HPZipm12.exe and Firefox not starting anymore

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Solar, Jan 17, 2008.

  1. Solar

    Solar Private First Class

    Hello!

    Two days ago, a friend send me the a program Foxit to try it out and after i installed it, the day after i wanted to launch Firefox and nothing was showing up. Then went to windows task manager and noticed HPZipm12.exe and never saw this before. So i figure myself that i got a virus or malware that stoping firefox to go on the net. And even that Explorer could not go on the net.

    I then did a system restore point but i did not have an old one, i onlky had one from yesterday 16 january 2008. So i did and then just happend that i was able to run IE version with NO Addons the one found in System Tools.

    So i came online, went to this pge: http://forums.majorgeeks.com/showthread.php?t=139313
    IN here i found the steps to follow before posting here on : Windows XP Cleaning Procedure.

    So i did followed every step on by one 'till the 4th step where i stopped and i'm posting here with the attached files because the HPZipm12.exe file is still in my computer.

    ONe thing though, i do not have the Textfile from AVG antispyware. At the end after i followed all the steps and then clicked on APPLY , i went to report and there was nothing.

    Thank you for any help on fixing my laptop.

    Really appreciate!!
     

    Attached Files:

    Solar, Jan 17, 2008
    #1
  2. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    hpzipm12.exe is loaded by the Hewlett-Packard PSC 2100, 2200, 4100, and 6100 series printer drivers. They are essential for the smooth running of these devices.

    Do you use an HP priner?
     
    chaslang, Jan 17, 2008
    #2
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay now we need to use a new tool.
    • Download and save to RenV.exe from following link to Desktop (must be on the Desktop)
    • Now Copy the bold text in the below code box to notepad. Save it as Log.txt to your desktop. (It must be on your Desktop).
    Code:
    C:\WINDOWS\system32\ctfmon .exe
    • Now using your mouse, drag Log.txt onto RenV.exe
    • When finished, RenV.exe will produce a new log names Log.txt on your Desktop I will ask for this log later.

    Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Uninstall the below old versions of software:
    Java(TM) 6 Update 3

    Make sure you reboot after uninstalling the above!

    After reboot, now install the current version of Sun Java from: Sun Java Runtime Environment

    You must put your PC into Normal Startup mode using MSconfig. This was requested in the first Step of the READ & RUN ME. Please do this now and do not use MSconfig to control startups anymore.

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    F3 - REG:win.ini: load=C:\WINDOWS\system32\ddaba.exe
    O2 - BHO: (no name) - {1ECA2C76-1C41-4B03-A1CB-3C36F755EE74} - C:\WINDOWS\system32\ddaba.dll (file missing)
    O2 - BHO: (no name) - {A1C77420-D2AF-4A94-88DA-77CE0C551BED} - C:\WINDOWS\system32\jkkkhgg.dll
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3649] cmd /c del "C:\WINDOWS\system32\ddaba.dll_old"
    O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
    O20 - AppInit_DLLs:
    O20 - Winlogon Notify: jkkkhgg - C:\WINDOWS\SYSTEM32\jkkkhgg.dll
    O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll

    After clicking Fix, exit HJT.

    Now download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your desktop
    • Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    After reboot look for all of the above files we had Avenger attempt to delete. If you still see them, delete them yourself.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created by running this and also attach the log from Avenger.

    Make sure you tell me how things are working now!
     
    chaslang, Jan 17, 2008
    #3
  4. Solar

    Solar Private First Class

    Edit: I'm following the steps you've asked me to do.. we'll report soon.

    Thank you

    Hello Chaslang!

    Thank you for taking a second to respond. Yes an HP printer was installed in this computer but not used on it anymore. And the softwares and drivers were left in the computer. But to be honest with you, i've always check my Task Manager and never saw the HPZipm12.exe in there that is why i got scared.

    And why i got scared more is that out of sudden Firefox stop answering. As i explained in my first post, when i double ckick on Firefox icon, i see the mouse going like its going to start but no firefox page showing up.

    And i really would like to know if thru the logs, if i don't have any malware or virus in because since yesterday i am not accessing my email on the net at all in case.

    Thank you for your time!

