Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

PSguard and the missing wininet.dll file! [RESOLVED]


  • This topic is locked This topic is locked

#31
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, I want you to try this.

Go to Start->Run and type in cmd and hit OK. Once that window opens, type in the following:

assoc .log

and hit Enter. What does it show you? Does it return back:

.log=txtfile


If not, I want you to type in:

assoc .log=txtfile


and hit Enter. Now try running HijackThis and posting the log.
  • 0

Advertisements


#32
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
OK, I've tried these commands but got no results I'm afraid.

I went to Start->Run (had to type in 'command', cmd wouldn't work).
Tried entering assoc .log (and assoc.log, to be certain) at C:\WINDOWS\Desktop> and at C:\> but got the same message both times - Bad command or file name.

I then tried the second command you gave me (assoc .log=txtfile and assoc.log=txtfile just to be sure) both at Desktop and C: but got the 'Bad command' message again. HJT still won't run!

Thanks for your patience with this! :tazz:

Edited by dweebosh, 15 August 2005 - 03:08 AM.

  • 0

#33
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
It's Windows ME :tazz: assoc command won't work there.

OK, create a blank notepad file and type in anything just for testing purposes. Now save the file as "test.log" (make sure to include the quotes). Now hold down your SHIFT key and right click on that test.log file...go to Open With. Choose Notepad and make sure the bottom box that says something like Always use this program to open these files is checked. Hit OK. Close that file. Now try HJT again.
  • 0

#34
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
I followed your instructions using the "test.log" file but HJT still won't run!
When I went to the 'Open With' menu the Always use this program... box wasn't checked. I then ticked this box and tried to run HJT - but no luck!

Can I do anything useful under Control Panel>Folder Options>File Types?
Sorry I don't have any good news to post!

Edited by dweebosh, 16 August 2005 - 04:13 AM.

  • 0

#35
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
That's ok, we'll try to help you figure this out. I will ask the others again to see if they have any other ideas.

OK, you may go into the File Types and see if you can find an entry for the log files. If you can find LOG, then delete that entry. Try running HJT again.

A word about LOG files since you deleted it. If Windows ask you what program to open a LOG file with, choose Notepad and check the box at the bottom. It will ask because you deleted it under File Types and it's not associated with any programs.
  • 0

#36
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
I tried deleting the LOG entry from the File Types menu but it made no difference.
HJT is still refusing to run.

I just want to double check that HJT works as a stand-alone application and doesn't need to be in any particular system folder to run (as long as its a permanent folder) - I'm just getting a bit paranoid that I'm doing something wrong now!
  • 0

#37
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, let's all hope it's a trojan that's blocking this. So try downloading CWS SmartKiller and unzip it. Then run that unzipped file. Did if find anything?

Restart and try runnning HJT.
  • 0

#38
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
I got this message when running the extracted CWS SmartKiller file...

MiniRemoval. Copyright © 2004 Safter Networking Limited.
CoolWWWsearch.Smartkiller (v1/v2) has not been found on your system.

It doesn't sound like it ran properly (or is this an 'all clear' message?)
I also received a PM recommending the following site for info on PSguard, I don't know if its helpful at all?
http://www3.ca.com/s...s.aspx?id=43297

...I don't see any obvious signs of spyware anymore (AdAware and Spybot aren't picking anything up), I just can't understand why HJT won't run anymore? Is this something to do with my earlier registry restore?

:tazz:
  • 0

#39
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
I'm not sure if you still have smitfraud anymore. Do a scan on the site you gave me. Use Internet Explorer and start a scan on that site. See if it can detect anything.
  • 0

#40
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
Hi Again,

Spent the weekend trying to get this new scan to work, no luck though!

Neither this new site or the Panda Active Scan ran properly. I reset my security settings to low (all ActiveX options enabled) and rebooted. Neither remote scan would work.

What am I doing wrong?!
  • 0

Advertisements


#41
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Download this file and unzip it. Run the unzipped .bat file and restart your computer. Try running HJT again. This problem is really frustrating now :tazz:
  • 0

#42
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
I tried the new file you posted but it wouldn't run properly :tazz: After clicking 'OK' to confirm the registry alterations I received an error message - something about the data not being a valid registry file?? (is this another Win Me problem?)

Thanks for all your help to this point! Although we're still having some difficulties getting HJT to run, I don't see any symptoms of Malware and my windows performance issues have been resolved. I'm very grateful for your assistance and hope my donation goes some way to showing this! :)
  • 0

#43
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
OK, let's try this. Download this file and unzip it. Run the .bat file and restart . Now try running HJT.
  • 0

#44
dweebosh

dweebosh

    Member

  • Topic Starter
  • Member
  • PipPip
  • 37 posts
Still no results I'm afraid! The file you posted ran in a DOS window but I could see lots of 'Bad command or file name' messages popping up in response to the commands.

The commands finished with an 'original file associations reset' message (or something to that effect) but HJT still wouldn't run after rebooting.

Why is life never simple?

Edited by dweebosh, 26 August 2005 - 06:53 AM.

  • 0

#45
greyknight17

greyknight17

    Malware Expert

  • Visiting Consultant
  • 16,560 posts
Do you remember if you tried renaming HJT yet to see if it will work? I think we did this already, but just want to make sure on that one.

OK, download Itty Bitty Process Manager and unzip it. Run the program and save the list. Post that list here. Again, if that doesn't run, try renaming the program to something else (since some trojans may try to block it by recognizing the default name).

Next, I want you to do this:

Create a folder on your desktop called Sysclean.
Go to http://www.trendmicr...ownload/dcs.asp and download sysclean package to the folder you made.
Go to http://www.trendmicr...oad/pattern.asp and download the Official Pattern Release for windows to your desktop.
This file will be called lptXXX.zip (XXX represents the version number)
Unzip lptXXX.zip and you'll get the file lpt$vpn.XXX.
Move the lpt$vpn.XXX to that Sysclean-folder you created on your desktop.

Turn off your antivirus which is installed on your system because it can interfere with the Sysclean-scan.

Open the sysclean-folder and doubleclick sysclean.com.
Check: Automatically clean or delete detected files.
Click scan.
When the scan is finished, open your sysclean-folder and copy and paste the contents of sysclean.log in your next reply.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP