Can not " Fix " HJT line item

Stilllearning6 · Jul 10, 2006

HJT shows line item 015

- Trusted Zone :*.frame.crazywinnings.com(HKLM)

Others have posted this item and seemed to successfully "FIX" .

I place a checkmark next to this item in the HJT program and click fix , yet still apppears .

What am I missing ?

DavidGP · Jul 10, 2006

Have you followed all the steps in this thread Downloading, Installing, and Running HijackThis

and this section in particular

Before running HijackThis: You must be in normal boot mode and you should close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs. Also disable msconfig or any other similar startup control programs.
Click to expand...

If you have browser windows open then the fix will not remove it as its an active running file... close all browser windows and try?

Stilllearning6 · Jul 10, 2006

Thank you for the guidance .

Have printed your comments and will try again .

I do not remember if I left Notepad / MsftWord still open as I copied log to another computer. I don't want to guess --will retry, and provide update.

Stilllearning6 · Jul 10, 2006

Rebooted in normal mode,
preselected normal config in msconfig,
did not open any programs ,
ran HJT .
found same issue at -015 trusted site
placed a check to FIX ,
HJT said it would delete the item ,
the HJT screen showed as an all white page for several minutes -- perhaps 10 minutes.
Then , when C drive LED light seemed to be inactive , I closed it and scanned again .
Issue still there.

Still puzzled and still learning.

Suggestions ?

chaslang · Jul 11, 2006

Those kind of Trusted Zone items cannot be fixed using HJT. The easiest solution is to remove all TZ and RZ (Restricted Zone) items and then re-run Spybot's Immunize program (or any similar program used to put items in the RZ) .

Download DelDomains and unzip it to your desktop.

Find the files from deldomains.zip on your Desktop and RightClick on the deldomains.inf file and select Install.

Afterwards run Spybot and make sure you re-Immunize immediately.

Now check your HJT log and let me know how it looks.

Stilllearning6 · Jul 12, 2006

Thank you , your guidance was successful. Line item - 015 was removed .

I still have to work on 3 entries of

CoolWWWSearch.Feat2DLL

found by SpyBot v. 1.4 , which don't go away.

Will post info later . Thank you for your help.

chaslang · Jul 12, 2006

Proper procedure for full malware cleaning are given below. We require these steps to be performed before we will look at logs!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

Bitdefender

Panda Scan

HijackThis

.

Log in or Sign up

Can not " Fix " HJT line item

Stilllearning6 Private E-2

DavidGP MajorGeeks Forum Administrator - Grand Pooh-Bah Staff Member

Stilllearning6 Private E-2

Stilllearning6 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

Stilllearning6 Private E-2

chaslang MajorGeeks Admin - Master Malware Expert Staff Member