yyy65 popus seem to be gone. have tagasaurus

By cmheinley
Mar 9, 2006
  1. I was told to repost here after i completed all the steps from the other thread. Well i was doing the online internet scan and i get an error report after i use the delete option. It doesn't delete really any of the detected files however, but it gives the option to view more information on the viruses. I get the error report before i can view all the details of the viruses. Here is my hijack now report though after following the other instructions. try to direct me from here. Should i do the other two steps posted by RBS?
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html

    Open your task manager, by pressing the ctrl/alt/delete keys together. Click on the processes tab and end process for(if there).


    Close task manager.

    Click start/run and type regsvr32 /u C:\WINDOWS\SYSTEM32\msupdate32.dll and press the enter key.

    Run HJT with no other programmes open and have HJT fix the following, by placing a tick in the little box next to(if there).

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
    R3 - Default URLSearchHook is missing

    O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\SYSC00.exe
    O4 - HKLM\..\Run: [twmtsrwA] C:\WINDOWS\twmtsrwA.exe

    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
    O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://eu-housecall.trendmicro-europe.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab

    O20 - Winlogon Notify: msupdate - C:\WINDOWS\SYSTEM32\msupdate32.dll

    O21 - SSODL: SysTray.Exgl - {636821FC-6F5C-2f1b-B164-E67214F678E2} - C:\WINDOWS\system32\ljimcphl.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files(if there).


    Reboot into normal mode and turn system restore back on.

    Please post a fresh HJT.

    Regards Howard :)
  3. cmheinley

    cmheinley TS Rookie Topic Starter

    okay. the only problem i came across was unregistering the msupdate32.dll. It said that there was no acess point for /u i believe. I had already deleted SYSC00.exe and twmtsrwA, and there was no msupdate.dll that i saw. I did however use hjt to fix the three problems and my new report is as follows.
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

Topic Status:
Not open for further replies.

Similar Topics

Add your comment to this article

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...