[Excal]

Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme.reg (make sure that Save as Type is set at "All Files") on your Desktop. Ensure there is no space at above REGEDIT 4.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\MODULEUSAGE\C:/WINDOWS/DOWNLOADED PROGRAM FILES/M67M.OCX]

[-HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_WINTOOLSSVC]

[-HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TOPSEARCH.TSLINK]

[-HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\TPUSN]

[-HKEY_CLASSES_ROOT\CLSID\{66FC8717-EFA7-4546-8C4A-E224F3A80C76}]

[-HKEY_CLASSES_ROOT\CLSID\{D52433A9-A44C-43AB-A013-24B3C756DD2B}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\APPID\NHELPER.DLL]

[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP MANAGEMENT\ARPCACHE\INTERNET OPTIMIZER]

[-HKEY_CLASSES_ROOT\TypeLib\{EDD3B3E9-3FFD-4836-A6DE-D4A9C473A971}]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\extensions\CmdMapping\{6685509E-B47B-4f47-8E16-9A5F3A62F683}]

[-HKEY_CLASSES_ROOT\Interface\{48E59292-9880-11CF-9754-00AA00C00908}]

Locate fixme.reg on your Desktop and double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer "Yes" and wait for a message to appear similar to "Merged Successfully".

1) Please download the Killbox.


2) Please remove the following folders using Windows Explorer (if present):

C:\PROGRAM FILES\CashBack
C:\PROGRAM FILES\eZula
C:\PROGRAM FILES\COMMON FILES\GMT
C:\WINDOWS\SYSTEM32\vmss
C:\WINDOWS\SYSTEM32\P2P Networking
C:\WINDOWS\bsx32
C:\PROGRAM FILES\E2G
C:\PROGRAM FILES\KAZAA
C:\DOCUMENTS AND SETTINGS\SIMBA\FAVORITES\WeirdOnTheWeb.ur



3) Please run Killbox.

• Select "Delete on Reboot".
• Copy the file names below to the clipboard by highlighting them and pressing Control-C:
  
  C:\DOCUMENTS AND SETTINGS\SIMBA\APPLICATION DATA\tvmknwrd.dll
  C:\DOCUMENTS AND SETTINGS\SIMBA\APPLICATION DATA\Sskknwrd.dll
  C:\WINDOWS\SYSTEM32\winupdt.bin
  C:\WINDOWS\SYSTEM32\mqexdlm.srg
  C:\WINDOWS\SYSTEM32\im64.dll
  C:\WINDOWS\SYSTEM32\q17i9a4j.ini
  C:\WINDOWS\SYSTEM32\ap2nqrd4.dat
  C:\WINDOWS\SYSTEM32\ritsacnk.dat
  C:\WINDOWS\SYSTEM32\setup_incred_7.exe
  C:\WINDOWS\SYSTEM32\WebRebates_Auto_InstallSilent.exe
  C:\WINDOWS\SYSTEM32\auto_update_uninstall.log
  C:\WINDOWS\system32\msnapl.dll
  C:\WINDOWS\system32\mshpeb.dll
  C:\WINDOWS\system32\qqpyu.dat
  C:\WINDOWS\system32\mscif.exe
  C:\WINDOWS\system32\mqexdlm.srg
  C:\WINDOWS\system32\msglji.gif
  C:\WINDOWS\system32\mac80ex.idf[msbe.dll]
  C:\WINDOWS\system32\mac80ex.idf[Uninstall.exe]
  C:\WINDOWS\system32\mac80ex.idf[adv.exe]
  C:\WINDOWS\system32\mac80ex.idf[adx.exe]
  C:\WINDOWS\system32\mseggo.gif
  C:\WINDOWS\system32\msfdje.gif
  C:\WINDOWS\system32\SplWbr.dll
  C:\WINDOWS\system32\msfaol.dll
  C:\WINDOWS\system32\msiaih.dll
  C:\WINDOWS\system32\setup_incred_7.exe
  C:\WINDOWS\system32\P2P Networking v126.cpl
  C:\WINDOWS\inf\ceres.inf
  C:\WINDOWS\inf\farmmext.inf
  C:\WINDOWS\inf\alchem.inf
  C:\WINDOWS\inf\banner.inf
  C:\WINDOWS\smdat32a.sys
  C:\WINDOWS\dhdom1.bin
  C:\WINDOWS\usta33.ini
  C:\WINDOWS\unstall.exe
  C:\WINDOWS\Downloaded Program Files\m67m.inf
  C:\WINDOWS\Downloaded Program Files\ClientAX.inf
  C:\WINDOWS\Downloaded Program Files\clientax.dll
  C:\WINDOWS\Downloaded Program Files\xmlparse_.dll
  C:\WINDOWS\Downloaded Program Files\xmltok_.dll
  C:\WINDOWS\Downloaded Program Files\setup.inf
  
  
  
• Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
• Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
  
  If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..
  
• Let the system reboot.

Please post back and tell me how your computer is running.


Thanks,



Excal

Edited by Excal, 19 July 2005 - 08:52 AM.

[Advertisements]

oh crap, I JUST realized that I posted the wrong ewido log, I posted one from yesterday afternoon, but I ran ewido this morming. The logs I posted of Hijack and Activescan are both current though. I'll post the most current Ewido log below. I'll hold off on your latest instructions until I hear back from you. Sorry for the mistake and thanks for being patient.
====================================

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:06:50 AM, 7/19/2005
+ Report-Checksum: EF38B729

+ Scan result:

:mozilla.9:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.10:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.11:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.12:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.13:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.14:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.19:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.23:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.24:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.30:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.31:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.32:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.40:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.43:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.44:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.45:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.46:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.51:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.59:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.60:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.61:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup


::Report End

[compuder]

oh crap, I JUST realized that I posted the wrong ewido log, I posted one from yesterday afternoon, but I ran ewido this morming. The logs I posted of Hijack and Activescan are both current though. I'll post the most current Ewido log below. I'll hold off on your latest instructions until I hear back from you. Sorry for the mistake and thanks for being patient.
====================================

---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 8:06:50 AM, 7/19/2005
+ Report-Checksum: EF38B729

+ Scan result:

:mozilla.9:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.10:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.11:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.12:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.13:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.14:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
:mozilla.19:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.23:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.24:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Centrport : Cleaned with backup
:mozilla.30:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.31:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Qksrv : Cleaned with backup
:mozilla.32:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
:mozilla.40:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.42:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.43:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.44:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Sextracker : Cleaned with backup
:mozilla.45:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.46:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
:mozilla.51:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.53:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.54:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
:mozilla.58:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
:mozilla.59:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.60:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup
:mozilla.61:C:\Documents and Settings\simba\Application Data\Mozilla\Profiles\default\oxq4cqu3.slt\cookies.txt -> Spyware.Cookie.Pointroll : Cleaned with backup


::Report End

[Excal]

Ewido cleaned all of its files

You can go ahead with the previous instructions...thanks.



Excal

[compuder]

Alright, I did the fixme.reg & removed all the folders in windows explorer fine. Then I used Killbox, the first time it let me Ctrl-C and paste from clipboard. Then clicked YES at Delete at Reboot prompt, then I clicked NO at the Reboot Now prompt. I manually rebooted, not sure if Killbox worked. Now I try to run killbox again, it WONT let me paste from clipboard, even though I copied it to clipboard. The box is just blank when I choose Paste from Clipboard.

So I just manually search for random files. Some are gone, but some are still there such as: C:\WINDOWS\system32\mac80ex.idf

"C:\WINDOWS\inf\farmmext.inf" is gone, but "...\inf.farmmext.PNF" is there.

Not sure if Killbox ran correctly or not. I can't copy/paste from clipboard in killbox now. I dont remember getting a pending operations prompt either.

[Excal]

Thats ok.

Run Active Scan again and we will see if it worked.

also

start>mycomputer>Local Disk C:>windows>prefetch folder. Delete all the contents out of the prefetch folder but do not delete the folder.

Post back with the results.

Thanks,



Excal

[compuder]

Here's the activeScan I just did:
=================================

Incident Status Location

Spyware:spyware/tvmedia No disinfected C:\DOCUMENTS AND SETTINGS\SIMBA\APPLICATION DATA\tvmcwrd.dll
Spyware:spyware/surfsidekick No disinfected C:\DOCUMENTS AND SETTINGS\SIMBA\APPLICATION DATA\Sskcwrd.dll
Adware:adware/portalscan No disinfected C:\WINDOWS\SYSTEM32\winupdt.008
Adware:adware/savenow No disinfected C:\WINDOWS\SYSTEM32\baur5s9q.dat
Adware:adware/sahagent No disinfected C:\WINDOWS\SYSTEM32\bqrufs5f.dat
Spyware:spyware/bargainbuddy No disinfected C:\WINDOWS\SYSTEM32\vx1.nls
Adware:adware/keenvalue No disinfected C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
Adware:adware/transponder No disinfected C:\WINDOWS\INF\dlmax.inf
Adware:adware/twain-tech No disinfected C:\WINDOWS\smdat32m.sys
Adware:adware/dealhelper No disinfected C:\WINDOWS\dhdomp1.bin
Adware:adware/ipinsight No disinfected C:\WINDOWS\alchem.ini
Adware:adware/ncase No disinfected C:\WINDOWS\180ax.log
Adware:adware/weirdontheweb No disinfected C:\PROGRAM FILES\WeirdOnTheWeb
Adware:adware/ezula No disinfected C:\PROGRAM FILES\Web Offer
Spyware:spyware/altnet No disinfected C:\PROGRAM FILES\Altnet
Adware:adware/gator No disinfected C:\PROGRAM FILES\COMMON FILES\CMEII
Adware:adware/delfinmedia No disinfected C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\picsvr
Adware:adware/p2pnetworking No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\P2P NETWORKING
Adware:adware/wintools No disinfected HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_WINTOOLSSVC
Spyware:spyware/betterinet No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DLMAXDLL.DLMAXDLLOBJ.1
Adware:adware/wupd No disinfected HKEY_LOCAL_MACHINE\SOFTWARE\WINDUPDATES
Spyware:spyware/media-motor No disinfected HKEY_CLASSES_ROOT\CLSID\{7149E79C-DC19-4C5E-A53C-A54DDF75EEE9}
Adware:adware/topmoxie No disinfected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\extensions\CmdMapping\{6685509E-B47B-4f47-8E16-9A5F3A62F683}
Adware:adware/myway No disinfected HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\system32\mac80ex.idf[msbe.dll]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\system32\mac80ex.idf[Uninstall.exe]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\system32\mac80ex.idf[adv.exe]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\system32\mac80ex.idf[adx.exe]
Adware:Adware/KeenValue No disinfected C:\WINDOWS\browserxtras\pn\remove.exe

[Excal]

Launch Notepad, and copy/paste the box below into a new text file. Save it as fixme.reg (make sure that Save as Type is set at "All Files") on your Desktop. Ensure there is no space at above REGEDIT 4.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\P2P NETWORKING]

[-HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\ENUM\ROOT\LEGACY_WINTOOLSSVC]

[-HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\DLMAXDLL.DLMAXDLLOBJ.1]

[-HKEY_LOCAL_MACHINE\SOFTWARE\WINDUPDATES]

[-HKEY_CLASSES_ROOT\CLSID\{7149E79C-DC19-4C5E-A53C-A54DDF75EEE9}]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\extensions\CmdMapping\{6685509E-B47B-4f47-8E16-9A5F3A62F683}]

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC}]

Locate fixme.reg on your Desktop and double-click on it. You will receive a prompt similar to: "Do you wish to merge the information into the registry?". Answer "Yes" and wait for a message to appear similar to "Merged Successfully".



Just a few random bad files and folders to clean up.

