Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

trojanhorse startpage 19.an and j [RESOLVED]


  • This topic is locked This topic is locked

#31
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
Hi

God am i having problems with things this end. now the cd rw disk that i have been using will not read on this computer. It contains all my back up files from my old computer and it has been working. before when i inserted the disk, it would scan it and go through the list then a box would come up saying that the disk contains mixed files how do i want to open it. now it does not say that it comes up with a box and i click on it to open files with explorer. then it shows nothing. Today i have tried it again and it came up that i got to download something from windows 95. Screams what is going on. How can one day it works and serveral times may i add then yesterday it starts going wrong. Surley my new computer is not up the creak already.

So what i had to do is use another disk and put the hijack log on and it worked not coming up like it did before but at least it opened it.

So here is the hijack log for the old computer.......

Logfile of HijackThis v1.99.1
Scan saved at 23:47:20, on 22/07/05
Platform: Windows 98 SE (Win9x 4.10.2222A)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MDM.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\STARTER.EXE
C:\WINDOWS\TASKMON.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\INTERNAT.EXE
C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\WINMX\WINMX.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by BT Openworld
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [EnsoniqMixer] starter.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [internat.exe] internat.exe
O4 - HKLM\..\Run: [Welcome] C:\WINDOWS\Welcome.exe /R
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [Machine Debug Manager] C:\WINDOWS\SYSTEM\MDM.EXE
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRAM FILES\MSN MESSENGER\MSNMSGR.EXE" /background
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsec...scan/axscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...ebscan_ansi.cab

thanks again she says after screaming :tazz:
  • 0

Advertisements


#32
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Hi Shell, let's try a diagnostic startup to see if you are able to boot into normal mode that way.

Go to Start > Run - type:

msconfig

Click OK.

Under the general tab select "Diagnostic startup" Click Apply, Click OK. Restart your computer and see if you are able to boot into windows normally.
  • 0

#33
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
hi bet you are all getting fed up with me. Right i have done that test before and that is how it got into safe mode. now i have just done it again and im not really sure if its in safe mode or not. it does not say safe mode up top (but then it did not say that before i did the thing u asked) but the picture on the front screen is all pixel like it would be if in safe mode and the fonts and pointer are larger like they would be. as its not connected to the internet i cant tell if i can do anything on it.

What it does do is this comes up with the screen giving me all options so choose normal mode then it comes up with a black screen and this is displayed well something like this as cant write it all down as its quick

Set path c:= Windows:/system WREM/ Windowsc/ windows comand c
C>

thanks for all your time and effort if you really think i should give this up as a lost cause i will.

Shell
  • 0

#34
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Ok, let's try a selective startup to see if you are able to boot into normal mode that way.

Go to Start > Run - type:

msconfig

Click OK.

Under the general tab select "Selective startup" then uncheck everything EXCEPT system.ini - leave that one checked. Click apply, click ok and reboot...

If you are still unable to boot normally, go back into msconfig, uncheck system.ini and put a check next to win.ini only. I believe there are 4 options, do each one at a time to see if you are able to boot normally to see if we can figure out where the problem is. Let me know if you're able to boot normally at all like this and with which option(s). Do NOT uncheck everything.
  • 0

#35
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
Wow i think i might be just begining to wipe the sweat off my brow cos think we are getting somewhere. right here are the results

system.ini = loaded straight away but display picture is alittle pixel but think that just something else as it also looks like some pictures as if u spilt water on painting and they smudge. icons are small it looked fine of course at the moment i can not connect to the internet so cant test if that is ok. but i think this must be normal mode, but stil with problems with graphics.

Just one thing when i went back into misconfig and selective startup, although i had only ticked one box there was two boxes ticked which was load up group items.

win..ini no list of start up ie normal safe mode came up started straight away but the picture and fonts looked like they were in safe mode, as screen was very pixel.

