Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

hijack this log

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Unread postby thefuse » May 31st, 2005, 3:05 pm

i finally worked out how to use dll compare and these are the files from the bottom section, dont know if they enlighten you anymore
* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!
________________________________________________

C:\WINDOWS\SYSTEM\folder.htt Tue May 10 2005 2:16:42p ...H. 13,122 12.81 K
C:\WINDOWS\SYSTEM\desktop.ini Tue May 10 2005 2:16:42p ...H. 266 0.26 K
C:\WINDOWS\SYSTEM\zllictbl.dat Mon May 30 2005 6:16:18p ...H. 4,212 4.11 K
C:\WINDOWS\SYSTEM\vsconfig.xml Tue May 31 2005 3:45:54p A..H. 890 0.87 K
C:\WINDOWS\SYSTEM\SFP\mscreate.dir Mon Jun 14 2004 1:28:52a A..HR 0 0.00 K
C:\WINDOWS\SYSTEM\SFP\IE\mscreate.dir Mon Jun 14 2004 1:28:52a A..HR 0 0.00 K
________________________________________________

2,033 items found: 1,986 files (6 H/S), 47 directories.
Total of file sizes: 231,458,845 bytes 220.73 M
thefuse
Regular Member
 
Posts: 40
Joined: May 30th, 2005, 5:19 am
Advertisement
Register to Remove

Unread postby askey127 » June 1st, 2005, 5:51 am

My recommendation is that you do a full data backup and re-install the system.

The symptoms you describe CAN be caused by parameters written into the file folder.htt
It is an HTML-like template and can be edited with notepad. It basically controls how a page looks and behaves, and is customizable. Desktop.ini just locates it. This file can be corrupted and replicated by malware infections. Then even after the malware is gone, all the templates can remain incorrect. If you can find representative samples of 'folder.htt' in a good working W98SE system, you might get away with replacing them directly. Original versions of the file come with the installation for the system or IE4.
The file folder.htt is hidden, so to change, rename, edit, or make a copy to work on, you would have to first boot using a W98 boot floppy to DOS, and use a command prompt line like:
ATTRIB -h -s C:\Windows\System\folder.htt
There is some info from Microsoft here http://support.microsoft.com/default.aspx?scid=kb;%5BLN%5D;Q181689

You have two actions you can take if you want to use the system for repair attempts without a clean re-install. You may need the W98SE CD for either.
Either may or may not work. You can try them if you wish.
(1) Under Start, Settings, Control Panel, choose Add/Remove and scroll all the way down to Microsoft Internet Explorer
Choose Remove. When the dialog comes up, choose Repair instead of Remove.

(2) Under Start, Programs, choose MSDOS Command Prompt. Type "sfc /scannow" without the quotes. sfc is known to be buggy in W98, but will attempt to replace corrupt system files.

askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13897
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Unread postby thefuse » June 1st, 2005, 6:04 am

thanks for all your help askey
will try to do all that you advised
thefuse
Regular Member
 
Posts: 40
Joined: May 30th, 2005, 5:19 am

Unread postby askey127 » June 1st, 2005, 6:07 am

If you try sfc /scannow from the command line, it may work best if you install the W98SE CD and enter it from Start, Run, rather than from a DOS box.

askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13897
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Unread postby thefuse » June 1st, 2005, 2:03 pm

call me stupid but i dont know how to get sfc/scannow to start or even how to get to it in the first place
thefuse
Regular Member
 
Posts: 40
Joined: May 30th, 2005, 5:19 am

Unread postby askey127 » June 1st, 2005, 4:18 pm

Put your CD for W98SE in the CD drive.
If it autostarts, click Exit.

You click on Start, Run.
When the box comes up, type sfc /scannow
(There is a space between sfc and /scannow).
Let it do its thing.


askey127
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13897
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Unread postby thefuse » June 4th, 2005, 6:43 am

if i type in sfc /scannow i get the message, 'the command line parameters are not valid. The following parameters are not recognized, "scannow"
thefuse
Regular Member
 
Posts: 40
Joined: May 30th, 2005, 5:19 am

Unread postby askey127 » June 4th, 2005, 7:35 am

thefuse,
If the command line parameter doesn't work, see whether you can run the system file checker from the windows interface.
MS instructions are here : http://support.microsoft.com/kb/185836/EN-US/

A possible complication of using this tool and its remedy are listed here : http://support.microsoft.com/?kbid=192832

askey
User avatar
askey127
Admin/Teacher
Admin/Teacher
 
Posts: 13897
Joined: April 17th, 2005, 3:25 pm
Location: New Hampshire USA

Unread postby Nick-YF19 » June 16th, 2005, 12:58 am

Whilst we appreciate that you may be busy, it has been 10 days or more since we heard from you.

Infections can change and fresh instructions will now need to be given. This topic is now closed, if you still require assistance then please start a new topic in the Malware Removal Forum

If you wish this topic reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.
User avatar
Nick-YF19
Admin/Teacher Emeritus
 
Posts: 4036
Joined: May 17th, 2005, 12:42 am
Location: California
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 35 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware