[tomcatt]

hi im having the same problem like another guy here (kurtsm)...i get an error sayin tht C:\Windows\System32\Tools\DelFolders.exe Cannot find file

i tried the same thing u told him...but got this in the log:

Logfile of HijackThis v1.99.0
Scan saved at 1:47:55 AM, on 2/1/2005
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\cisvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe
D:\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.in/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.msn.com/8SE...&CM=MsgrInstall
O1 - Hosts: 67.15.72.88 ibank.barclays.co.uk
O1 - Hosts: 67.15.72.88 online-business.lloydstsb.co.uk
O1 - Hosts: 67.15.72.88 online.lloydstsb.co.uk
O1 - Hosts: 67.15.72.88 www.halifax-online.co.uk
O1 - Hosts: 67.15.72.88 www.ukpersonal.hsbc.co.uk
O1 - Hosts: 67.15.72.88 www.nwolb.com
O1 - Hosts: 67.15.72.88 banesnet.banesto.es
O1 - Hosts: 67.15.72.88 extranet.banesto.es
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [SiS KHooker] C:\WINDOWS\System32\khooker.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: 24Online Client.lnk = C:\Program Files\eLitecore\Cyberoam Client for 24Online\CyberoamClient.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: Win32 Classes -
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2CD0ACE-CB25-4947-9EC5-23C19AC6AFFA}: NameServer = 172.16.0.1

please help me...& i have another very serious problem which might be related to this...when i click on shut down my computer does not turn off...it remains as it is...everything keeps working...im really worried...looking forward to your advice

[Advertisements]

Hi there tomcatt,
The following are mandatory fixes:
Close all programs down, leaving only HijackThis running.
Place a check against the following items:

O4 - HKLM\..\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe

Click on Fix Checked and exit HijackThis.

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\WINDOWS\system32\syshost.exe

Post back a fresh HijackThis log and we'll take another look.

[admin]

Hi there tomcatt,
The following are mandatory fixes:
Close all programs down, leaving only HijackThis running.
Place a check against the following items:

O4 - HKLM\..\Run: [Microsoft IIS] C:\WINDOWS\system32\syshost.exe

Click on Fix Checked and exit HijackThis.

Please reboot into safe mode (continually tap the F8 key while your system is starting, select Safe Mode from the menu).
Be sure you're able to view hidden files, and remove the following files in bold (if found):
C:\WINDOWS\system32\syshost.exe

Post back a fresh HijackThis log and we'll take another look.