Please remove the following folders using Windows Explorer (if present):

C:\PROGRAM FILES\WeirdOnTheWeb
C:\PROGRAM FILES\Web Offer
C:\PROGRAM FILES\Altnet
C:\PROGRAM FILES\COMMON FILES\CMEII
C:\DOCUMENTS AND SETTINGS\ALL USERS\APPLICATION DATA\picsvr
C:\WINDOWS\browserxtras\pn

• Open HiJackThis
• Click on the configure button on the bottom right
• Click on the tab "Misc Tools"
• Click on "Delete File on Reboot"
• Navigate to this file - C:\WINDOWS\180ax.log
• Double click on that file.
• HJT asks you if you want to reboot, now. Click "no".
  
  Do that for the following files also, until you get to the last one, then click "yes" when HJT asks you to reboot.

C:\DOCUMENTS AND SETTINGS\SIMBA\APPLICATION DATA\tvmcwrd.dll
C:\DOCUMENTS AND SETTINGS\SIMBA\APPLICATION DATA\Sskcwrd.dll
C:\WINDOWS\SYSTEM32\winupdt.008
C:\WINDOWS\SYSTEM32\baur5s9q.dat
C:\WINDOWS\SYSTEM32\bqrufs5f.dat
C:\WINDOWS\SYSTEM32\vx1.nls
C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
C:\WINDOWS\INF\dlmax.inf
C:\WINDOWS\smdat32m.sys
C:\WINDOWS\dhdomp1.bin
C:\WINDOWS\alchem.ini
C:\WINDOWS\system32\mac80ex.idf[msbe.dll]
C:\WINDOWS\system32\mac80ex.idf[Uninstall.exe]
C:\WINDOWS\system32\mac80ex.idf[adv.exe]
C:\WINDOWS\system32\mac80ex.idf[adx.exe]

Post back when you finish and tell me how your computer is running

[compuder]

I've been doing the last steps in normal mode connected to the internet, I asked the guys in live chat if that was ok because you didn't specifiy safe mode/unconnected except in the very first post - (if that makes a difference).

Anways, I just did the instructions in your last post. One thing, I only found ONE "C:\WINDOWS\system32\mac80ex.idf" of these files. No [adx.exe], or [adv.exe] extensions in brackets. Don't know if that makes a difference, just thought I'd let you know.

Let me know what the next step is. Do I need activeScan?

[Excal]

One thing, I only found ONE "C:\WINDOWS\system32\mac80ex.idf" of these files. No [adx.exe], or [adv.exe] extensions in brackets.

Thats part of the Bullseye network which is a bad file. Delete it please

As long as everything is fine, this was the last step. I just wanted to make sure that your computer was back to normal.


Thanks,



Excal

[compuder]

Thanks for you help with the aurora - my comp seems to be working fine now.

Now I can't find my internet explorer .exe file now, I had some web pages I saved and now I can't open them. I find no .exe file for IE in my c:program files/internet explorer folder. I did a search and the only place are shortcuts to IE in my "documents and settings" folder.

Also, can you help me fix windows media player or do I need to post a new topic, if so what forum do I start a new post in?

[Excal]

k lets work on the IE first.

Try these suggestions first http://www.geekstogo...er_60-t251.html

Let me know how it goes.

Thanks,



Excal

[compuder]

Ok, I just found it, the IE.exe was HIDDEN. I had changed settings to hide hidden files.

I still can't open my saved web pages with IE.

[Excal]

copy them out of properties,go to the sites, then resave them as a favorite place


Excal

[compuder]

Even now, I try to save web pages as xxx.html and I cannot view them by clicking directly on them. It gives me "xxx.html is not a valid Win32 application" error message. I have to click OPEN WITH and choose either netscape or mozilla EXE files, it doesnt let me choose IE.exe, I guess this isnt a big problem. I'm not trying to bookmark the page, I'm trying to actually save it as it is in case I want to view it offline so I didnt save it as a favorite place.

I went to the topic about repairing IE and the first thing it says is that I need is a Windows XP cd-rom, which I dont have. My windows XP home edition came with my computer purchase and I just have the factory restore disks.

If I need windows xp cd-rom to fix my windows media player, then I cant fix it.

[Excal]

So firefox is working fine? Its just ie?


U weren't able to uninstall Media Player in the add/remove programs?

In safe mode?



Excal