Hi. I have just looked and deleted the file/folders that you said i should. I though i would let you know which ones were present and not present.
C:\WINDOWS\GatorHDPlugin.log < file Not present.
C:\WINDOWS\smdat32a.sys < file Present
C:\WINDOWS\toolbar_nieuw13.dll < file Not present.
C:\Program Files\Myway < folder Present
C:\WINDOWS\TEMP\Altnet < folder Not present.
C:\WINDOWS\browserxtras < folder Present
C:\WINDOWS\mshp.dll < file Not present.
C:\WINDOWS\system32\EGCOMLIB_1035.dll < file Not present.
C:\WINDOWS\system32\redirect.vbs < file Not present.
I have deleted those that i found. And yes i did notice that you wanted me to delete the file: EGCOMLIB_1035.dll . So why am i getting that pop-up which only occurs in my sisters folder? I feel i should add that my computer is working real fast on the internet now, i didnt notice it had slowed down so much before i ran those programs as it was still reasonably fast. Another question (sorry), is this a fixable problem and is it quite a nasty one? Anyway i hope i am doing alright for you and again thanks for your assistance and patience.
Hi. Just saw your new post. There are 5 user accounts on the computer. As i said i ran both of the tools from my sisters account and that Apropos thing. My user account did not show up in the safe mode! I did however run the CCleaner on my account (in normal mode) by mistake. I then ran it again in my sisters account in the safe mode. I would like to point out that the Ewido program did scan through all the other user accounts just not mine.
Please post your hijackthis logs directly into this thread and not as an attachment they will fit here. Also I cannot work on more than one log at a time. So let's concentrate on the top one and let's call it LOG A, it gets way to confuseing for me if more than one log is worked on at a time. You must be logged in to that user account that we are working on as each account has it's on little or big problems.
LOG A ONLY:
Go here to learn how to show hidden files/folders:
Again make sure all browser windows are closed and click FIX
Now reboot into safe mode by tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter.
Hunt for and delete if present:
C:\Program Files\Viewpoint < folder
Now run that clean batch file you created earlier, type in 'Y' a couple of times and press enter at the prompts.
Then:
Go to Start > Run and type: CLEANMGR.EXE and hit enter.
When prompted select the C: drive and click ok.
Check the boxes for:
Temporary Internet Files
Downloaded Program Files
Recycle Bin
Temporary Files
Click OK or Enter
Reboot
Make sure you are set to normal startup. Click Start -> Run -> Type Msconfig -> Press Enter -> make sure Startup is set to Normal Start
Post a new HJT log for further review and feed back on how this user account is running now please. LOG A ONLY
I would like to clarify that all the hijack logs i have posted in this thread have been from my user account only. They were just taken from various stages of the process i have undertaken with you. My computer is running fine but i only ever noticed a problem before when opening or runnning downloaded video files( these files were not illegally by the way it was from a site which allows downloads.). I suppose it is running abit faster.
Here is the new hijack log (from my user account) after doing the procedures in your post above:
Logfile of HijackThis v1.99.1
Scan saved at 09:39:43, on 13/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\hijackthis.exe
I still experience the problem when in safe mode that i cant access my user account. Everyone elses account is present. Therefore i have been running all the tools that needed to be run in safe mode in my sisters account. But all hijack this logs have been done in my account (in normal mode).
Thankyou for cleaning my account. But i do still have the same problem when i download a certain file. It still closes down my folder screen when i open the folder with the new download in it. Maybe that particular file is just corrupt.
Anyway here is my big sisters account, i have found that a pop-up appears when i open her account with that error loading EGCOMLIB_1035.dll message. Here is her hijack this log:
Logfile of HijackThis v1.99.1
Scan saved at 10:35:01, on 14/01/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\system32\slserv.exe
C:\Program Files\Virtual CD v4 SDK\system\vcssecs.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\khooker.exe
C:\Program Files\Virtual CD v4 SDK\system\vcsplay.exe
C:\Program Files\Lexmark\Lexmark Precision Photo\MemCard.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\HijackThis\hijackthis.exe
Make sure you can see hidden files/folders
In Windows XP
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.
Run hijackthis and click the scan button and put checks next to these:
Nothing open but hijackthis and click "fix checked"
Now reboot into safe mode by tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter.
Hunt for and delete if present:
EGCOMLIB_1035.dll/search for this one as no full file path is evident, probably in windows or system32 folder
Now run that clean batch file you created earlier, type in 'Y' a couple of times and press enter at the prompts.
Then:
Go to Start > Run and type: CLEANMGR.EXE and hit enter.
When prompted select the C: drive and click ok.
Check the boxes for:
Temporary Internet Files
Downloaded Program Files
Recycle Bin
Temporary Files
Click OK or Enter
Reboot and do a Panda scan useing big sisters account
