147ak477

(1)
by TEMP, you mean c:\ TEMP
or C:\Documents and Settings\Administrator\Local Settings\Temp?

scan log please change to .log

[ Last edited by 147ak477 on 2006-1-15 at 11:42 PM ]

147ak477

開始——程式集，啓動，入面有冇咩隨機開嘅程序?

only have microsoft office and acrobat reader quick launch

147ak477

sorry forgot to attach

147ak477

all contents in c:\ TEMP deleted
and
C:\Documents and Settings\Administrator\Local Settings\Temp
some files cannot be deleted , other including hidded files are deleted
see attached

147ak477

O17 --deleted and doesn't  appear anymore

but
O20 - Winlogon Notify: MCD - C:\WINDOWS\system32\lv0u09d9e.dll
after use hijackthis to fix , still appear, when i manually click delete it
it said other program/user using it , cannot delete

i use norton to scan sometime before and there 's also a .dll ( scanned as a threat) that cannot be deleted.

147ak477

Originally posted by kingwong at 2006-1-16 06:03 PM:
用HIJACKTHIS修復以下items：

O4 -...

where can i find these:
ssocks5.dll
%systemdir%\SSocks32.dll
Regsock32. exe
MSM. EXE

147ak477

Originally posted by gergermen at 2006-1-16 10:09 AM:
咁你入SAFE MODE度再睇搞一次
HIJACK...

how to enter safe mode?

147ak477

entered saft mode
disable 系統還原
set show hidden files

hijackthis remove O 17 and O4

scan norton ( nothing  wrong detected! , even the file last time)

search but cannot find all the files:
C:\windows\system32\SSock32.dll
C:\WINDOWS\msm. exe
Regsock32. exe & ssocks5.dll

also all the things in the registry inside the quote cannot be find

147ak477

still have pop up
after i connect to internet
microsoft anti-spyware detected the contextplus.com wants to modify the windows host file and i click block it


an add pop up in IE, but cannot load

then my toolbar style suddenly changed , from blue XP style to classic grey style and warning windoe ( cannot find power(sth else in the name) .dll ) and rebooted!

147ak477

seems to fix , using another method from another forum
but thanks anyway
especially gergermen!!!