[Michelle]

Ok, I think I confused you with my previous post, When I said I wanted you to run the Hoster program in safe mode, I didn't need the Silent Runners log again. I just needed you to restore original host files. You did this in safe mode without a problem, yes? I wasn't sure if you had run the Hoster program since you were showing me the Silent Runner's log which is a whole different thing.

Michelle

[Advertisements]

Michelle,

Yes, while in safe mode I ran the hoster program and clicked the restore original hosts and it said your changes have been made. Then I ran the log.

The General

[The General]

Michelle,

Yes, while in safe mode I ran the hoster program and clicked the restore original hosts and it said your changes have been made. Then I ran the log.

The General

[Michelle]

OK, let's try this first:

Boot into Safe Mode again.
Use Windows Explorer and navigate to C:\Program files and look for the folder below (in bold):

C:\Program Files\PPC Advertor

If it is there, DELETE it!

If you can't find this folder I have a couple of other things to try to get rid of this thing!

Michelle

[Michelle]

Oh, by the way, when you open Internet Explorer is your browser hijacked (redirected) to "about:blank" or some strange website address? Or does your set homepage load normally?

Michelle

[The General]

Michelle,

I ran the requested search in safe mode and couldn't find the file you spoke of. I even ran a search for it just to be sure, but nothing was there. My internet explorer runs fine. It opens to the normal homepage.


The General

[Michelle]

Did you go into Windows Explorer and manually look for the folder? If the folder is hidden it won't show up in search (unless it's set up that way).

Ok, let's try this now:

Boot into safe mode.

Go to Start > Run > then type in:

sfc /scannow

**make sure that space is in there between sfc and /

Click OK.

It will pull up a box that says "windows file protection" just let it do what it does

We'll see how this works! Let me know

Michelle

[The General]

All right, I went to safe mode and ran the scannow and I made sure the space was there. When I hit enter there was a flash and nothing happened. I waited awhile just be sure, but nothing happened. No dialog box or anything besides the screen flash.

The General

[Michelle]

Ah, it was worth a shot! Apparently, sfc command can not be run in safe mode!

Please follow the directions given by Kc. Just doubleclick on the ones that say "error" (there will also be some that say information and warning) and tell us what it says in the dialogue box that it pulls up.

After this, we are going to repair Internet Explorer to see if that helps any!

Michelle

[The General]

Ok here is what I saw when I went into the event viewer. There were several errors from all the attempts I had at trying to figure out the problem.

The errors always came in pairs like I mentioned and the first is;
faulting application explorer.exe. version 6.0.2900.2180. fauliting module shell32dll, version 6.0.2900.2578, fault address 0x00054581.

The second error is;
faulting application drwtson32.exe.version 5.1.2600.0, faulting module dbghekp.dlllversion 5.12600.2180, fault address 0x0001295d

There were several other error logs from early march about could not contact filter driver, naifiltr.sys. is missing, about haning application errors with iexplorer and fauliting application erros about mmjb.

I don't know what I am looking at or what you need to know. Give me further advice on what to do and we can take it from there.

The General

[The General]

Michelle,
I have made an error and I think it may have cost you some time and confusion. I only realized this once I ran the event log viewer in my last post and had an epiphany. When I arrow over all programs from the start menu and the computer freezes and I get the error log it is encountering an error with windows explorer and not with internet explorer as previously stated. I guess when I read it quickly all I saw was explorer and thought internet explorer only and not windows explorer. I am sooooo sorry about this and I hope that we haven't been on a wild goose chase.

Let me know what to do from here.
Thanks again,
The General

[Michelle]

No worries, General! I know it was explorer that was freezing up. I suggested we repair Internet Explorer because we are running out of options and this could either help or not, either way it won't do anything bad.

Go back into the event viewer and look at the error messages that say "faulting drwtson32.exe" and tell me the faulting modules on them or are they all the same: dbghekp.dll (this is spelled correctly?) and tell me any other "faulting modules" on the errors that have come up recently due to this infection.

Michelle

[Michelle]

Ok, General, now we know who the bad guy is (finally some progress! You're probably tired of me after 2 weeks of running programs ) Here is what I need you to do:

Please locate the file (that was on the error message - defaulting module): dbghekp.dlll then zip it up. You can zip it up by right clicking on the file, then going to Send To > Compressed (zipped) folder. E-mail the zipped folder to: Spyware Submissions

As soon as we review what that file does, I will have a fix for you.

Michelle