[Buckeye_Sam]

Just enter them in one at a time(hand type them in if you have to), but when it asks you to reboot after the first one, hit NO. Then enter the second one and reboot.

[Advertisements]

Sorry, but I can't get more than one entered. I put the first one in and it shows up in blue underneath. If I try to enter the other one the first one disappears. It's not asking me to reboot after the first one.

[showme69]

Sorry, but I can't get more than one entered. I put the first one in and it shows up in blue underneath. If I try to enter the other one the first one disappears. It's not asking me to reboot after the first one.

[showme69]

Sorry, but I can't get more than one entered. I put the first one in and it shows up in blue underneath. If I try to enter the other one the first one disappears. It's not asking me to reboot after the first one.

[Buckeye_Sam]

Just do them one at a time. If it doesn't ask you to reboot, then reboot manually.

[showme69]

Ok, did it once with msclock32.dll and it rebooted automatically, but the PUP window still pops up. Did it a second time and got the Pending File Rename... message, rebooted manually and the PUP window still pops up. Did it one more time with the msplock32.dll with the same results. I hate people that do this to us.

[Buckeye_Sam]

We're probably making this far too complicated.

Please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.
• If you have trouble getting into Safe mode go here for more info.

Please make sure that you can View Hidden Files

• Click Start -> My Computer
• Select Tools -> Folder options
• Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
• Also make sure that 'Display the contents of system folders' is checked.
• For more info on how to show hidden files click here.

Delete these files.

C:\WINDOWS\SYSTEM32\msclock32.dll
C:\WINDOWS\SYSTEM32\msplock32.dll


If you get an error while deleting try this first:

Click Start -> Run and type: regsvr32 /u msclock32.dll and hit Enter.
Then type regsvr32 /u msplock32.dll and hit Enter.

Then go back and delete the files.


Reboot back to normal mode.

[showme69]

I'll have to try later today, out of time right now. Thanks for the help so far.

[Buckeye_Sam]

No problem.
Post back when you can. I'll be around.

[showme69]

Went into safe mode, deleted the two files. Restarted the computer and the PUP window still came up. I'm running a full McAfee scan right now. I went into the System32 folder and didn't see the files anymore so I don't know where McAfee is finding them.

The full scan of the computer didn't turn up anything but the PUP window continues.

Edited by showme69, 11 October 2005 - 12:27 PM.

[Buckeye_Sam]

Is the location the same?

[showme69]

Yes, the PUP window lists the same thing.

C:\WINDOWS\SYSTEM32\msclock32.dll

[Buckeye_Sam]

Run Hijackthis and click on the Open Misc Tools section.

• Go to Delete a file on Reboot
• Select this file:
  
  C:\WINDOWS\SYSTEM32\msclock32.dll
  
  
• Click Open and Yes to confirm.
• Reboot your computer.

Let me know if you still get the popups.

[showme69]

I can't do that because as I mentioned earlier, when I go into the System32 folder the file isn't there, but it's still listed the same in the PUP window. That's what really confused me is that the PUP window is showing it, but it's not visible in the folder and a full McAfee scan doesn't pick it up either.

[Buckeye_Sam]

I suspect it's still there, it's just hidden. Let's see what we can find out.

Download and save backlight to your desktop. Doubleclick blbeta.exe, accept the agreement, leave [X]scan through Windows Explorer checked, click scan > next.

You'll see a list of all the items it found. There will also be a log on your desktop with the name fsbl.xxxxxxx.log (where xxxxxxx represents numbers). The application finds both bad files and legitimate ones such as "wbemtest.exe", so don't choose the rename option yet! Copy and paste the log it generated in your next reply.



============



Please download DLLCompare

*Save it to your desktop and run it.
*Click 'Run Locate.com'to scan.
*When the scan has completed, click 'Compare'.
*When completed, click "Make a Log of What Was Found".
*Please Copy/Paste the entire contents of the logfile to this thread.

Note: If you get an error after pressing Run Locate.com:
copy autoexec.nt from c:\windows\repair\ folder to c:\windows\system32\ folder.

[showme69]

Backlight didn't find aything. When I run DLLCompare, it just comes up with a notepad window with this in it:

10/12/05 07:30:16 [Info]: BlackLight Engine 1.0.23 initialized
10/12/05 07:30:16 [Info]: OS: 5.1 build 2600 (Service Pack 2)
10/12/05 07:30:16 [Note]: 4019 4
10/12/05 07:30:16 [Note]: 4005 0
10/12/05 07:30:47 [Note]: 4006 0
10/12/05 07:30:47 [Note]: 4011 1728
10/12/05 07:30:47 [Note]: FSRAW library version 1.7.1011
10/12/05 07:31:45 [Note]: 4007 0