Printable View
First and foremost, I wanted to do a scan with HijackThis , but early this jam! I cannot explore my C drive it automatically opens the dialog "Open With", and when I do a "Right Click" it appears multiple symbol in place of "open", "explore". Unable to execute the Task Manager, is there any solution for this. I was hoping to run combofix on drive other then C: for solving the problem.
You have an infection that mug by usb. Connecting all your USB sticks and external hard drive, do not double click on it, make a right click then open. Download this tool sUBs: Double-click it and let it guide you. Open the workstation. Click on the Tools menu at the top right and then Folder Options. In the new window, click the View tab at the top. Checkmark in the list "Show hidden files". Throws "hide protected system files to use (recommended)". You'll receive a message that tells you that it can damage the system, do not keep account. Open the workstation. Right click on the hard drive that you cannot open. Choose Open from the pull down menu. Look for a file autorun.inf, RavMon.exe, AdobeR.exe Remove it by right clicking then delete. Repeat on all disks that you cannot open. Post a report hiajckthis. And the thing related to running combofix other then C: is not required for that.
Thank you for coming to me rescue. First, in the "folder options" I cannot select "A Unhide hidden folders." Only the "do not display" must be legible. And yet, these are only symbols! (So it's a guess). Similarly, when I right-click: I have symbols instead of first 2 lines, "If I click on the first (which should be" open "), the dialog open with opens.
We will try to lift restrictions Task Manager. Download the Zeb-Restore here: Save this file on the desktop. Right click Zeb-Restore.zip then goes on to extract all and chosen as the site registration desk. Open the folder ZR_1.0.0.37. Double-click on Zeb restore.exe Check the box to click on Task Manager Restore. Do not check any other box without our notice! Restart your computer for the change is supported. Furthermore: Download ComboFix.exe (by sUBs). Double click ComboFix.exe tape by a valid entry to start the scan. When the scan is completed, a report will appear.
For solving this problem, right click on the desktop and then goes on again then open a text document. Copy / paste it into notepad that is quote
Then click on File / Save As. Choose the desktop as a place of registration. A Type > All files, Give it the name fixme.reg click Save leave the notepad. Right click on Merge fixme.reg selected in the list, accept the merger with the registry. Try to restart in Safe Mode.Quote:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ SafeBoot \ Minimal \ (4D36E967-E325-11CE-BFC1-08002BE10318)]
@ = "DiskDriver"
Spyware or other symbol that displays in place of some function (on the right click in the display option). Should I try to send you a report with HidjackThis. It's perfect, after the last manip. I managed to open my drive (for CE PC there). The symbols on the right click Appears To be gone. But they are always present in the folder options ("do not show hidden files" is replaced by symbols, and the line "show hidden files does not exist"?)
Open another notepad and glues them what is in quote:
Save this file on the desktop anywhere else! File name: CFScript. File type: all files. Click Save. Exit Notepad. Then move the txt the file over the combofix and drop there. A blue window will appear: the message that appears (Type 1 to continue, or 2 to abort), tape 1 then valid. Wait time of scan office will disappear several times: it is normal! Do not touch anything until the scan is not finished! Once the scan is completed, a report will appear: post its contents.Quote:
File::
C: \ WINDOWS \ System32 \ Systom.exe
Registry:
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run]
"Crsss" =-
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows nt \ currentversion \ image file execution options \ mmc.exe]
Debugger =-
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows nt \ currentversion \ image file execution options \ NAVSetup.exe]
Debugger =-
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows nt \ currentversion \ image file execution options \ rfwProxy.exe]
Debugger =-
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows nt \ currentversion \ image file execution options \ UpLive.EXE.exe]
Debugger =-
[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows nt \ currentversion \ image file execution options \ zxsweep.exe]
Debugger =-