    And Happy belate Year 2008, health and all the best

    S
     
    Solar, Jan 17, 2008
    #4
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    It was always there. It is a service and unless you uninstall the software, it will always be running. You can see it in your HJT log:

    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
     
    chaslang, Jan 18, 2008
    #5
  6. Solar

    Solar Private First Class

    Hello Chaslang!

    OK i did follow all the steps you've aksed me to to the letter. Now i just reboot after performing Avenger and now i'm looking inside System32 to see if the files were all erased and there is some example"
    - jkkkhgg.dll (tried to delete it but it says: its been used by another program or person)

    All the other ones i was able to to Delete them manually.

    I just finished running CCleaner and MGtools and here is the log. ONe thing, i'm looking inside Avenge folder and there is no Log in it.

    Things seems to go well now, i will reboot my computer after i send this message to you.

    Thank you again an i hope that Firefox will work after i reboot. Let me know what should i do if Firefox is still not working. Should I uninstall it and then clean everything that has to do with it and re-install it back? THanx
     

    Attached Files:

    Solar, Jan 18, 2008
    #6
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Where is the log from Avenger? Did you get an error while running it?
     
    chaslang, Jan 18, 2008
    #7
  8. Solar

    Solar Private First Class

    Sounds good. I only have COmodo Malware installed. The other ones are uninstalled. Thanx, will be waiting


    Well kind of , it detected a malware while it wanted to reboot the computer then i had one choice to click OK and then reboot. And i rebooted the computer.... but i did not get an error while running it. All went well. Just after it finishes all and ask me to reboot
     
    Solar, Jan 18, 2008
    #8
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Your infection has spread and we will need to do some similar steps, but you must getr Avenger to run properly. There is no need to attach a MGlogs.zip file unless you get Avenger to run as requested and produce a log because if Avenger does not run, your malware will not be removed.

    I will be writing a new procedure. In the meantime, shutdown your ComodoAntivirus. Perhaps it was interferring with Avenger.
     
    chaslang, Jan 18, 2008
    #9
  10. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Avenger does not detect malware so exactly what are you referring too? Do you mean as I said in my last message Comodo AV detected malware? If so, it stopped Avenger from running properly.
     
    chaslang, Jan 18, 2008
    #10
  11. Solar

    Solar Private First Class


    This is exact. Now i turned off Comodo all the way

    EDIT: OK Chaslang.. sorry but AVG was installed while i was following the first steps proceedures:
    http://forums.majorgeeks.com/showthread.php?t=139313
    ... ok i will uninstall all that now. Thank you. Do you want me to reboot computer after uninstallation? Thanx
     
    Solar, Jan 18, 2008
    #11
  12. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You must stop doing things on your own. You are causing more problems. DO NOT install anything unless we ask you to do so. I see you have installed more software. Uninstall Comodo BO clean now. Also uninstall AVG Antispyware now. Due to your infection, everything you install is getting infected.

    Uninstall the above while I work up a new fix.
     
    chaslang, Jan 18, 2008
    #12
  13. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Okay now we need to use a new tool.
    • Now Copy the bold text in the below code box to notepad. Save it as Log.txt to your desktop. (It must be on your Desktop).
    Code:
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
C:\Program Files\Comodo\CBOClean\BOC425 .exe
C:\Program Files\Google\Google Talk\googletalk .exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched .exe
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\QuickTime\qttask     .exe
C:\Program Files\QuickTime\qttask    .exe
C:\Program Files\QuickTime\qttask   .exe
C:\Program Files\QuickTime\qttask  .exe
C:\Program Files\QuickTime\qttask .exe
C:\WINDOWS\system32\ctfmon .exe
    • Now using your mouse, drag Log.txt onto RenV.exe
    • When finished, RenV.exe will produce a new log names Log.txt on your Desktop I will ask for this log later.
    Now Copy the bold text below to notepad. Save it as fixME.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:


    F3 - REG:win.ini: load=
    F3 - REG:win.ini: run=
    O2 - BHO: (no name) - {3E93E266-1568-42E2-A02B-7D2515656701} - C:\WINDOWS\system32\gebcc.dll
    O2 - BHO: (no name) - {A1C77420-D2AF-4A94-88DA-77CE0C551BED} - C:\WINDOWS\system32\jkkkhgg.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"

    I'm not sure why you have the below, but anything in a Temp folder is not useful to have as a startup since Temp folders always get files removed from them. They are Temporary not permanent. So fix this iehome.bat line too and then the O20 line.
    O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')

    O20 - Winlogon Notify: jkkkhgg - C:\WINDOWS\SYSTEM32\jkkkhgg.dll




    After clicking Fix, exit HJT.