Autoexec. bat file this cam up with the failure i was getting before set path c=windows:/system wrem/windowsc/windows command c
c> again looked like in safe mode but not stating so

load start up groups items same as (win.ini although forgot to mention that it asked for password for the 3 last ones )

So hopefully this might help

Thanks shell :tazz:
  • 0

#36
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Hi Shell, I didn't forget about you, I just needed to talk to the techs about this because they know about this better than I do! :tazz:

Ok, please reboot into Safe Mode
Right-Click Start and go to explore
go to C:\
Right-click autoexec.bat and select rename
Rename it to autoexec.txt
Then right-click autoexec.txt and go to "send to > floppy [A:]" (you will need a floppy disk in the a: drive)

Then, please open Notepad. Leave the notepad blank
Go up to "File > Save As" then click the drop-down to change the "Save As Type" to "All Files". Save it as autoexec.bat on your C:\

Then reboot your computer. Let me know how it goes also please post the contents of autoexec.txt that you saved to the floppy.
  • 0

#37
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
ok thanks so much i will go and try this. so do u think we are nearly there. I dont think the bit with the front screen is the prob as i think its just pic they have put on there.

i have set up a wireless router and got my computer (new one) my daughters on working. I take it, it is not advisable to install the network card in the computer with the problems. or will it not make a difference. i guess the only good thing it will tell us that it is all up and running ok cos at the moment it seems to be working fine, i can access all programs and everything seems fine but of course there are prob still lots of things i cant see.

Ok just going off to try this, at this rate i will be building my own pc by the end of the week ha ha... quite proud of myself that i got it up and running with wireless router with no probs.. now just gotta see if i can get my old stuff of (pain comp to my new one via the wireless just gotta work that one out ahhhhhhh laffs

thanks again
shell
  • 0

#38
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
hi im back

Well i did as you said but there was not file saying Autoexec.bat there was one saying autoexec so did it to that i hope i did right. once i renamed the file like you said in C:. this is the report it said on the floppy im typing it as its only little and was not worth putting on cd:

ECHO OFF

*** DO NOT EDIT THIS FILE***

rem this file was created by system configuaration utility as a place holder
rem for your AUTOEXEC.BAT file. Your actual AUTOEXEC.BAT file has been
rem saved under the name AUTOEXEC.TSH
rem
rem
rem
rem

When i went into change and rename there was a file called AUTOEXEC.TSH should it have been that one i renamed. if so shall i do it again, also what about the changes i did to the other one.

Thanks
Shell :tazz:

Edited by shell38, 25 July 2005 - 02:36 PM.

  • 0

#39
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Please locate AUTOEXEC.TSH
Right-click on it and select "Open" it should pull up a box asking what you want to open it with, Please choose Notepad, but make sure it is NOT set to always open with this program.

Copy the entire contents of that notepad, then close it.

Go to start > programs > accessories > notepad Then paste the contents you copied into a new text file. Save it is autoexec.txt onto a floppy. Post the contents.
  • 0

#40
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
hi do i do this in safe or normal mode thanks
  • 0

Advertisements


#41
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
So, you can get into normal mode now?

Just do it in normal mode.

Also, what exactly are the problems you're having now?? Last I heard you could only get into safe mode and were receiving the error message.
  • 0

#42
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
hi

well think i have been able to get into normal mode for the last day or so no error coming up now since u told me to only click on one of them 4 options. when i typed misconfig in. is it ok to just leave it as one option or should more be ticked. shall i still do that autoexe.bat like you said in normal mode.

Then shall i install my network card and try and connect up to the internet to see if all is working fine.

Thanks
Shell
  • 0

#43
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Don't do anything with autoexec.bat! I need you to do this:

Please locate AUTOEXEC.TSH
Right-click on it and select "Open" it should pull up a box asking what you want to open it with, Please choose Notepad, but make sure it is NOT set to always open with this program.

Copy the entire contents of that notepad, then close it.

Go to start > programs > accessories > notepad Then paste the contents you copied into a new text file. Save it is autoexec.txt onto a floppy. Post the contents.
  • 0

#44
shell38

shell38

    Member

  • Topic Starter
  • Member
  • PipPipPip
  • 119 posts
hi

Well i did what u asked but there was not alot to copy dont no if that was a good thing or bad. what i did notice was it was almost the same as the error i was getting when i started up (im not getting that error now though it loads ok)
This is what is said.

SET PATH=C: \WINDOWS\SYSTEM\WBEM; %PATH%

That was all it said.
Hope i have done it right

Many thanks once again.

Just one thing can i ask do u think it is ok for me to install the network card on this pc or should i leave it for now. thanks
  • 0

#45
Michelle

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Shell,
Before you install the network card, please go into msconfig and click to enable "Normal Startup", then reboot your computer. Let me know if you receive any error messages or have any other problems.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP