Edited by Grooblle, 28 February 2006 - 05:05 PM.
Popups + Explorer freezing all the time!
Started by
Grooblle
, Jun 07 2005 08:18 AM
#1
Posted 07 June 2005 - 08:18 AM
#2
Posted 07 June 2005 - 01:29 PM
Please read these instructions carefully and print them out! Be sure to follow ALL instructions!
Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found:
Security IGuard
Virtual Maid
Search Maid
Exit Add/Remove Programs.
*Click here and download Killbox by Option^Explicit.
*Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
*In the killbox program, select the Delete on Reboot option.
*Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\wp.exe
C:\wp.bmp
C:\bsw.exe
C:\WINDOWS\sites.ini
C:\WINDOWS\popuper.exe
C:\WINDOWS\system32\hhk.dll
C:\WINDOWS\System32\helper.exe
C:\WINDOWS\System32\intmonp.exe
C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\System32\ole32vbs.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\System32\shnlog.exe
C:\WINDOWS\System32\intmon.exe
C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\system32\hp60FC.tmp
C:\WINDOWS\system32\hookdump.exe
C:\WINDOWS\screen.html
*Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
While your computer is restarting, tap the F8 key continually until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.
*IMPORTANT* Be sure you know how to VIEW HIDDEN FILES
Using Windows Explorer, delete the following (please do NOT try to find them by "search" because they will not show up that way)
FOLDERS to delete (in bold) if found:
C:\Program Files\Search Maid
C:\Program Files\Virtual Maid
C:\Windows\System32\Log Files
C:\Program Files\Security IGuard
C:\Program Files\AntiVirusGold
Reboot into normal mode.
A registry file to undo most of the changes is available here:
http://metallica.gee...m/smitfraud.reg
Doubleclick that file and confirm you want to merge it with the registry.
Then run HijackThis and check the following items. (some may already be gone)
Close all windows except HijackThis and click Fix checked:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.updatesearches.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.updatesea...earch.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.updatesearches.com/
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp60FC.tmp
O3 - Toolbar: WordReferenceEnFr - {5776A2BC-D803-47F6-9DC0-8344DB8D604C} - C:\Program\WordReferenceEnFr\wordreferenceEnFr.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\system32\msmsgs.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
1.) Download the Hoster from HERE Press "Restore Original Hosts" and press "OK". Exit Program.
2.) Download: http://www.mvps.org/.../DelDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.
3.) Download, install, and run CleanUp!
Post a new HijackThis log when you are done.
Do you have any idea where this belongs to or came from:
O20 - Winlogon Notify: style2 - C:\WINDOWS\q40102234_disk.dll
Regards,
Go to Start > Control Panel > Add or Remove Programs and remove the following programs, if found:
Security IGuard
Virtual Maid
Search Maid
Exit Add/Remove Programs.
*Click here and download Killbox by Option^Explicit.
*Extract the program to your desktop and double-click on its folder, then double-click on Killbox.exe to start the program.
*In the killbox program, select the Delete on Reboot option.
*Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\wp.exe
C:\wp.bmp
C:\bsw.exe
C:\WINDOWS\sites.ini
C:\WINDOWS\popuper.exe
C:\WINDOWS\system32\hhk.dll
C:\WINDOWS\System32\helper.exe
C:\WINDOWS\System32\intmonp.exe
C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\System32\ole32vbs.exe
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\System32\shnlog.exe
C:\WINDOWS\System32\intmon.exe
C:\WINDOWS\System32\msmsgs.exe
C:\WINDOWS\system32\hp60FC.tmp
C:\WINDOWS\system32\hookdump.exe
C:\WINDOWS\screen.html
*Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
While your computer is restarting, tap the F8 key continually until a menu appears. Use your up arrow key to highlight Safe Mode, then hit enter.
*IMPORTANT* Be sure you know how to VIEW HIDDEN FILES
Using Windows Explorer, delete the following (please do NOT try to find them by "search" because they will not show up that way)
FOLDERS to delete (in bold) if found:
C:\Program Files\Search Maid
C:\Program Files\Virtual Maid
C:\Windows\System32\Log Files
C:\Program Files\Security IGuard
C:\Program Files\AntiVirusGold
Reboot into normal mode.
A registry file to undo most of the changes is available here:
http://metallica.gee...m/smitfraud.reg
Doubleclick that file and confirm you want to merge it with the registry.
Then run HijackThis and check the following items. (some may already be gone)
Close all windows except HijackThis and click Fix checked:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.updatesearches.com/bar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.updatesea...earch.php?qq=%1
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.updatesea...earch.php?qq=%1
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.updatesearches.com/
F2 - REG:system.ini: Shell=explorer.exe, msmsgs.exe
O2 - BHO: VMHomepage Class - {FFFFFFFF-FFFF-FFFF-FFFF-FFFFFFFFFFFA} - C:\WINDOWS\system32\hp60FC.tmp
O3 - Toolbar: WordReferenceEnFr - {5776A2BC-D803-47F6-9DC0-8344DB8D604C} - C:\Program\WordReferenceEnFr\wordreferenceEnFr.dll (file missing)
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Program\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [RegSvr32] C:\WINDOWS\system32\msmsgs.exe
O4 - HKCU\..\Run: [Intel system tool] C:\WINDOWS\system32\hookdump.exe
1.) Download the Hoster from HERE Press "Restore Original Hosts" and press "OK". Exit Program.
2.) Download: http://www.mvps.org/.../DelDomains.inf
To use: right-click and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.
3.) Download, install, and run CleanUp!
Post a new HijackThis log when you are done.
Do you have any idea where this belongs to or came from:
O20 - Winlogon Notify: style2 - C:\WINDOWS\q40102234_disk.dll
Regards,
#3
Posted 07 June 2005 - 02:15 PM
...
Edited by Grooblle, 28 February 2006 - 05:06 PM.
#4
Posted 08 June 2005 - 12:28 AM
Can you go to this board:
http://www.thespykil...x.php?topic=5.0
and follow the instructions there to upload:
C:\WINDOWS\q40102234_disk.dll
It's in a very crucial place to remove for the wrong reasons.
I'd like to have a look before we make an attempt.
Regards,
http://www.thespykil...x.php?topic=5.0
and follow the instructions there to upload:
C:\WINDOWS\q40102234_disk.dll
It's in a very crucial place to remove for the wrong reasons.
I'd like to have a look before we make an attempt.
Regards,
#5
Posted 08 June 2005 - 01:56 AM
...
Edited by Grooblle, 28 February 2006 - 05:07 PM.
#6
Posted 08 June 2005 - 04:31 AM
Good. That doesn't look very friendly or necessary.
*In the killbox program, select the Replace on Reboot option and put a checkmark in the Use Dummy box
*Copy the file name below to the Full Path to File to Delete box:
C:\WINDOWS\q40102234_disk.dll
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
After the reboot check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:
O20 - Winlogon Notify: style2 - C:\WINDOWS\q40102234_disk.dll
Also see if you can find c:\sample.exe
If so, upload that file at TheSpykiller in the same thread.
Regards,
*In the killbox program, select the Replace on Reboot option and put a checkmark in the Use Dummy box
*Copy the file name below to the Full Path to File to Delete box:
C:\WINDOWS\q40102234_disk.dll
*Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
After the reboot check the items listed below in HijackThis, close all windows except HijackThis and click Fix checked:
O20 - Winlogon Notify: style2 - C:\WINDOWS\q40102234_disk.dll
Also see if you can find c:\sample.exe
If so, upload that file at TheSpykiller in the same thread.
Regards,
#7
Posted 08 June 2005 - 10:04 AM
...
Edited by Grooblle, 28 February 2006 - 05:07 PM.
Similar Topics
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users