dialog box, type msconfig and then click OK.
  4. In the System Configuration Utility, on the BOOT.INI tab, check /SAFEBOOT.
  5. Click OK.
  6. When you are asked to restart the computer, click Restart
  7. The computer restarts in Safe mode. (This can take several minutes.)
When you are finished working in Safe mode, use the System Configuration Utility to start Windows XP in normal mode.

To use the System Configuration Utility to start Windows XP in normal mode
  1. Finish what you need to do in Safe mode.
  2. In the section "To use the System Configuration Utility to start Windows XP" above, repeat steps 1-3 (inclusively).
  3. But in step 4, uncheck /SAFEBOOT.
  4. Close all programs, and restart the computer.
Trevuren
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 28 2005, 10:32 AM
Post #13


Member
**
Posts: 30
OS: XP
Thanks

biggrin.gif

Did you read about the Killbox message
Go to the top of the page
 
+Quote Post
Trevuren
post Jul 28 2005, 11:14 AM
Post #14


Member 5k
Group Icon
Posts: 18,694
From: Ottawa
OS: Windows 7 Ultimate 32-bit/ Windows 7 Home Premium 64-bit
MVP


Yes and I answered in the same reply in which I gave you the procedures for the wrong version of Windows.

I know the source of the programs. I said that you should open it. If you get a "corrupt" message, it is probably because your download or opening of the zip did not go smoothly.


Trevuren
Go to the top of the page
 
+Quote Post
bulaklak_01
post Jul 28 2005, 02:08 PM
Post #15


Member
**
Posts: 30
OS: XP
Thanks again,

Bulaklak

smile.gif
Go to the top of the page
 
+Quote Post
 

4 Pages V   1 2 3 > » 
Closed TopicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 

Collapse

> Similar Topics

    Topic Title Replies / Views Topic Information
No New Posts   4 / 1,023 18th August 2005 - 06:54 AM
tiggre007 started - last by therock247uk
No New Posts 2 / 27,145 5th September 2005 - 06:56 AM
talon0775 started - last by Buckeye_Sam
No New Posts   2 / 2,344 28th June 2007 - 11:41 PM
litodreamerboi4u started - last by RiP
No new   30 / 1,359 22nd June 2009 - 04:56 PM
alicat1969 started - last by kahdah

RSS Time is now: 7th November 2009 - 10:01 PM

Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks mentioned on this page are the property of their respective owners.

© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy | Advertising
Powered By IP.Board © 2009  IPS, Inc.