    Run avenger.exe by double-clicking on it.
    • Check the 'Input script manually' box.
    • Click on the magnifying glass icon.
    • Copy everything in the Quote box below, and paste it in the box that opens:
    • Now click the 'Done' button.
    • Click on the traffic light icon and OK the prompt.
    • You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt
    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below logs"
    • Log.txt from RenV
    • C:\avenger.txt
    • C:\MGlogs.zip
    Make sure you tell me how things are working now!
     
    chaslang, Jan 18, 2008
    #13
  14. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes I know that but other things were not part of the READ ME.

    NOOO! You must only do what we ask you to do and nothing else. A reboot right now will spread your infection and cause it to mutate making the fix I just posted a wast of time.
     
    chaslang, Jan 18, 2008
    #14
  15. Solar

    Solar Private First Class

    Solar, Jan 18, 2008
    #15
  16. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    You need to click Yes to run on next reboot.

    Did you shutdown Comodo AV as requested? Did you uninstall AVG AntiSpyware and Comodo BO clean?
     
    chaslang, Jan 18, 2008
    #16
  17. Solar

    Solar Private First Class

    Hello Chaslang!

    HEre are the logs as requested. I did follow exactly word by word what yo've asked me to.
    Thank you.. ONe thing, everything seems to work normaly but i must admit that i will wait for your last call to know if i'm malware free and i'm curious to find out about Firefox. thank you
     

    Attached Files:

    Solar, Jan 18, 2008
    #17
  18. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    • Now Copy the bold text in the below code box to notepad. Save it as Log.txt to your desktop. (It must be on your Desktop).
    Code:
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
C:\Program Files\Comodo\CBOClean\BOC425 .exe
C:\Program Files\Google\Google Talk\googletalk .exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas .exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched .exe
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\QuickTime\qttask     .exe
C:\Program Files\QuickTime\qttask    .exe
C:\Program Files\QuickTime\qttask   .exe
C:\Program Files\QuickTime\qttask  .exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask      .exe
C:\Program Files\QuickTime\qttask     .exe
C:\WINDOWS\system32\ctfmon .exe
    • Now using your mouse, drag Log.txt onto RenV.exe
    • When finished, RenV.exe will produce a new log names Log.txt on your Desktop Attach this new Log.txt file now.
     
    chaslang, Jan 18, 2008
    #18
  19. Solar

    Solar Private First Class

    OK there it is the new Log.txt file as requested. Let me know whats next

    Thank you
     

    Attached Files:

    • Log.txt
      File size:
      279 bytes
      Views:
      1
    Solar, Jan 18, 2008
    #19
  20. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    We need to run it one more time as one file was missed.

    • Now Copy the bold text in the below code box to notepad. Save it as Log.txt to your desktop. (It must be on your Desktop).
    Code:
    C:\Program Files\QuickTime\qttask      .exe
    • Now using your mouse, drag Log.txt onto RenV.exe
    • When finished, RenV.exe will produce a new log names Log.txt on your Desktop I will ask for this log later.
    Run C:\MGtools\analyse.exe by double clicking on it. This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

    O2 - BHO: (no name) - {A1C77420-D2AF-4A94-88DA-77CE0C551BED} - C:\WINDOWS\system32\jkkkhgg.dll (file missing)
    O2 - BHO: (no name) - {CDE5462F-6B17-4C5C-B1EE-C7124170AAC7} - C:\WINDOWS\system32\gebcc.dll (file missing)
    O20 - Winlogon Notify: jkkkhgg - jkkkhgg.dll (file missing)

    After clicking Fix, exit HJT.

    Now delete the below file
    C:\WINDOWS\system32\TUKernel.exe

    Now Reboot your PC.

    Now run Ccleaner!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it. Then attach the new C:\MGlogs.zip file that will be created. Also attach the new Log.txt file from RenV.

    Make sure you tell me how things are working now!
     
    chaslang, Jan 18, 2008
    #20
  21. Solar

    Solar Private First Class

    Here is the request Log.txt and MGlogs attached!

