Printable View
I have PM'd the OP on two occasions regarding this matter, but so far have not received a reply :(.
Hopefully it was not a wasted effort on my part.
If you are having problems, you are welcome to post a log in the hijackthis forum, along with a silent runners log. The text file it creates will be in the same folder you run it from.
Please run Adaware and Spybot S&D first if you decide to post :).
stargazer777. If you read this, can you also do a search for C:\windows\Hires.dat and delete that also if found.
okay- problem solved- i downloaded the silent runner program and found a startup program called "resetuponreboot.exe" or something (i wish i saved the name) that was located in the windows/temp directory. after erasing the temp directories and eliminating that item from the registry and rebooting the computer- it seems to have gone away. funny that norton or any other spyware/adware programs could not catch this, and i tried them all. btw- i updated all the most recent winxp updates available- don't know if that helped any- but it seemed many of them were security and adware related.
Nope, did a full search in that directory path and .... nothing.Quote:
Originally posted by crunchie
stargazer777. If you read this, can you also do a search for C:\windows\Hires.dat and delete that also if found.
- Dave
All,
I did another scan with Silent Runner, and I have attached the resulting file.
- Dave
You still have C:\WINDOWS2\System32\delaybuf.dll on board. That is why you are still being hijackrd :).
Please post another hijackthis log and we can go from there.
Well, I deleted everything I previously was told to. I can only surmise it is somehow being reinstalled.
I tried to delete it, and a message window informed me that I could not delete the file, that "access is denied". How do I get around this so I can ditch it ?
- Dave
That's why I wanted a hijackthis log. Then the complete process can be undertaken. Do you still have the killbox? It will be required again, unless you can delete the delaybuf file in safe mode.
crunchie,
Here is a new HijackThis log as requested.
I'm late to work but will check for replies from there.
I'll be coming home early and should have plenty of time this afternoon to work on killing this thing. Hopefully it won't be a too-involved process.
Thanks again for comments and info.
- Dave
Scan with hijackthis and tick the boxes next to all the following entries, then close all browser and explorer windows, and hit the "Fix checked" button.
O2 - BHO: BHO Class - {575A5AE9-B68E-4BEB-BACB-FE430448C654} - C:\WINDOWS2\System32\WinSuck.dll
O2 - BHO: IEWatchObj Class - {9527D42F-D666-11D3-B8DD-00600838CD5F} - C:\WINDOWS2\System32\IETie.dll
O2 - BHO: BHO Class - {F6053709-5723-454E-AB9D-7FC7E681AFA5} - C:\WINDOWS2\System32\WinTitle.dll
O9 - Extra button: SideStep - {3E230861-5C87-11D3-A1C6-00105A1B41B8} - C:\WINDOWS2\Downloaded Program Files\SbCIe02a.dll
O9 - Extra button: (no name) - {578FC4E3-151E-456c-AF8E-B63061EFE228}} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
Run Pocket Killbox again and paste the full file path of the file in the box and click on Standard File Kill and End Explorer Shell While Killing File. Click on the button with the red circle and an X in the middle after you enter the file.
C:\WINDOWS2\System32\delaybuf.dll
Reboot afterwards if the file is successfully deleted.
If the file is not deleted, do not reboot yet. Run Pocket Killbox again and paste the full file path in the box and click on Delete on Reboot. Next click on the button with the red circle and an X in the middle. You will get a message saying "File with be deleted on next reboot, Process and Reboot now?" Click "Yes" to reboot only after the last file you enter.
After the reboot please post another hijackthis log and a silent runners log.