1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

[Solved] About:blank hijack

Discussion in 'Virus & Other Malware Removal' started by SharonMc, Sep 13, 2004.

Thread Status:
Not open for further replies.
Advertisement
  1. SharonMc

    SharonMc Thread Starter

    Joined:
    Sep 13, 2004
    Messages:
    7
    Hi ~ I'm new here. I've read the other posts about about:blank hijackings, and I'm the latest victim. I ran findnfix, and this is the log. I'm not super computer literate, but any help is appreciated. This thing is a demon. Thanks! :)

    Mon 13 Sep 04 12:27:06

    »»»»»»»»»»»»»»»»»»***LOG!***(*updated *9/1*)»»»»»»»»»»»»»»»»

    *System:
    Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600)
    *IE version:
    6.0.2900.2180 SP2

    The type of the file system is NTFS.


    MS-DOS Version 5.00.500

    *command.com test passed!

    __________________________________
    !!*Creating backups...!!
    (*Backup already exist!)
    12:27:06.10 Mon 09/13/2004
    __________________________________

    *Local time:
    Monday, September 13, 2004 (9/13/2004)
    12:27 PM, Eastern Standard Time
    *Uptime:
    12:27:10 up 0 days, 0:02:16

    *Path:
    C:\FINDnFIX
    ----------------------------------------------------
    »»Member of...: ("ADMIN" logon + group match required!)

    User is a member of group OFFICE\None.
    User is a member of group \Everyone.
    User is a member of group BUILTIN\Administrators.
    User is a member of group BUILTIN\Users.
    User is a member of group NT AUTHORITY\INTERACTIVE.
    User is a member of group NT AUTHORITY\Authenticated Users.
    User is a member of group \LOCAL.
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    Group BUILTIN\Administrators matches list.
    Group BUILTIN\Users matches list.

    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

    User: [OFFICE\Sharon McCormack], is a member of:

    BUILTIN\Administrators
    \Everyone

    Running in WORKSTATION MODE.

    SystemDrive is C:
    SystemRoot is C:\WINDOWS
    Logon Domain is OFFICE
    Administrator's Name is Sharon McCormack
    Computer Name is OFFICE
    LOGON SERVER is \\OFFICE

    »»»»»»»»»»»»»»»»»»*** Note! ***»»»»»»»»»»»»»»»»
    The list will produce a small database of files that will match certain criteria.
    Ex: read only files, s/h files, last modified date. size, etc.
    The filters provided and registry scan should match the
    corresponding file(s) listed.
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Unless the file match the entire criteria, it should not be pointed to remove
    without attempting to confirm it's nature!
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    At times there could be several (legit) files flagged, and/or duplicate culprit file(s)!
    If in doubt, always search the file(s) and properties according to criteria!

    The file(s) found should be moved to \FINDnFIX\"junkxxx" Subfolder

    ______________________________________________________________________________
    ***YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***
    ______________________________________________________________________________

    ......Scanning for file(s)...
    *Note! The list(s) may include legitimate files!
    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

    »»»»» (*1*) »»»»» .........
    »»Read access error(s)...

    C:\WINDOWS\SYSTEM32\COMFCPA.DLL +++ File read error
    \\?\C:\WINDOWS\System32\COMFCPA.DLL +++ File read error

    »»»»» (*2*) »»»»»........
    COMFCPA.DLL Can't Open!

    »»»»» (*3*) »»»»»........

    C:\WINDOWS\SYSTEM32\
    comfcpa.dll Thu Jun 24 2004 11:28:08a A...R 57,344 56.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 57,344 bytes 56.00 K

    unknown/hidden files...

    C:\WINDOWS\SYSTEM32\
    mfc42.dll Wed Aug 4 2004 3:56:42a A.SH. 1,028,096 1004.00 K
    msvcirt.dll Wed Aug 4 2004 3:56:44a A.SH. 54,784 53.50 K
    msvcp60.dll Wed Aug 4 2004 3:56:44a A.SH. 413,696 404.00 K
    oleaut32.dll Wed Aug 4 2004 3:56:44a A.SH. 553,472 540.50 K

    4 items found: 4 files, 0 directories.
    Total of file sizes: 2,050,048 bytes 1.95 M

    »»»»» (*4*) »»»»».........
    Sniffing..........
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\COMFCPA.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MFC42.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MSVCIRT.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MSVCP60.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\OLEAUT32.DLL
    SNiF 1.34 statistics

    Matching files : 5 Amount in bytes : 2107392
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»»»(*5*)»»»»»
    ¯ Access denied ® ..................... COMFCPA.DLL .....57344 24.06.2004

    »»»»»(*6*)»»»»»
    fgrep: can't open input C:\WINDOWS\SYSTEM32\COMFCPA.DLL

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
    »»»»»Search by size...
    *List of files and specs according to 'size' :
    *Note: Not all files listed here are infected, but *may include* the
    name and spces of the offending file...
    ___________________________________________________________________________
    Path: C:\WINDOWS\SYSTEM32 Including: *.DLL

    123. Comfcpa Dll 57,344 . . R . A 6-24-04 11:28 am
    268. Dpwsockx Dll 57,344 . . . . A 8-04-04 3:56 am
    765. Msasn1 Dll 57,344 . . . . A 8-04-04 3:56 am
    233. Dmloader Dll 35,840 . . . . A 8-04-04 3:56 am
    431. Imgutil Dll 35,840 . . . . A 8-04-04 3:56 am
    1338. Umandlg Dll 35,840 . . . . A 8-04-04 3:56 am
    263. Dpvacm Dll 21,504 . . . . A 8-04-04 3:56 am
    321. Feclient Dll 21,504 . . . . A 8-04-04 3:56 am

    ____________________________________________________________________________
    *By size and date...


    C:\WINDOWS\SYSTEM32\
    comfcpa.dll Thu Jun 24 2004 11:28:08a A...R 57,344 56.00 K
    dpwsockx.dll Wed Aug 4 2004 3:56:42a A.... 57,344 56.00 K
    msasn1.dll Wed Aug 4 2004 3:56:42a A.... 57,344 56.00 K

    3 items found: 3 files, 0 directories.
    Total of file sizes: 172,032 bytes 168.00 K

    C:\WINDOWS\SYSTEM32\
    dmloader.dll Wed Aug 4 2004 3:56:42a A.... 35,840 35.00 K
    imgutil.dll Wed Aug 4 2004 3:56:42a A.... 35,840 35.00 K
    umandlg.dll Wed Aug 4 2004 3:56:46a A.... 35,840 35.00 K

    3 items found: 3 files, 0 directories.
    Total of file sizes: 107,520 bytes 105.00 K

    C:\WINDOWS\SYSTEM32\
    dpvacm.dll Wed Aug 4 2004 3:56:42a A.... 21,504 21.00 K
    feclient.dll Wed Aug 4 2004 3:56:42a A.... 21,504 21.00 K

    2 items found: 2 files, 0 directories.
    Total of file sizes: 43,008 bytes 42.00 K

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\COMFCPA.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL
    SNiF 1.34 statistics

    Matching files : 3 Amount in bytes : 172032
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\UMANDLG.DLL
    SNiF 1.34 statistics

    Matching files : 3 Amount in bytes : 107520
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL
    SNiF 1.34 statistics

    Matching files : 2 Amount in bytes : 43008
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»


    BHO search and other files...

    fgrep: can't open input C:\WINDOWS\SYSTEM32\COMFCPA.DLL
    **File C:\WINDOWS\SYSTEM32\DMGA.DLL
    000020E4: 25 25 25 30 32 78 00 00 . 00 00 00 00 C0 82 05 B3 %%%02x.. ....À‚.³


    No matches found.

    "C:\WINDOWS\SYSTEM32\"
    dmga.dll Sep 10 2004 31744 "dmga.dll"
    rtipxmib.dll Aug 4 2004 31744 "rtipxmib.dll"

    2 items found: 2 files, 0 directories.
    Total of file sizes: 63,488 bytes 62.00 K

    *sp.html found in temp folder:
    --a-- - - - - - 7,976 09-10-2004 sp.html
    File: <C:\DOCUME~1\SHARON~1\LOCALS~1\Temp\sp.html> CRC-32 : 93866C48 MD5 : CE5B5B5B DFD4A959 9F4A95C7 6FA46BD2
    *Filter keys search...
    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html
    CLSID = {B2109648-EECD-4A9E-ABAE-86580AEF0B96}

    HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain
    CLSID = {B2109648-EECD-4A9E-ABAE-86580AEF0B96}

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»
    »»Size of Windows key:
    (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

    Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 448

    »»Checking for AppInit_DLLs (empty) value...
    ________________________________
    !"AppInit_DLLs"=""!

    Value does not match
    ________________________________

    »»Comparing *saved* key with *original*...

    REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)

    Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).

    Value "AppInit_DLLs" in key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" has different lengths (1 vs 32)

    »»Dumping Values........
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    AppInit_DLLs = (*** MISSING TRAILING NULL CHARACTER ***)
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710

    »»Security settings for 'Windows' key:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    (ID-NI) ALLOW Read BUILTIN\Users
    (ID-IO) ALLOW Read BUILTIN\Users
    (ID-NI) ALLOW Full access BUILTIN\Administrators
    (ID-IO) ALLOW Full access BUILTIN\Administrators
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER

    Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    Read BUILTIN\Users
    Full access BUILTIN\Administrators
    Full access NT AUTHORITY\SYSTEM



    »»Performing string scan....
    00001150: vk @ f AppInit_DLLs G
    00001190: C : \ W I N D O W S \ S y s t e m 3 2 \ c o m f c p a . d l
    000011D0:l . d l l d l l m p . d l l l h vk 0
    00001210: UDeviceNotSelectedTimeout 1 5 P 9 0
    00001250: vk ' zGDIProcessHandleQuota" vk
    00001290: Spooler2 y e s _ h P vk
    000012D0: 5swapdisk vk @ . TransmissionRetr
    00001310:yTimeout h P 8 vk ' W
    00001350:USERProcessHandleQuotau
    00001390:
    000013D0:
    00001410:
    00001450:
    00001490:
    000014D0:
    00001510:
    00001550:
    00001590:
    000015D0:

    ---------- WIN.TXT
    fùAppInit_DLLs֍æG˜ÿÿÿC
    --------------
    --------------
    $01180: AppInit_DLLs
    $01217: UDeviceNotSelectedTimeout
    $01267: zGDIProcessHandleQuota
    $01300: TransmissionRetryTimeout
    $01350: USERProcessHandleQuotau
    --------------
    --------------
    C:\WINDOWS\System32\comfcpa.dll
    --------------
    --------------
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""
    "DeviceNotSelectedTimeout"="15"
    "GDIProcessHandleQuota"=dword:00002710
    "Spooler"="yes"
    "swapdisk"=""
    "TransmissionRetryTimeout"="90"
    "USERProcessHandleQuota"=dword:00002710

    .............
    A handle was successfully obtained for the
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows key.
    This key has 0 subkeys.
    The AppInitDLLs value exists and reports as 64 bytes, including the 2 for string termination.

    [AppInitDLLs]
    Ansi string : "C:\WINDOWS\System32\comfcpa.dll"
    0000 43 00 3a 00 5c 00 57 00 49 00 4e 00 44 00 4f 00 | C.:.\.W.I.N.D.O.
    0010 57 00 53 00 5c 00 53 00 79 00 73 00 74 00 65 00 | W.S.\.S.y.s.t.e.
    0020 6d 00 33 00 32 00 5c 00 63 00 6f 00 6d 00 66 00 | m.3.2.\.c.o.m.f.
    0030 63 00 70 00 61 00 2e 00 64 00 6c 00 6c 00 00 00 | c.p.a...d.l.l...
    -----------------------

    »»»»»»Backups list...»»»»»»
    12:34:18 up 0 days, 0:09:24
    -----------------------
    Mon 13 Sep 04 12:34:18


    C:\FINDNFIX\
    keyback.hiv Fri Sep 10 2004 12:49:48p A.... 8,192 8.00 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 8,192 bytes 8.00 K

    C:\FINDNFIX\KEYS1\
    winkey.reg Fri Sep 10 2004 12:49:50p A.... 287 0.28 K

    1 item found: 1 file, 0 directories.
    Total of file sizes: 287 bytes 0.28 K

    *Temp backups...

