Thank you, I created a folder and moved it in there. I have the scan log in "my documents" should I move that in there as well and delete it from my documents? Can you tell what is going on with my system?
Important: Create a folder on the C: drive called C:\HJT. You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT. Move HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary. Please delete the old copy so it can't be used.
aero654
3 Posts
0
June 6th, 2004 02:00
pskelley
933 Posts
0
June 6th, 2004 02:00
Important: Create a folder on the C: drive called C:\HJT.
You can do this by going to My Computer (Windows key+e) then double click on C: then right click and select New then Folder and name it HJT.
Move HijackThis into this folder. When you run HijackThis from this folder and have it "Fixed checked" it will create a backup file of modifications to use if restore is necessary. Please delete the old copy so it can't be used.
Navin kurian
526 Posts
0
June 6th, 2004 11:00
Run spybot 1.3 http://www.safer-networking.org/index.php?page=mirrors
then delete
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allaboutsearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://allaboutsearching.com/searchbar.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://allaboutsearching.com/searchbar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://allaboutsearching.com/searchbar.html
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O1 - Hosts: 207.36.196.189 auto.search.msn.com
O1 - Hosts: 207.36.196.189 search.netscape.com
O1 - Hosts: 207.36.196.189 ieautosearch
O4 - HKLM\..\Run: [efal] C:\WINDOWS\efal.exe
O4 - HKLM\..\Run: [StQ] C:\documents and settings\david r. melk\local settings\temp\StQ.exe
O4 - HKLM\..\Run: [Bakra] C:\WINDOWS\System32\IEHost.exe
O4 - HKLM\..\Run: [2LRX2W83X2T3MQ] C:\WINDOWS\System32\PcwbkiJQ.exe
O4 - HKLM\..\Run: [w7oS3pO] upnenum.exe
O4 - HKLM\..\Run: [nzrzjxskbmzry] C:\WINDOWS\System32\jkhqrjzw.exe
O4 - HKLM\..\Run: [HtmReal] C:\PROGRA~1\Bleh the time\Poll date build.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - Startup: AdDestroyer.lnk = C:\Program Files\AdDestroyer\AdDestroyer.exe
O4 - Startup: Virtual Bouncer.lnk = C:\Program Files\VBouncer\VirtualBouncer.exe
then run cwshredder
http://www.spywareinfo.com/~merijn/downloads.html
http://www.spywareinfo.com/~merijn/htlogtutorial.html