Dankwsc

I ran sfc /scannow as you had instructed, however when I pushed enter after typing it in nothing ever happened...I then tried to run it through command prompt and when I typed it in it said: windows file protection could not initiate a scan of protected system files. The specific error code is 0x000006ba [the RPC server is unavailable. Please advise

No, not to my knowledge...

No such luck...None of these commands seem to work?

when I entered that in it said: The system cannot find the path specified.

When I typed the above in it said: 'DELTREE' is not recognizable as an internal or external command, operable program, or batch file. --Please advise

ok...do I just type delete after that?

Didom, -Did as you instructed and got to step #4...at that point I ran into a problem...Since this probelm started when my desktop comes up in safe mode I have roughly five seconds to click on something before my computer freezes(this is why it has been so difficult for me to do these things thus far)...therefore I am practically racing to get into the prgram files and by the time I get to the AWS folder it freezes and I cannot delete it...I know the folder is there, so is there any other way to access it, perhaps through command prompts, so I can delete it and finish the rest of your instruct

I will proceed with your instructions this evening, however in step #2 there is a good chance that the computer will freeze when I click on the start button ( even in safe mode) as it has done every time in the past...if this happens is there another way to access the hidden files and folders?

- no I did not install Weather Bug and I would hopefully like to remove all traces of AOL as well...Unfortunately I still cannot run in normal mode as the desktop icons still do not come up, and it still freezes immediately...even in safe mode, it seems to have defaulted back to what it was doing before we fixed with fixwareout yesterday...here is the fresh hijack this log....thanks ogfile of HijackThis v1.99.1 Scan saved at 7:51:02 AM, on 10/10/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\

It worked!!!! Here is the hijack log after fixwareout ran...Please advise. ile of HijackThis v1.99.1 Scan saved at 6:56:01 PM, on 10/9/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\fixwareout\SUB\BFU.exe C:\hijackthis.exe O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program

I am able to download BFU to the desktop, but everytime I try to save to the C drive it freezes. Everytime I run fixwareout it says it is downloading BFU.

dk, --I cannot run anything is normal mode...as the desktop icons do not even come up on the screen and it freezes as soon as the actual desktop appears...I tried to follow your instructions in safe mode by running BFU then fixwareout but as usual it only lets me start to run BFU then it freezes and I can't even try to run fixwareout...very frustrating...are we running out of options???

dk, -downloaded W2kfiles.exe...not sure it worked though since this "thing" keeps blocking everything we try( it says it is installed, but doesn't seem to do anything)...after doing that though I ran fixwareout again and this time it said: download Brute Force Unistaller at www.merijn.com -should I do this? Please advise

dk, -below is the hijack log: file of HijackThis v1.99.1 Scan saved at 7:15:38 PM, on 10/4/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Shane Dankworth\Desktop\HijackThis.exe O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27D

dk, -Here is the fixwareout report: Check for missing files ..... C:\WINNT\system32\AUTOEXEC.NT not there ..... End check for missing files ..... VXD Check REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers] "VDD"=hex(7):43,3a,5c,50,72,6f,67,72,61,6d,20,46,69,6c,65,73,5c,41,6c,77,69,6c,\ 20,53,6f,66,74,77,61,72,65,5c,41,76,61,73,74,34,5c,61,73,77,4d,6f,6e,56,64,\ 2e,64,6c,6c,00,00 ..... End vxd check ..... please post this at the forum du to the fact that my computer freezes when I do more than one task at a time I will post the new hijack this log sho

Silent Runners.vbs", revision 40.1, http://www.silentrunners.org/ Operating System: Windows 2000 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "AIM" = "C:\PROGRA~1\AIM\aim.exe -cnetwait.odl" ["America Online, Inc."] "ares" = ""C:\Program Files\Ares Lite Edition\Ares.exe" -h" [file not found] "NCLaunch" = "C:\WINNT\NCLAUNCH.EXe" ["Northcode Inc."] "ctfmon.exe" = "ctfmon.exe" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "Synchroniz

dknoppix, did as you instructed, however, when I clicked start and typed "cmd" into the run type it froze...I then tried to enter your instructions in the "cmd" through "safe mode with command prompts"...it then said that "taskkill" is not recognized as an internal or external command, operable program or batch file...are there any other ways to access it?

dknoppix, -tried to delete "csvun.exe" in task manager as you instructed...unfortunately, it said: process could not be completed...access denied... nothing seems to be working...please advise...thanks!

dknoppix, Thanks...will do! Won't be able to post the results until tonight or tommorow as I have to download all programs from another computer till we can get the safe mode fixed. Thanks for your patience!

dknoppix, -Thanks for the instructions...Unfortunately I cannot seem to run any of the programs that you had me download except for CWShredder. Even when I'm working in safe mode my computer freezes and I cannot complete your instructions...Very frustrated...Please advise...Thanks!

Fortunately I was able to get a Logfile: Please Help gfile of HijackThis v1.99.1 Scan saved at 7:43:37 AM, on 9/28/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\csvun.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUMENTS AND SETTINGS\SHANE DANKWORTH\DESKTOP\HijackThis.exe R1 - HKCU\Software\Micr

Before computer froze, I noticed that my homepage would default to a Winn/32 file and then I got large text on my desktop saying that my computer may be infected...Now my computer freezes when I reboot and it even freezes in safe mode when I went to run a "Hijack This Log". How do I run a log if I cannot do anything in safe mode...Please help!! thanks in advance!

Insipid, -Solved the internet problem. Computer is running like new. Thanks for all your help. Don't know what I would have done withour your help. I am installing the programs that you had recommended so that this does not happen again!

Insipid, -It is running much better! I will proceed with your instructions. I am still however having problems getting on the internet. Could it be that all this software that I have added since the beggining is blocking my connection? Should I delete Hijack this, Ewido,etc. when we are all finished?

Insipid, -Did all that you had instructed. However, i did not fix: O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present---as I wasn't sure what that was. Should I still delete it or leave it alone. Here is the new log: Logfile of HijackThis v1.99.1 Scan saved at 9:20:26 PM, on 6/29/2005 Platform: Windows 2000 SP4 (WinNT 5.00.2195) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\spools