    "C:\Documents and Settings\Sharon McCormack\Local Settings\Temp\Backs2\"
    keyback2.hi_ Sep 10 2004 8192 "keyback2.hi_"
    winkey2.re_ Sep 10 2004 287 "winkey2.re_"

    2 items found: 2 files, 0 directories.
    Total of file sizes: 8,479 bytes 8.28 K
    -D---- JUNKXXX 00000000 12:49.48 10/09/2004
    A----- STARTIT .BAT 00000060 12:27.08 13/09/2004

    ________________________________________________________________________________
    ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
    AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
    MINIMAL REQUIREMENTS INCLUDE:
    _________XP HOME/PRO; SP1; IE6/SP1
    _________2K/SP4; IE6/SP1
    ________________________________________________________________________________
    »»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»
    -----END------
    Mon 13 Sep 04 12:34:26
    
     
  2. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Hi SharonMc

    Welcome to TSG! :)

    Be sure to Follow the next set of steps carefully, in the exact order specified.

    ***FIRST YOU NEED TO DISABLE YOUR ACTIVE ANTI VIRUS PROTECTION TO AVOID CONFLICTS!***

    Get ready to restart:
    First doubleClick on the FIX.bat file in the C:\FINDnFIX\Keys1 folder.
    Wait for the popup -Alert to restart your computer in 15 seconds.

    After the computer restarts and you are back in Windows, navigate to C:\Windows\System32 folder:
    Locate and select the COMFCPA.DLL file (as it will be visible)
    And use the folder's top menu and got to Edit >
    Move to Folder...
    Select the C:\FINDnFIX\junkxxx as destination and move
    the COMFCPA.DLL there.

    Note: Move the COMFCPA.DLL file and DO NOT move any other file except for that one to the junkxxx folder. Doublecheck to be sure you are moving the right file.
    -----------------------------------------------------------------------------------------------------------

    Now look in the C:\FINDnFIX folder and locate the RESTORE.bat file. Doubleclick it to run it.

    Wait for it to run and it will and it will produce a 'log1.txt' file! Copy that log and paste it here!

    -----------------------------------------------------------------------------------------------------------

    *Note:
    Do not change/move around or
    tamper with any of the file(s) folder(s) and path
    included in the 'FINDnFIX' folder.
     
  3. SharonMc

    SharonMc Thread Starter

    Joined:
    Sep 13, 2004
    Messages:
    7
    Thanks for the quick reply! Here's what I got.

    Mon 13 Sep 04 21:22:18

    »»»»»»»»»»»»»»»»»»***LOG2!(*updated *9/1*)***»»»»»»»»»»»»»»»»

    *System:
    Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600)
    *IE version:
    6.0.2900.2180 SP2

    The type of the file system is NTFS.

    ___________________________________________
    !!Restoring backups!!

    The operation completed successfully

    The operation completed successfully
    21:22:14.06 Mon 09/13/2004
    ___________________________________________

    *Local time:
    Monday, September 13, 2004 (9/13/2004)
    9:22 PM, Eastern Standard Time
    *Uptime:
    21:22:20 up 0 days, 0:03:54

    *path:
    C:\FINDnFIX
    Running in WORKSTATION MODE.

    SystemDrive is C:
    SystemRoot is C:\WINDOWS
    Logon Domain is OFFICE
    Administrator's Name is Sharon McCormack
    Computer Name is OFFICE
    LOGON SERVER is \\OFFICE
    ------------------------------------------


    This log will confirm if the file was successfully moved, and/or
    the right file was selected...

    Scanning for file(s) in System32...

    »»»»»»» (1) »»»»»»»

    »»»»»»» (2) »»»»»»»

    »»»»»»» (3) »»»»»»»

    No matches found.
    Unknown/hidden files...

    C:\WINDOWS\SYSTEM32\
    mfc42.dll Wed Aug 4 2004 3:56:42a A.SH. 1,028,096 1004.00 K
    msvcirt.dll Wed Aug 4 2004 3:56:44a A.SH. 54,784 53.50 K
    msvcp60.dll Wed Aug 4 2004 3:56:44a A.SH. 413,696 404.00 K
    oleaut32.dll Wed Aug 4 2004 3:56:44a A.SH. 553,472 540.50 K

    4 items found: 4 files, 0 directories.
    Total of file sizes: 2,050,048 bytes 1.95 M

    »»»»»»» (4) »»»»»»»
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\MFC42.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MSVCIRT.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MSVCP60.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\OLEAUT32.DLL
    SNiF 1.34 statistics

    Matching files : 4 Amount in bytes : 2050048
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»»»(5)»»»»»

    »»»»»(6)»»»»»

    »»»»»»» Search by size And Date...

    *List of files specs according to size:
    *Note: Not all files listed here are infected!
    ____________________________________________________________________________
    Path: C:\WINDOWS\SYSTEM32 Including: *.DLL

    267. Dpwsockx Dll 57,344 . . . . A 8-04-04 3:56 am
    764. Msasn1 Dll 57,344 . . . . A 8-04-04 3:56 am
    232. Dmloader Dll 35,840 . . . . A 8-04-04 3:56 am
    430. Imgutil Dll 35,840 . . . . A 8-04-04 3:56 am
    1337. Umandlg Dll 35,840 . . . . A 8-04-04 3:56 am
    262. Dpvacm Dll 21,504 . . . . A 8-04-04 3:56 am
    320. Feclient Dll 21,504 . . . . A 8-04-04 3:56 am

    ____________________________________________________________________________

    C:\WINDOWS\SYSTEM32\
    dpwsockx.dll Wed Aug 4 2004 3:56:42a A.... 57,344 56.00 K
    msasn1.dll Wed Aug 4 2004 3:56:42a A.... 57,344 56.00 K

    2 items found: 2 files, 0 directories.
    Total of file sizes: 114,688 bytes 112.00 K

    C:\WINDOWS\SYSTEM32\
    dmloader.dll Wed Aug 4 2004 3:56:42a A.... 35,840 35.00 K
    imgutil.dll Wed Aug 4 2004 3:56:42a A.... 35,840 35.00 K
    umandlg.dll Wed Aug 4 2004 3:56:46a A.... 35,840 35.00 K

    3 items found: 3 files, 0 directories.
    Total of file sizes: 107,520 bytes 105.00 K

    C:\WINDOWS\SYSTEM32\
    dpvacm.dll Wed Aug 4 2004 3:56:42a A.... 21,504 21.00 K
    feclient.dll Wed Aug 4 2004 3:56:42a A.... 21,504 21.00 K

    2 items found: 2 files, 0 directories.
    Total of file sizes: 43,008 bytes 42.00 K

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\DPWSOCKX.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\MSASN1.DLL
    SNiF 1.34 statistics

    Matching files : 2 Amount in bytes : 114688
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\DMLOADER.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\IMGUTIL.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\UMANDLG.DLL
    SNiF 1.34 statistics

    Matching files : 3 Amount in bytes : 107520
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL
    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    Sniffed -> C:\WINDOWS\SYSTEM32\DPVACM.DLL
    Sniffed -> C:\WINDOWS\SYSTEM32\FECLIENT.DLL
    SNiF 1.34 statistics

    Matching files : 2 Amount in bytes : 43008
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.DLL

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

    BHO search and other files...



    No matches found.

    "C:\WINDOWS\SYSTEM32\"
    rtipxmib.dll Aug 4 2004 31744 "rtipxmib.dll"

    1 item found: 1 file, 0 directories.
    Total of file sizes: 31,744 bytes 31.00 K


    No matches found.

    --*sp.html in temp folder was NOT FOUND!--

    *Filter keys search...
    REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/html' (2)

    --(*text/html Subkey was NOT FOUND!)--

    REGDMP: Unable to open key 'HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\text/plain' (2)

    --(*text/plain Subkey was NOT FOUND!)--

    »»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»*»»»

    »»»*»»» Scanning for moved file... »»»*»»»



    No matches found.

    Power SNiF 1.34 - The Ultimate File Snifferdog. Created Mar 16 1992, 21:09:15.

    SNiF 1.34 statistics

    Matching files : 0 Amount in bytes : 0
    Directories searched : 1 Commands executed : 0

    Masks sniffed for: *.*

    fgrep: no files found for C:\FINDNFIX\JUNKXXX\*.*


    Analyzer v1.36 by Boogie Copyright (C) 1997 ESP Team
    Files: C:\FINDNFIX\JUNKXXX\*.*
    Ä
    Ä


    Volume: None * DDIR * 9:24 pm | Mon, 9-13-04
    Ser #: 2CEF-8319 DOS Ver. 5.00 0% Used space
    Path: C:\FINDNFIX\JUNKXXX All files selected

    No files found.

    No. of files: 0 | List size: 0
    Disk size: 976.5 M | Actual spc: 0
    Bytes free: 976.5 M | Conserved space: 0

    File not found - C:\FINDnFIX\junkxxx\*.*

    CHK-SAFE.EXE Ver 2.51 by Bill Lambdin Don Peters and Robert Bullock.
    MD5 Message Digest Algorithm by RSA Data Security, Inc.

    File name Size Date Time MD5 Hash
    ________________________________________________________________________

    CRC-Cyclic Redundancy Checker, Version 1.20, 08-Feb-92, rtk

    C:\FINDNFIX\JUNKXXX
    No files found


    #######################################################
    *Known files are...
    --------------------
    File: ((56k; (57,344 bytes)
    CRC-32 : D5C9FB2E
    MD5 : C185B36F 9969D3A6 D2122BA7 CBC02249
    --------------------
    File: ((35k; (35,840 bytes)
    CRC-32 : 33081C8B
    MD5 : 1DE9A8E2 4C826006 7A479B09 577D9CAE
    --------------------
    File: ((21k; (21,504 bytes)
    CRC-32 : 2258F59E
    MD5 : EFEE2CB3 B342A351 51802356 9637F8E6
    #######################################################
    »»Permissions:
    ERROR: There are no more files. Directory "C:\FINDnFIX\junkxxx\."
    Permissions:
    Type Flags Inh. Mask Gen. Std. File Group or User
    ======= ======== ==== ======== ==== ==== ==== ================
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000003 tco- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000002 tc-- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000009 --o- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 00000002 tc-- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000009 --o- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 0000001B -co- 10000000 ---A ---- ---- BUILTIN\Administrators
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 0000001B -co- 10000000 ---A ---- ---- NT AUTHORITY\SYSTEM
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x OFFICE\Sharon McCormack
    Allow 0000001B -co- 10000000 ---A ---- ---- \CREATOR OWNER
    Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users
    Allow 0000001B -co- A0000000 R-X- ---- ---- BUILTIN\Users
    Allow 00000012 tc-- 00000004 ---- ---- --+- BUILTIN\Users
    Allow 00000012 tc-- 00000002 ---- ---- -w-- BUILTIN\Users

    Owner: OFFICE\Sharon McCormack

    Primary Group: OFFICE\None

    Directory "C:\FINDnFIX\junkxxx\.."
    Permissions:
    Type Flags Inh. Mask Gen. Std. File Group or User
    ======= ======== ==== ======== ==== ==== ==== ================
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x BUILTIN\Administrators
    Allow 0000001B -co- 10000000 ---A ---- ---- BUILTIN\Administrators
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x NT AUTHORITY\SYSTEM
    Allow 0000001B -co- 10000000 ---A ---- ---- NT AUTHORITY\SYSTEM
    Allow 00000010 t--- 001F01FF ---- DSPO rw+x OFFICE\Sharon McCormack
    Allow 0000001B -co- 10000000 ---A ---- ---- \CREATOR OWNER
    Allow 00000010 t--- 001200A9 ---- -S-- r--x BUILTIN\Users
    Allow 0000001B -co- A0000000 R-X- ---- ---- BUILTIN\Users
    Allow 00000012 tc-- 00000004 ---- ---- --+- BUILTIN\Users
    Allow 00000012 tc-- 00000002 ---- ---- -w-- BUILTIN\Users

    Owner: OFFICE\Sharon McCormack

    Primary Group: OFFICE\None




    »»Size of Windows key:
    (*Default-450 *No AppInit-398 *fake(infected)-448,504,512...)

    Size of HKEY_LOCAL_MACHINE\software\microsoft\Windows NT\CurrentVersion\Windows: 450

    »»Checking for AppInit_DLLs (empty) value...
    ________________________________
    !"AppInit_DLLs"=""!

    Value Matches
    ________________________________

    »»Comparing *saved* key with *original*...

    REGDIFF 2.1 - Freeware written by Gerson Kurz (http://www.p-nand-q.com)

    Comparing File #1 (Keys1\winkey.reg) with File #2 (HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows).

    No differences found.

    »»Dumping Values:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\DeviceNotSelectedTimeout SZ 15
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\GDIProcessHandleQuota DWORD 00002710
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Spooler SZ yes
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\swapdisk SZ
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\TransmissionRetryTimeout SZ 90
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\USERProcessHandleQuota DWORD 00002710
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs SZ

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
    DeviceNotSelectedTimeout = 15
    GDIProcessHandleQuota = REG_DWORD 0x00002710
    Spooler = yes
    swapdisk =
    TransmissionRetryTimeout = 90
    USERProcessHandleQuota = REG_DWORD 0x00002710
    AppInit_DLLs =

    »»Security settings for 'Windows' key:


    RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above
    Copyright (c) 1999-2001 Frank Heyne Software (http://www.heysoft.de)
    This program is Freeware, use it on your own risk!

