Also download and install ccleaner.exe from http://www.ccleaner.com. Don't let it clean anything yet.
Reboot into Safe Mode by tapping the F8 key when you see the PC maker's logo. Keep tapping until it tells you it is going to Safe Mode or you see the Safe Mode menu. Select the top option. Log in with your usual login.
Run HijackThis and just do a Scan only. Check then Fix Checked the following:
(Also check anything that was not in your last scan. These things tend to change names every reboot.)
Now run ccleaner.exe. On the first page, uncheck everything but the two lines that have the word Temporary in them then Run Cleaner.
Run Killbox. Where it says Full Path of File to Delete you need to type or copy (Hightlight and Ctrl + c) and Paste (move to the killbox and place the cursor in the box and Ctrl + V):
c:\secure32.html
Then check Delete on Reboot option then press the red button.
Agree you want to delete the file but do not let it reboot. Repeat for:
Normally I would tell you to start your own thread but it appears that dell is pulling the plug on the HijackThis forum and not accepting new posts so send me your log directly: rkinner "AT" att "DOT" net. Put Hijack in Subject Name.
RKinner
2 Intern
•
5.9K Posts
0
October 21st, 2005 00:00
Download the Hoster from:
www.funkytoad.com/
Unpack to your desktop and run it. Select Restore Original Hosts.
Get DelDomain.inf from:
http://www.mvps.org/winhelp2002/DelDomains.inf and then right click on it and Install.
Download the killbox:
http://www.atribune.org/downloads/KillBox.exe
or
http://www.bleepingcomputer.com/files/killbox.php
and save it to your desktop.
Also download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet.
Reboot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in with your usual login.
Run HijackThis and just do a Scan only. Check then Fix
Checked the following:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [polo.exe] polo.exe
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O4 - HKCU\..\Run: [MStask] C:\WINDOWS\svchost.exe
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {9D614E8E-03AA-11D3-90FC-0040C7157029} (PDMSInstallerCtl Class) - http://www.pakdata.com/download/PDMSInstaller.cab
O20 - Winlogon Notify: style32 - C:\WINDOWS\
(Also check anything that was not in your last scan. These things tend to change names every reboot.)
Now run ccleaner.exe. On the first page, uncheck everything but the two lines
that have the word Temporary in them then Run Cleaner.
Run Killbox.
Where it says Full Path of File to Delete you need to type
or copy (Hightlight and Ctrl + c) and Paste (move to the killbox and
place the cursor in the box and Ctrl + V):
c:\secure32.html
Then check Delete on Reboot option then press the red button.
Agree you want to delete the file but do not let it reboot.
Repeat for:
C:\WINDOWS\System32\polo.exe
C:\WINDOWS\system32\paytime.exe
C:\WINDOWS\svchost.exe
(It may not find any of these last three. Just go on to the next.)
Run your antivirus while still in Safe Mode and let it do a full scan.
Reboot into normal mode and run another HijackThis log and post it as a reply. Let's
see how we did.
Ron
Keltik
4 Posts
0
November 13th, 2005 23:00
RKinner
2 Intern
•
5.9K Posts
0
November 14th, 2005 21:00