    I think after this one, i'm gonna go sleep Chaslang. Thank you very very much for all. Hope your next post will be positive.
     

    Attached Files:

    Solar, Jan 18, 2008
    #21
  22. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Nope! Apparently you are not doing something correctly with creating the Log.txt file and dragging it ontop of RenV.exe.

    What happens if you just drag the Log.txt file that is on your Desktop now ontop of RenV.exe?
     
    chaslang, Jan 18, 2008
    #22
  23. Solar

    Solar Private First Class


    This is the thing Chaslang! Remember, when you ask me to copy whats in the box and create with notpad a file called Log.txt, for me already there is the same filename in the desktop. And then you ask me to take that file that i just created to drag it into RenV right? And it will after generate another notpad file that has the same name and you're telling me it will appear in the desktop right?

    My question to you, when RenV create the new Log.txt files, does it replace the one you asked me to create on the desktop? Thank

    Now i'm gonna go try what you just asked me to do, witch is Drag the log.txt file on RenV

    EDIT:

    HEre you will find screenshot of what exactly happen when i DRAG the Log.txt file. The first screenshot shows what happens when i drag the file, after a prompt DOS window open and then the created Txt file generated by RenV.exe

    http://i166.photobucket.com/albums/u106/Sosomusik/RenV1.jpg

    http://i166.photobucket.com/albums/u106/Sosomusik/RenV2.jpg

    http://i166.photobucket.com/albums/u106/Sosomusik/RenV3.jpg

    There you go Chas. Thanx a lot

    Thank you
     
    Solar, Jan 18, 2008
    #23
  24. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes. Notice I had you save this:
    Code:
    C:\Program Files\QuickTime\qttask      .exe
    and look at what is in your last Log.txt file

    Code:
    Ran on 2008-01-18 -  2:13:38,93
----a-w           282,624 2008-01-18 05:36:02  C:\Program Files\QuickTime\qttask      .exe
 Entries:                1  (1)
 Directories:            0  Files:             1
 Bytes:            282,624  Blocks:          552
     
    chaslang, Jan 18, 2008
    #24
  25. Solar

    Solar Private First Class


    HEllo Chaslang!

    GOod morning, sorry but i fall asleep man. Was starting very early this morning at work. Yes i noticed the log files but as i told you, i just followed your request and actions to do. But as i told you, the mixing thing is the following: first step you do ask me to CREATE with a notpad a Log.txt file on the desktop right? and then ask me to Drag that txt file on RenV an it opens up and after RenV generate a New txt File that you tell me is going to be saved in the desktop as well. But my question to you, Does RenV automatically overrwrite the one alredy on the desktop, because i've checkd and does not look like. So what i have to do when the New one from Renv is Open, i sto Delete the i created and then save As back the one from RenV.

    THank you, please let me know what you want me to do Next. I will be available now 'til 1h pm.

    Have a great day and thank you for your precious time

    :)
     
    Solar, Jan 18, 2008
    #25
  26. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    This is not necessary. RenV will automatically overwrite the previous file but you must make sure that you are not keeping the Log.txt file I had you create with notepad open. You must save the file and exit notepad.
     
    chaslang, Jan 18, 2008
    #26
  27. Solar

    Solar Private First Class


    Sounds good. But just to reassure you, when RenV was creating its own txt file, i DID NOT have the one i crated earlier opened. It was closed. But th first time, after i got the one generated by Renv, i open the only Log.txt file and noticed that what was inside was the same you had me create.

    Oh well. Thank you very much. Is there anything else i should or have to do next?

    And by the way, i did not try to see if Firefox is working back or not because i'm waiting to have your Green fire from you.

    Thanx
     
    Solar, Jan 18, 2008
    #27
  28. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Just delete the below file manually
    Code:
    ----a-w 282,624 2008-01-18 05:36:02  C:\Program Files\QuickTime\qttask      .exe

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

    Then attach the below log
    • C:\MGlogs.zip
    How are things working?
     
    chaslang, Jan 18, 2008
    #28
  29. Solar

    Solar Private First Class

    There you,here is the MGlogs.I did erase the txt file as requested.

    Things seems to run well as i told you yesterday. Of course i'm running IE to navigate or to write you now. Haven't launched Firefox to see if its launching or not yet. Waiting for you to confirm me if I'm malware free or not.

    Thank you Chas!
     

    Attached Files:

    Solar, Jan 18, 2008
    #29
  30. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    We are not doing anything to specifically deal with anything related to FireFox. So if it still does not work properly, you should uninstall it, reboot, delete the FireFox folder, and then reinstall.

    You logs are clean.

    If you are not having any other malware problems, it is time to do our final steps:
    1. If we used Pocket Killbox during your cleanup, do the below
      • Run Pocket Killbox and select File, Cleanup, Delete All Backups
    2. If we used ComboFix then UNINSTALL COMBOFIX (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
      • Click START then RUN
      • Now type combofix /u in the runbox and click OK.
      • Note: The space between the X and the U, it must be there.
    3. If we user SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
    4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
    5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
    6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
    7. If we had you run Avenger, you can delete all files related to Avenger now.
    8. If we had you run RenV.exe, you can delete it and the Log.txt file on your Desktop.
    9. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
    10. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
    11. You can delete the C:\MGtools folder and the C:\MGtools.exe file. You can also delete the C:\MGlogs.zip
    12. If you are running Windows XP or Windows ME, do the below:
      • Refer to the cleaning steps in the READ ME for your Window version and see the steps to Disable System Restore which will flush your Restore Points.
      • Then reboot and Enable System Restore to create a new clean Restore Point.
    13. After doing the above, you should work thru the below link:
     
    chaslang, Jan 18, 2008
    #30
  31. Solar

    Solar Private First Class

    Problem Solved with Malware

    Hello Chas!
    THank you thank you thank you for your time. Cannot thank you enough. I did follow your last steps to the T. I did the Restore point Disabled and Enable back after reboot.

    I'm going now to read and follow the steps on How to Protect yourself from malware!

    And regarding firefox, i will uninstall it etc...

    One last question for you, do you suggest me to get Comodo Antivirus or its not a good one? For sure i will be getting comodo Firewall and Avg antispyware as well.

    Thank you for guiding me thru these steps.

    Cheers and good day!

    S:)
     
    Solar, Jan 18, 2008
    #31
  32. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Re: Problem Solved with Malware

    You're welcome.

    I did not realize that you uninstall it Comodo AV since it still shows in your HJT log:
    Apparently it did not uninstall properly.

    You can use it or any of the other free antivirus programs given in the How to protect yourself link.
     
    chaslang, Jan 18, 2008
    #32
  33. Solar

    Solar Private First Class

    Hello Chas!

    Sorry to disturb you agian.. but after i followed all the steps until System Restor, then i reboot my computer and after installed Comod Firewall.. and then reboot because it ask for. Then when i came back to launch IE, i started seeing these things appearing.

    Can you help me here please. Thanx

    Look at the Screnshot:

    http://i166.photobucket.com/albums/u106/Sosomusik/Destinations.jpg

    http://i166.photobucket.com/albums/u106/Sosomusik/scannercopy1.jpg

    I really dont know what are these now.. thanx for your help!
     
    Solar, Jan 18, 2008
    #33
  34. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Not malware! I'm not sure exactly what you are doing or how you are installing or configuring things but you have some aspect of your software confused on where to look for things.
     
    chaslang, Jan 18, 2008
    #34
  35. Solar

    Solar Private First Class

    I

    I know this is not a malware but its damn annoying. Everytime i'm on IE or open anything for the internet, either the window for Destinations or SCanner copy appear trying to gather info. I really have no idea. And trust me, i did not do anything besides what we did to fix the malware probs.

    Thanx, i'll try to see if i can find a solution for this. Gracias
     
    Solar, Jan 18, 2008
    #35
  36. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Remember when I ask about the below?
    O4 - .DEFAULT User Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')

    What is the purpose of this? Does that file even exist? If so, what is in it?
     
    chaslang, Jan 18, 2008
    #36
  37. Solar

    Solar Private First Class

    Yes i do remember but i dont even know what is the purpose of this file. But i think in the last proceedures, we did delete it.
     
    Solar, Jan 18, 2008
    #37
  38. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    I asked you to fix it multiple times but it still always showed in your log. I assumed you were not fixing it for some reason.

    Check a current log. Is it still there?
     
    chaslang, Jan 18, 2008
    #38

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds