Critical system errors

alrita · Nov 13, 2006

I have Gone through all the steps in Read and Run
First form and still have the critical system errror pproblem. Logs are attached. Any help will be appricted. This is post one of two to get all the attachments

alrita · Nov 13, 2006

Critical system errors 2

This is page 2 with the balance of logs.

chaslang · Nov 14, 2006

Welcome to Majorgeeks!

You need to attach the other logs that were requested in the READ ME:

runkeys.txt - the log from GetRunKey.bat
newfiles.txt - the log from ShowNew.bat

You also MUST install and rename HijackThis exactly as requested in the READ ME. You are running it directly from the ZIP file which we specifically indicate that you must not do. Attach a new log from it after installing and renaming as specified.

alrita · Nov 14, 2006

I though I followed Hijack this instructions. It is in my windows file under analyse.exe. I must have did it wrong and redownloaded per instructions and hope it is correct this time. Attached is the file plus the missing files. Thank you.
Al

chaslang · Nov 14, 2006

alrita said:

I though I followed Hijack this instructions. It is in my windows file under analyse.exe.
Click to expand...

HijackThis should not be install there!!!!! And you did not rename it properly. You have multiple .exe extensions!

This is what you currently have!

C:\WINDOWS\analyse.exe\analyse.exe.exe

This is what it should be!

C:\Program Files\HJT\analyse.exe

or even

C:\Program Files\HijackThis\analyse.exe

Please install it as requested.

Is your copy of Spyware Doctor 4.0 a paid or free trial version?

Uninstall the below old versions of software:
J2SE Runtime Environment 5.0 Update 6
Mozilla Firefox (1.5.0.7)

Now install the current version of Sun Java from: Sun Java Runtime Environment

Then install the current version of FireFox from: Mozilla Firefox

Delete the below two folders! If they will not delete, just tell me later but continue on with all steps below:
C:\Program Files\Starware347
C:\Program Files\VirusBursters

I'm going to post two sets of instructions below. Each will be enclosed in separate Quote boxes. Make sure to complete the first one 100% before moving on to the second one.

STEP 1: Complete this procedure completely including attaching the requested log before doing the second procedure.

Download SmitfraudFix (by S!Ri) to your Desktop.

Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please attach that log in your next reply.

Note:process.exe ( which is used my SmitFraudFIx ) is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user. The below is a link to what process.exe is.

http://www.beyondlogic.org/consulting/proc...processutil.htm

IMPORTANT: Do NOT run any other options until you are asked to do so!
Click to expand...

STEP 2: PLEASE READ ALL OF THESE INSTRUCTIONS FIRST BEFORE DOING ANYTHING. Ask any questions that you may have before starting.

Please print out or copy these instructions to Notepad as the internet will not be (while in Safe Mode) available to you at certain points of the removal process. Make sure to work through all the Steps in the exact order in which they are listed below. Again, if there's anything that you don't understand, ask your question(s) before moving on with the fixes.

Reboot your computer into Safe Mode : Starting your computer in Safe mode

Open the SmitfraudFix Folder of your Desktop, then double-click smitfraudfix.cmd file to start the tool.

Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.

The tool will also check if wininet.dll is infected. If it is infected and a clean version is found, you will be prompted to replace the infected wininet.dll with the clean file. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. BUT Reboot in Safe Mode.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed.

Now reboot into normal mode and attach this new rapport.txt log here.
Click to expand...

Now attach new logs from:

GetRunKey

ShowNew

HJT

How are things working now?

alrita · Nov 14, 2006

I finished and the Critical system error is gone. I am attaching the files in this post and the next. The Doc is purchased. I redid the Hijack this several times before I got the exe.exe out {I Hope} Thanks for your help it is greatly appricated. I had to put rapport in notepad and save as I did not know how to get it out of system 32
Al

alrita · Nov 14, 2006

Here is no2 get runkeys and shownew

chaslang · Nov 15, 2006

alrita said:

I redid the Hijack this several times before I got the exe.exe out {I Hope}
Click to expand...

You still have it incorrect! You have the below:

C:\Program Files\analyse.exe\HijackThis.exe

I repeat what it should be:

C:\Program Files\HJT\analyse.exe

or even

C:\Program Files\HijackThis\analyse.exe
Click to expand...

Since your copy of Spyware Doctor is a paid version, you should uninstall Windows Defender now!

Is everything running okay?

alrita · Nov 15, 2006

I went to search and found all HJT, hijack this, analyse.exe deleted them all, redownloaded the zip file. I opened programs in start menu and made a new folder HJT. I went to zip file and extrated the file to the HJT. I went to C:\programs highlited the HJT and renamed it analyse.exe. Attached is what I got when I ran it,with two exe's. Have no idea what I am doing wrong. The instructions are right in front of me and I follow them to a tee. Guess at 65 I should have stayed with learning how to set the clock on the old VCR. My grand child who uses this can get the virus fast then leave to go back north and I get to learn how to fix it. Computer working OK. Can get Firefox but thats OK I have Internet explorer. I uninstalled defender and Monzella as it would not connect for somereason.
Thanks for everthing.
Al

chaslang · Nov 16, 2006

alrita said:

I went to search and found all HJT, hijack this, analyse.exe deleted them all, redownloaded the zip file. I opened programs in start menu and made a new folder HJT. I went to zip file and extrated the file to the HJT. I went to C:\programs highlited the HJT and renamed it analyse.exe. Attached is what I got when I ran it,with two exe's. Have no idea what I am doing wrong.
Click to expand...

You said you created a new folder named HJT but you are not using it. So either you did not create the HJT folder or you do have it, but you are not running the HijackThis program from that folder. You are using the below:

C:\Program Files\analyse.exe\analyse.exe.exe

I'll describe what the above means:

C:\ is the root (the highest level) folder on drive C

Program Files is a folder which is located in the root of drive C

analyse.exe is a subfolder of Program Files

analyse.exe.exe is the file that you renamed from hijackthis.exe

You don't need to keep redownloading and extracting the files. All you need to do is right click on analyse.exe.exe and select Rename. Then just remove the duplicate .exe from the end of the name. Then you could select the analyse.exe subfolder and right click on it and again select Rename and change it to HJT. Then if you now run the analyse.exe program you would see the below in your HJT log.

C:\Program Files\HJT\analyse.exe

Since you are not having any malware problems it is not necessary for you to worry about this; however, if you think of this as computer education , it is useful training.

I'm not sure what you mean by

Monzella as it would not connect for somereason.
Click to expand...

You should work thru this How to Protect yourself from malware! you really need to get a true firewall installed. You are probably relying on the on in WinXP SP2 which is not adequate.

Log in or Sign up

Critical system errors

alrita Private E-2

Attached Files:

Activescan.txt

bdscan.txt

log.txt

alrita Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

alrita Private E-2

Attached Files:

hijackthis.log

newfiles.txt

runkeys.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

alrita Private E-2

Attached Files:

hijackthis.log

rapport.txt

rapport safe mode.txt

alrita Private E-2

Attached Files:

runkeys.txt

newfiles.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member

alrita Private E-2

Attached Files:

hijackthis.log

chaslang MajorGeeks Admin - Master Malware Expert Staff Member