Important: Create a folder on the C: drive called C:\HJT. You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary. Please delete the old copy (including the zip copy) so it can't be used.
Check these in hijackthis, AND WITH ALL OTHER WINDOWS CLOSED, fix checked.
The following have randomly named file names, and as such are normally malware, UNLESS you know what they are, and they are from a safe source, please check for removal.
ChrisRLG
3.9K Posts
0
April 13th, 2004 12:00
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Unzip HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary. Please delete the old copy (including the zip copy) so it can't be used.
Check these in hijackthis, AND WITH ALL OTHER WINDOWS CLOSED, fix checked.
O4 - HKCU\..\Run: [explore] c:\windows\explore.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/03cfaf489f939c45eb19/netzip/RdxIE601.cab
The following have randomly named file names, and as such are normally malware, UNLESS you know what they are, and they are from a safe source, please check for removal.
O4 - HKLM\..\Run: [ADHKNQUX] C:\WINDOWS\ADHKNQUX.exe
Then Reboot to safe mode (F8 on boot) and delete the following files/folders:-
File > > c:\windows\explore.exe
And if checked above.
File > > C:\WINDOWS\ADHKNQUX.exe
Then Reboot and post a fresh log for me to check.