    Access Control List for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    (ID-NI) ALLOW Read BUILTIN\Users
    (ID-IO) ALLOW Read BUILTIN\Users
    (ID-NI) ALLOW Full access BUILTIN\Administrators
    (ID-IO) ALLOW Full access BUILTIN\Administrators
    (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM
    (ID-IO) ALLOW Full access CREATOR OWNER

    Effective permissions for Registry key hklm\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:
    Read BUILTIN\Users
    Full access BUILTIN\Administrators
    Full access NT AUTHORITY\SYSTEM



    00001150: vk UDeviceNotSelecte
    00001190:dTimeout 1 5 P h vk ' zGDIProce
    000011D0:ssHandleQuota" 9 0 vk Spooler2
    00001210: y e s _ vk 5swapdisk h
    00001250: X vk . TransmissionRetryTimeout vk
    00001290: ' W USERProcessHandleQuotau h X
    000012D0: vk f AppInit_DLLs G
    00001310:
    00001350:
    00001390:
    000013D0:
    00001410:
    00001450:
    00001490:
    000014D0:
    00001510:
    00001550:

    ---------- NEWWIN.TXT
    fùAppInit_DLLs֍æG
    --------------
    --------------
    $0117F: UDeviceNotSelectedTimeout
    $011C7: zGDIProcessHandleQuota
    $01270: TransmissionRetryTimeout
    $012A0: USERProcessHandleQuotau
    $012F0: AppInit_DLLs
    --------------
    --------------
    No strings found.

    --------------
    --------------
    d.... 0 Sep 10 12:49 .
    d.... 0 Sep 10 12:49 ..

    2 files found occupying -1024 bytes


    ===============================================================================
    0 bytes 0 cps
    Files: 0 Records: 0 Matches: 0 Elapsed Time: 00:00:00.01

    VDIR v1.00
    Path: C:\FINDNFIX\JUNKXXX\*.*
    ---------------------------------------+---------------------------------------
    . <dir> 09-10-:4 12:49|.. <dir> 09-10-:4 12:49
    ---------------------------------------+---------------------------------------
    2 files totaling 0 bytes consuming 0 bytes of disk space.
    17299968 bytes available on Drive C: No volume label

    ...File dump...


    Detecting...

    C:\FINDnFIX\junkxxx
    Finished Detecting...
    =========================================
    0 C:\FINDnFIX\junkxxx (DIR Total)

    Owner No. Files Total Size
    =========================================
    ________________________________________________________________________________
    ***THE FIX IS NOT COMPATIBLE WITH EARLIER;UNPATCHED VERSIONS OF WIN2K'(SP3 and BELLOW)'
    AND/OR LAX OF SECURITY UPDATES AND SERVICE PACKS FOR ALL PLATFORMS!
    MINIMAL REQUIREMENTS INCLUDE:
    _________XP HOME/PRO; SP1; IE6/SP1
    _________2K/SP4; IE6/SP1
    ________________________________________________________________________________
    »»»»»»»»*** www10.brinkster.com/expl0iter/freeatlast/FNF/ ***»»»»»»»
    Mon 13 Sep 04 21:24:36
    -----END-----
     
  4. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    What happened to the COMFCPA.DLL file? You were supposed to move it to the junkxxx folder, but it's not in the junkxxx folder. :confused:
     
  5. SharonMc

    SharonMc Thread Starter

    Joined:
    Sep 13, 2004
    Messages:
    7
    Wow, I'm confused too because I did move it to the junkxxx folder. I followed your instructions to the letter.
     
  6. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    -Open the FINDnFIX\Files2< Subfolder:
    Run the -> ZIPZAP.bat file.
    It will quickly clean the rest and
    will make a copy of the bad file(s) in the same
    folder (junkxxx.zip) and open your email client with instructions:
    Simply drag and drop the 'junkxxx.zip' file from
    the folder into the mail message and submit
    to the specified addresses! Thanks!

    Note: Just skip the part about emailing the 'junkxxx.zip' file since the other file isn't in there.

    When done, restart your computer and
    Delete and entire C:\FINDnFIX folder and its subfolders
    and be sure the junkxxx folder
    was deleted (as part of the cleanup process)


    Click here to download CWShredder. Close all browser windows, click on the cwshredder.exe then click "Fix" (Not "Scan only") and let it do it's thing.

    When it is finished restart your computer.



    Go here and download Adaware SE.

    Install the program and launch it.

    First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

    From main window :Click Start then under Select a scan Mode tick Perform full system scan.

    Next deselect Search for negligible risk entries.

    Now to scan just click the Next button.

    When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

    Restart your computer.

    Come back here and post another Hijack This log and we'll get rid of what's left.
     
  7. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    After you do the above create a permanent folder somewhere like in My Documents and name it Hijack This.

    Now Click here to download Hijack This. Download and save the file to the Hijack This folder you just created.

    Click on Hijackthis.exe to launch the program.

    Click the "Scan" button when the scan is finished the scan button will become "Save Log" click that and save the log.

    The log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" then Paste the log back here in your next reply.
     
  8. SharonMc

    SharonMc Thread Starter

    Joined:
    Sep 13, 2004
    Messages:
    7
    Ok, here's the Hijack This log:

    Logfile of HijackThis v1.98.2
    Scan saved at 10:33:33 PM, on 9/13/2004
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\STOPzilla!\szntsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\devldr32.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Creative\ShareDLL\CtNotify.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\System32\CTsvcCDA.EXE
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Creative\ShareDLL\MediaDet.Exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\wanmpsvc.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Documents and Settings\Sharon McCormack\My Documents\Hijack This\hijackthis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.intergate.com/startpage
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://rd.yahoo.com/slv/ycheck/as/*http://search.yahoo.com/search?p=%s
    R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\WINDOWS\System32\SZIEBHO.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
    O4 - HKLM\..\Run: [STOPzilla] "C:\Program Files\STOPzilla!\Stopzilla.exe" /autorun
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
    O4 - HKCU\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe /0
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {6EA1AC90-FAC5-11D3-9725-0090279053A3} (MP3.com Beam-it) - http://signup.backstagevip.com/beamit/Beam-itActiveXControl.cab
    O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX25.cab
    O16 - DPF: {861DB4B6-3838-11D2-8E50-002018200E57} (MrSIDI Control) - http://images.myfamily.net/isfiles/downloads/MrSIDI.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://admin.pressplay.com/duet/registration/isetup.cab
    O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297C} - http://download.weatherbug.com/minibug/tricklers/AWS/minibuginstaller.cab
    O16 - DPF: {CA034DCC-A580-4333-B52F-15F98C42E04C} (Downloader Class) - https://www.stopzilla.com/_download/Auto_Installer/dwnldr.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{4B619DC3-983E-44E5-8B98-698641A0C698}: Domain = intergate.com
     
  9. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click "Fix checked"

    R3 - URLSearchHook: (no name) - _{8952A998-1E7E-4716-B23D-3DBE03910972} - (no file)

    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)

    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)


    Restart your computer.


    Turn off System Restore:

    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Check Turn off System Restore.
    Click Apply, and then click OK.

    Restart your computer, turn it back on and create a restore point.

    To create a restore point:

    Single-click Start and point to All Programs.
    Mouse over Accessories, then System Tools, and select System Restore.
    In the System Restore wizard, select the box next the text labeled "Create a restore point" and click the Next button.
    Type a description for your new restore point. Something like "After trojan/spyware cleanup". Click Create and you're done.


    Check this out for info on how to tighten your security settings and some good free tools to help prevent this from happening again.
     
  10. SharonMc

    SharonMc Thread Starter

    Joined:
    Sep 13, 2004
    Messages:
    7
    Ok...when I select system restore (when creating a restore point), I get a message "System Restore has been turned off. Do you want to turn on System Restore now?" Yes/No. I don't get a System Restore Wizard.
     
  11. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    You have to turn it back on first.
     
  12. SharonMc

    SharonMc Thread Starter

    Joined:
    Sep 13, 2004
    Messages:
    7
    oops...sorry! :rolleyes: It worked! Thank you so much!
     
  13. Flrman1

    Flrman1

    Joined:
    Jul 26, 2002
    Messages:
    46,329
    You're Welcome! :)

    I'm closing this thread. If you need it reopened please PM me or one of the other mods.

    Anyone else with a similar problem please start a "New Thread".
     
  14. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/273506

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice