TechSpot

Lots of Virus problems

By drewbp
Jun 6, 2006
  1. Sorry wrong forum
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Go HERE and follow the instructions exactly.

    Post a fresh HJT log into this thread, only after doing the above.

    I have moved this thread to our security and the web forum.

    Regards Howard :wave: :wave:
     
  3. drewbp

    drewbp TS Rookie Topic Starter

    wshjc.exe and other problems

    I have followed all the directions I was able to follow.

    My screen comes up on regular boot, then turns to blue backgroung, then I get the active desktop warnings. I also have 2 items in startup in msconfig that I don't see in the Hack this log gjpfdy in system32, although I can't find it there, and xrcgj, that is a common start up item.
    Thanks for the help in advance.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html


    Run HJT with no other programmes open. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Drew's Internet

    F2 - REG:system.ini: Shell=Explorer.exe, C:\WINDOWS\system32\wshjc.exe
    F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,honnnep.exe

    O4 - HKCU\..\Run: [Poay] C:\WINDOWS\ICROSO~1\explorer.exe

    O11 - Options group: [INTERNATIONAL] International*

    O14 - IERESET.INF: START_PAGE_URL=http://www.att.net This entry should be fixed if this address does not belong to your PC-manufacturer or your 'Internet-Service-Provider (ISP)'.

    O15 - Trusted Zone: http://officebeta.iponet.net

    Fix all 016-DPF entries.

    O23 - Service: JavaHMO TiVo TCM (JavaHMO) - Unknown owner - C:\Program Files\JavaHMO\bin\Wrapper.exe" -s "C:\Program Files\JavaHMO\conf\wrapper.conf (file missing)

    Click on the fix checked button.

    Close HJT.

    Reboot into normal mode and turn system restore back on.

    Please post a fresh HJT log.


    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...