Over 1 million tech questions and answers.

internet explorer cannot find file:///c:/secure32.html

Q: internet explorer cannot find file:///c:/secure32.html

My IE explorer wont let me change the home page and this error message pops up. I am pretty sure I picked up a virus but Mcafee did not detect it. I have run adaware programs without success.

recent items installed include
autosys.exe
adobelmsvc
rocdcur
hhtiscb
cfhbjd

my log is

Logfile of HijackThis v1.99.1
Scan saved at 4:49:48 PM, on 1/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Office keyboard utility\1.2\nhksrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Dantz\Retrospect\retrorun.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ShopSafe Browser Helper Object - {333F6B96-3992-4D58-A499-145A10FE48C3} - C:\WINDOWS\system32\BhoSSafe.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [AutoSys] C:\WINDOWS\system32\autosys.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\neoteris\secure application manager\samnsp.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab
O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} (Macromedia Authorware Web Player Control) - https://www.cchs.net/onlinelearning/...rs/awswaxf.cab
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - https://portal.harthosp.org/nfuse/Ci...a32/wficat.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {42C9E5EE-DA49-49B4-8ECC-1CAB1C51A2AB} (HomePrintingCtrl Class) - http://www.kodakgallery.com/download...1/axhomepr.cab
O16 - DPF: {46CF8BCA-84A1-4437-847A-DC29496E01A5} (ISiteNonVisual Control 3.3) - https://connect.jeffersonradiology.c...1.116,CT=java+
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://connect.jeffersonradiology.c...terisSetup.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {734F0ACB-CB01-4426-A8AB-A496C2583A40} (DesktopSync Class) - https://connect.jeffersonradiology.c...ecast,CT=java+
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {A422C32F-5082-4429-8575-B8BF83CF9E37} (ISiteUpgrade Control) - https://connect.jeffersonradiology.c...ecast,CT=java+
O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/5...l/gtdownls.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {EF3D42E2-8BB3-11D3-A415-00105A179C91} (IDXradRWebWord.WebWord) - https://connect.jeffersonradiology.c...ecast,CT=java+
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Office keyboard utility\1.2\nhksrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\retrorun.exe
O23 - Service: Retrospect Helper - Dantz Development Corporation - C:\Program Files\Dantz\Retrospect\rthlpsvc.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

RELEVANCY SCORE 200
Preferred Solution: internet explorer cannot find file:///c:/secure32.html

I recommend downloading and running DAP. It can help sort out any driver and firmware related issues on your system

It's worked out well for many of us in the past.

You can download it direct from this link http://downloaddap.org. (This link will open the download page of DAP so you can save a copy to your computer.)

A: internet explorer cannot find file:///c:/secure32.html

Hello raymanu and welcome to TSF,

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out these instructions.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

*************************************************************

Please download SmitfraudFix (by S!Ri) to your Desktop.

------------------------------------------------------------------

Download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"

Install AVG Anti Spyware
Double-click the icon on Desktop to launch AVG
On the top of the main screen click Shield
Click the word active to change it to inactive
On the top of the main screen click Update.
Then click on Start Update. The update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under "Reports"Select "Automatically generate report after every scan"
Un-Select "Only if threats were found"

When you have finished updating, EXIT AVG Anti Spyware. Do Not run a scan just yet, we will shortly.

------------------------------------------------------------------

Download and install CleanUp! but do not run it yet. (Not Recommended for XP64).


*************************************************************

Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.

------------------------------------------------------------------

Double-click on SmitfraudFix.exe to start the tool.
Select option #2 - Clean by typing 2 and press Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : " Registry cleaning - Do you want to clean the registry?" answer Yes by typing Y and hit Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question " Replace infected file?" by typing Y and hit Enter.

A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually. Reboot into Normal Windows.

The tool will create a log named rapport.txt in the root of your drive, eg: Local Disk C: (C:rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

______________________________

*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! or move them to a permanent location.

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "Options..."
*Move the arrow down to "Custom CleanUp!"
*Put a check next to the following:Empty Recycle Bins
Delete Cookies
Delete Prefetch files
Cleanup! All Users
Click on the "Temporary Files" and uncheck the box for "Scan drives for file matching" if it's checked.
Click OK
Press the CleanUp! button to start the program. Do NOT reboot/logoff when prompted.
______________________________

Next go to Control Panel click Display>Desktop>Customize Desktop>Web> Now, Uncheck Everything and delete if present:
? "Security Info"
? "Warning Message"
? "Security Desktop"
? "Warning Homepage"
? "Desktop Uninstall"

Also make sure the 'Lock desktop items' box is unticked. Click OK, and then Click Apply, then OK.
______________________________

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Run AVG Anti-Spyware with it's updated definitions: IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:
Run AVG Anti-Spyware with it's updated definitions:(...it's important that all windows must be closed) Click Scanner
Click on the Scan tab
Click Complete System Scan to begin scanning.
Once the scan is complete do the following:
If you have any infections you will prompted, **Please ensure it is set to Quarantine then select "Apply all actions"
Once finished, click the Save report button, then click Save Report As and save it to your desktop. (make sure to remember where you saved that file, this is important).
**AVG Anti-Spyware is compatible with most AV and anti-spyware products, and the free version will continue to be useful as a second anti-malware scanner.

------------------------------------------------------------------

Reboot into Normal Mode.

------------------------------------------------------------------

Double-click on SmitfraudFix.exe to start the tool.
Select option #3 - Delete Trusted zone by typing 3 and press Enter
Answer Yes to the question "Restore Trusted Zone ?" by typing Y and hit Enter.

Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.

------------------------------------------------------------------

Please run this online scan to search for any other files that may be lurking. It can take some time, so please be patient and allow it to run it's full course:

Perform an online scan with Internet Explorer with Panda ActiveScan Click on located at the bottom of the page.
A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*
Begin the scan by selecting If it finds any malware, it will offer you a report.
Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
Click on then click
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

------------------------------------------------------------------

Then post the following logs in your next reply...

c:\rapport.txt
AVG A/S log
Panda log
Hijackthis log

Read other 13 answers
RELEVANCY SCORE 100.8

this is my first time using a forum and so i dont know exactly what im doing but i recently got a virus of some sort and i cant seem to get my system back to normal. if someone could talk me through the process of using hijack this so maybe you can figure out whats wrong. thanks

A:cannot find file secure32.html and can't change homepage, never done this before

Hello bmx-rider8 and welcome to TSF

I suggest you follow the steps in the following link
Microbell's 5 Steps

Read other 19 answers
RELEVANCY SCORE 80.8

HTML file for reproducing:
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<label for="pet-select">Choose an item:</label>
<select name="list" id="selectId">
<option disabled value="text hello">Item 01</option>
<option value="item02">Item 02</option>
<option value="item03">Item 03</option>
<option disabled="Redundant value" value="item04">Item 04</option>
<option value="item05">Item 05</option>
</select>

<br>
<button id="btnId" onclick="getInfo()">INFO</button>
<br>
<br>
<div id="resultId">RESULT</div>

<script>
function getInfo(){
var selectCtrl = document.getElementById('selectId');
var options = selectCtrl.options;
var textCtrl = document.getElementById('resultId');

for (var i = 0; i < options.length; ++i){
var option = options[i];
var tmpTxt = '\n//=====\n';
tmpTxt += 'option.attributes: ' + option.attributes + '[' + i + ']\n';
tmpTxt += 'option.text = ' + option.text + '\n';
tmpTxt += 'option.disabled = ' + option.disabled + '\n';
tmpTxt += 'option.hideFocus = ' + option.hideFocus + '\n';
tmpTxt += 'option.spellcheck = ' + option.spellc... Read more

Read other answers
RELEVANCY SCORE 76.8

while opening int explorer, i get the msg "cannot find 'file:///c:/secure32.htm'"

I HAVE POSTED MY SmitFraudFix v2.132 LOG AT THE BOTTOM
I HAVE POSTED MY HIJACK THIS LOG BELOW

my os is WIN XP SP2,
INTRNT EXPLORER 6,
P4, 1.9 GHZ, 250MB DDR,
ANTIVIRUS IS SYMANTEC CORPORATE,
WINDOWS FIREWALL.

Logfile of HijackThis v1.99.1
Scan saved at 3:23:31 AM, on 30/12/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchosts.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\msasvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\{40C5E138-076B-1033-0823-050831040001}\Update.exe
C:\WINDOWS\system32\srshost.exe
C:\WINDOWS\... Read more

A:cannot find 'file:///c:/secure32.htm'

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
 

Read other 3 answers
RELEVANCY SCORE 70.4

Hi,
We have a COM dll which when embedded in html file and ran on Internet Explorer (Windows 7) was working fine. We were able to make call to the APIs exposed by the COM dll.

    But recently, we installed the windows updates namely
KB3074886 and
KB3065822.   

    After this, whenever we are accessing the API's of this COM dll, we are getting an error "SCRIPT438: Object doesn't support this property or method: ".  So we tried uninstalling the above two updates and saw that we were
able to access the APIs of the COM dll perfectly fine. Only when these updates are installed we are facing the above said error.
            Can someone assist us in what may be going wrong here. It will be very helpful for us as it is important for us to run with this updates installed in our system.

Thanks in Advance,
Satya.


Satyanvesh D

Read other answers
RELEVANCY SCORE 69.6

Hi,
I have a HTML page contains normal paragraph text content of 45 MB size. When i try to open it in IE, it is consuming around 1GB  of memory and unable to open the file, crashes sometimes. Is the behavior is expected or is there any settings  in
IE to open large HTML file.


Thanks,
Bala

Read other answers
RELEVANCY SCORE 68.4

Hi,
my computer was infected with SpySherrif and I had Norton Antivrus which got rid of it. However I have the secure32.html problem... whenever i startup Internet explorer I get an error saying that it could not find c:\secure32.html. I tried looking online and used a couple of utilities to fix the problem (Killbox, cleanup) but my homepage is still stuck as secure32.html. Please help me fix this, I'm going nuts trying to figure it out.

here is the log file from hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 4:02:18 PM, on 1/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSched... Read more

A:secure32.html

Read other 6 answers
RELEVANCY SCORE 68.4

I got spy sheriff last night. It has hijacked my browser.
I went in safe mode and ran:
ccleaner
adaware
spybot
ewido
smitrem.exe(runthis.bat)
Here is my log from Ewido
---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 1:14:57 PM, 12/5/2005
+ Report-Checksum: 9F256EC4

+ Scan result:

C:\WINDOWS\hosts -> Trojan.Qhost.el : Cleaned with backup
C:\WINDOWS\sys.exe -> Downloader.Small.bfy : Cleaned with backup
C:\WINDOWS\tool2.exe -> Hijacker.Spywad.k : Cleaned with backup
::Report End

Please help me get rid of secure32.html
Thanks
 

A:secure32.html

Read other 16 answers
RELEVANCY SCORE 68.4

I have a virus/malware/modified regs/etc and one symptom is that I cannot access my system32 folder. This has been bothering me immensely. AVG doesn't fix anything, the computer simply restarts each time the c:\windows\system32 folder is opened or accessed. Also, each time I try to access Firefox, my system reboots--although, I can access newtwork resources, just not through a web browser.

I was able to remove 14 "serious threats" using AVG spyware removal, which were located in the system information folder under C:\windows\. The problem still exists.

There was also threats of "secure32.html." I hunted that out in regedit, and replaces the start page and default page with "about:blank." Not sure if this was a good thing to do, but it hasn't fixed anything--I still cannot access the web without my computer restarting.

Any help is very appreciated. Here, first, is my blacklight log:

01/17/07 15:10:16 [Info]: BlackLight Engine 1.0.55 initialized
01/17/07 15:10:16 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/17/07 15:10:16 [Note]: 7019 4
01/17/07 15:10:16 [Note]: 7005 0
01/17/07 15:10:19 [Note]: 7006 0
01/17/07 15:10:19 [Note]: 7011 1528
01/17/07 15:10:20 [Note]: 7026 0
01/17/07 15:10:20 [Note]: 7026 0
01/17/07 15:10:25 [Note]: FSRAW library version 1.7.1021
01/17/07 15:10:25 [Note]: 2000 1012
01/17/07 15:11:23 [Note]: 7007 0
And, secondly, my HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 3:00:10 PM, on 1/17/2007
Pla... Read more

Read other answers
RELEVANCY SCORE 68.4

Hi,
First of all I would like to thank you for any help you might provide, I understand there are many different threads, so thank you for helping me. Here is the story:
I downloaded a song or something and my antivirus stopped it, however ever since, my homepage has change into secure32.html. I can change it as many time as i want to but it keeps changing back to secure32.html.

Here is my hijackthis log....
Logfile of HijackThis v1.99.1
Scan saved at 11:03:10 PM, on 1/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus + Firewall 2007\TPSrv.exe
c:\program files\panda software\panda antivirus + firewall 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\s... Read more

A:Secure32.html HELP!!!!!

Read other 7 answers
RELEVANCY SCORE 68.4

hello i need some help with my internet everytime i cerneeact and open a IE window a error message pops up saying that a file is missing something to do with secure32.html and also i get loads of pop ups that my pop up blocker can only stop some what should i do to stop this

thanks for anythig you can do to help
 

A:secure32.html

Run HijackThis and click Do a system scan and save a log file
Your HijackThis log will open in Notepad. Post the contents of the log here

 

Read other 3 answers
RELEVANCY SCORE 68.4

I tried going into regedit and deleting all references to 'secure32.html' but they keep regenerating. I managed to get rid of the file itself, but now every time I try to open Internet Explorer, I get a message that it's unable to find the file 'secure32.html'. This is my biggest problem left, though I still have problems staying connected to the internet that I suspect might be the result of other problems in here.

Logfile of HijackThis v1.99.1
Scan saved at 307 PM, on 12/27/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\paytime.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\... Read more

A:secure32.html

Download & install - CleanUp.exe (not recommended for WinXP64)

Download KillBox v2.0.0.175.exe (it's important that you get version v2.0.0.175)

'UNPLUG'/DISCONNECT your computer from the Internet when you have finished downlaoding.
It is IMPORTANT that you don't miss a step & perform everything in the correct order.


Have HijackThis fix these:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O2 - BHO: (no name) - {398AFBFD-A54D-C5E0-CC40-BB9761570EA0} - (no file)
O2 - BHO: (no name) - {6F4F2234-7A1B-ED72-66D6-5E3DFF0CD3D0} - (no file)
O4 - HKLM\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone
O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone
O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Int... Read more

Read other 17 answers
RELEVANCY SCORE 67.6

Never mind, got it fixed after all.

thanks anyway.
 

Read other answers
RELEVANCY SCORE 67.6

HelloI've have as far as i can see the same problem as SABTIN. I have run ad-ware, spybot, AVG antivirus and still when i open IE i get an error message saying it cannot find file "c/:secure32.html. i was wondering if i should follow the instructions given to SABTIN or not.Please advise...Here's a copy of my latest Hijack This scan:Logfile of HijackThis v1.99.1Scan saved at 18:04:29, on 10/01/2007Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\SOUNDMAN.EXEC:\Program Files\ASUS\Probe\AsusProb.exeC:\Program Files\Java\jre1.5.0_10\bin\jusched.exeC:\Program Files\Windows Defender\MSASCui.exeC:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeC:\Program Files\CyberLink\PowerDVD\PDVDServ.exeC:\Program Files&... Read more

A:Removing Secure32.html

Hello there and welcome to Bleeping Computer's security forum.My name is David, I will be helping you with your log today.It is a good idea to print off these instructions:This will be useful as there is a possibility some of the instructions will need to be carried out where internet access is not available. You may also like to save these instructions in word/notepad to the desktop where they can be easily found for the same reasons as above. A print out of the instructions would be a good reference to make sure you don't yet lost.Also, it is important that you complete the instructions in the right order, and also that you don't miss any steps out!If you have any queries about the process or just general questions, just ask.Open hijackthis, click 'config' (bottom right) Choose the tab 'misc Tools' on top.Choose 'delete a file on reboot'. In the field, copy and paste the filepath a few lines below.Click open. Hijackthis will tell you that this file will be deleted on next reboot and if you want to reboot now.When asked if you want to reboot now, say No.:C:\WINDOWS\system32\msasvc.exeDo the same for the following files. When you delete the last one, hit "yes" when asked to reboot:C:\secure32.htmlC:\Program Files\Common Files\dc6_startupmon.exeC:\Program Files\Common Files\ers_startupmon.exeC:\WINDOWS\system32\autosys.exeAfter the reboot, start HijackThis, close all open windows leaving only Hijack... Read more

Read other 10 answers
RELEVANCY SCORE 67.6

I ran all the software and updates recommended in the first stickey. It got rid of quite a few malware and such, but I still get the

secure32.html is not here thing when I run IE. It always resets my homepage within a second of me changing it back.


Here is my logfile after running virus malware spyware scans. Feelfree to email me at ****** with any suggestions





Logfile of HijackThis v1.99.1
Scan saved at 11:20:48 AM, on 1/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\msasvc.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\Program Files\Int... Read more

A:secure32.html hijacker

Hi and welcome to TSF.

I am currently reviewing your log. Please note that this is under the supervision of an expert analyst, and I will be back with a fix for your problem as soon as possible.

You may wish to Subscribe to this thread (Thread Tools) so that you are notified when you receive a reply.

Please be patient with me during this time.

Read other 11 answers
RELEVANCY SCORE 67.6

Before I even start I want to thank the people in this forum for any help they might be able to give.

I've had this computer a couple years now and managed to stay clean but now my grandson somehow got it infected. I've read through several fixes on various forums and made several attempts to repair it,, but without success. It appears that every solution is oriented to specific HijackThis logs. I've already downloaded HijackThis, Killbox, Cleanup and AVG Free. Following is the HijackThis log I ran a few minutes ago. Thank you.

Logfile of HijackThis v1.99.1
Scan saved at 1:04:36 PM, on 1/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\svchosts.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
c:\Program Files\Common Files\Symant... Read more

A:Darn secure32.html got me!

Read other 16 answers
RELEVANCY SCORE 67.6

well i somehow got this problem and have searched the net for ways to get rid of it dowloaded so many programs to clean up pc ...gone thou regedit and got rid of the ones that had secure32 coneected to them..and now my home page works as normal..but now explorer dosnt work as it should and all the graphics are still fuzzy..spent a few days working on this and this is as close as i can get.......can someone please help......this is my log i hope i have done it right and given you want you need...i probly have alot more problems but secure32 and really stuffed things up at the moment.thanks in advance,oz herb.Logfile of HijackThis v1.99.1Scan saved at 5:40:12 PM, on 4/19/06Platform: Windows 98 SE (Win9x 4.10.2222A)MSIE: Unable to get Internet Explorer version!Running processes:C:\WINDOWS\SYSTEM\KERNEL32.DLLC:\WINDOWS\SYSTEM\MSGSRV32.EXEC:\WINDOWS\SYSTEM\MPREXE.EXEC:\WINDOWS\SYSTEM\mmtask.tskC:\WINDOWS\SYSTEM\RNAAPP.EXEC:\WINDOWS\SYSTEM\TAPISRV.EXEC:\PROGRAM FILES\GRISOFT\AVG FREE\AVGCC.EXEC:\PROGRAM FILES\GRISOFT\AVG FREE\AVGEMC.EXEC:\WINDOWS\EXPLORER.EXEC:\WINDOWS\SYSTEM\PSTORES.EXEC:\PROGRAM FILES\WINZIP\WINZIP32.EXEC:\WINDOWS\TEMP\HIJACKTHIS.EXEO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER... Read more

A:Secure32.html Problem

Hello oz_herb and welcome to the BC HijackThis forum. I see no signs of viruses or malware in the log. It is clean.

If the graphics problem only appears in IE then it is possible that IE needs to be installed. If it happens in other programs as well then it would point to the video drivers and those should be reinstalled.

For assistance with reinstalling IE try the Internet Browser forum. For assistance with reinstalling the video drivers the Audio and Video forum would be the best. Either of those forums can assist with non-malware relatedissues.

Cheers.

OT

Read other 1 answers
RELEVANCY SCORE 67.6

Hi
New to this forum...

On opening IE getting pop up menu: cannot 'find file:///c:/secure32.html'. Make sure the path or Internet address is correct.

Windows/system32
Can see autosys.sys sitting there along with msasvc.exe and wamy.dll which seem to arrived at the same time.

Have Norton Security 2007 running. IE and XP SP2.

Ready the previous posts and rather nervous so pls be gentle with me. Thanks in advance. Fingers crossed!

HiJackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 11:07:14, on 13/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\MXOALDR.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\Mixer.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HP... Read more

A:c:\secure32.html on IE start up

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
 

Read other 1 answers
RELEVANCY SCORE 67.6

I found this site via Google searching for help on Secure32.html. I downloaded a couple of files today that had virus/spyware, but ZoneAlarm had caught them. Or at least I thought. Evidently didn't catch all of it. Thanks to D_Trojanator for his reply to the "Solved: c:\secure32.html Virus". I've downloaded HiJackThis, KillBox and SmitfraudFix. Here's my log from HiJackThis:
Logfile of HijackThis v1.99.1
Scan saved at 10:40:32 AM, on 1/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Microsoft ActiveSync\wcescomm... Read more

A:Solved: Help With Secure32.html

Read other 14 answers
RELEVANCY SCORE 67.6

and what the heck is it, i noticed after trying to download a keygen/serial (never again) and now this has popped up i my C drive and it will not remove it, manually or by a spyware removal program..Help please... It doesn't seem to have any adverse affect's on the running of my PC or on my IE as various other site's ave suggested it can affect yur homepage prefrence's...

EDIT: Just ran Killbox and it seem's to have removed the hTML document...for now anyway!!! But what does it supposed to do?

Logfile of HijackThis v1.99.1
Scan saved at 18:23:10, on 25/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\progra~1\mcafee.com\vso\mcvsescn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee... Read more

A:HELP...how can I remove C:/secure32.html.....(HJT LOG)

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
 

Read other 1 answers
RELEVANCY SCORE 67.6

I am running Xp and I have 3 problems (may or may not be related).

1. Sometimes- when I attempt to access Internet Explorer, I receive an error message: "cannot find 'file"///C;secure:html" and then a page cannot be displayed message. Problem is intermittent and now I am browsing without problem.

2. Norton Internet security cannot run a liveupdate. It does not see that there is an internet connection although i have the Internet explorer window open and can verify that it is online.

3. Twice, screen has gone blue with a message that a physical dump is taking place. Once the PC reboots- I get the typical "windows has recovered from a serious error"

I have run a scan disk with no errors found. The HiJack This log will be pasted below.

Please help if you can!!

Logfile of HijackThis v1.99.1
Scan saved at 8:25:39 PM, on 11/9/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Com... Read more

A:HJT - secure32.html error

The HiJackThis program is installed into a temporary directory and this is not a recommended thing for it. Please un-install HijackThis and remove all log files from your computer and then re-download and re-install fromthe file shown below:

To download HJTsetup.exe To Download HijackThis go to the following: http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item5
Filename = 1137518044HJTsetup.exe
Save the file to your desktop.
Double click on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\HijackThis.
Continue to click Next in the setup dialog boxes until you get to the Select Additional Tasks dialog.
Put a check by Create a desktop icon then click Next again.
Continue to follow the rest of the prompts from there.
At the final dialog box click Finish and it will launch Hijack This.
Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
Click Save to save the log file and then the log will open in notepad.
At the top of the Notepad HJT log screen, hit Edit then Select All then click Edit and then click Copy doing that copies the text to the clipboard, you won't see it yet....
Come back here to this thread and Paste the log in your next reply. DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

A security expert should take a look at your log - please be patient.
 

Read other 2 answers
RELEVANCY SCORE 66.8

Over the weekend did something to my computer!! Computer is an HP approx. 5 years old. When trying to access Internet Explorer it says: file:///C:/Program%20Files/AOL%20Toolbar/welcome.html Make sure path or Internet address is correct. If I click OK it'll bring up IE screen and show the same message again. I click OK again and then click on "home" picture. IE will then bring up the home page it's set to. Suggestions on what I did or need to do is appreciated. IE was working before just fine.

A:Internet Explorer - Can't find file

Over the weekend did something to my computer!! And exactly what did you do?

Read other 2 answers
RELEVANCY SCORE 66.8

Hey People
i jsut registered yesterday night...
i have this problem when i open IE.. it says something about secure32.html cant be open i've scanned my system and it comes up with a trojan horse of some sort... sometime IE just freezes on me and i cant do anything so i have to restart my comp...
please advise with assistant.. thanks
 

A:Solved: C:/secure32.html problem

Read other 16 answers
RELEVANCY SCORE 66.8

I have detected secure32 and spyaxe viruses on my computer. I enclose HTJ log and Activescan log below. How could I get rid of them?
Activescan log:
Incident Status Location

Adware:adware/securityerror Not desinfected C:\Documents and Settings\hp\Ulubione\Antivirus Test Online.url
Adware:adware/secure32 Not desinfected C:\secure32.html
Adware:adware/spyaxe Not desinfected Windows Registry
Adware:Adware/Secure32 Not desinfected C:\secure32.html
Adware:Adware/Secure32 Not desinfected C:\WINDOWS\secure32.html
Hacktool:HackTool/OptixPatch Not desinfected D:\Instalacje\nwc.zip[patch.exe]

HTJ Log:

Logfile of HijackThis v1.99.1
Scan saved at 23:48:20, on 27.12.2005
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
d:\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
d:\Grisoft\AVGFRE~1\avgupsvc.exe
d:\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\crypserv.exe
d:\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
D:\lotus\notes\ntmulti.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program... Read more

A:Solved: secure32.html detected

Read other 8 answers
RELEVANCY SCORE 66.8

hi all, great to be here

i also have the same problem as emagine

"Cannot find 'file:///c:/secure32.html'. Make sure the path or Internet address is correct."

but when i tryed doing the same steps to solve the problem it didnt fix it.

here is my hijack this log

Logfile of HijackThis v1.71.2
Scan saved at 10:58:38, on 15/01/2007
Platform: Windows NT 5.00.2195

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page=c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page=c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL=c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL=http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console
O11 - Options group: [JAVA_SUN] Java (Sun)

this is a work computer running on windows 2000 so u see my... Read more

A:c:\secure32.html virus , not the same as emagine

Get the latest version of Hijack This here: http://www.majorgeeks.com/download3155.html
Post a new log
 

Read other 2 answers
RELEVANCY SCORE 66.8

I have recently found that my Internet Explorer is infected with some sort of trojan/virus or something of that sort. My homepage keeps reverting back to the site "c:\secure32.html" regardless of how many times I change it to anything else. When I try to open Internet Explorer, I receive an error message as followed,
"Cannot find 'file:///c:/secure32.html'. Make sure the path or Internet address is corredct."

I have read some other postings but I still am confused as to how to go about solving this problem. I supposed my computer is infected by more than one virus. I am using Windows XP . I have tried running Spybot-Search and Destroy and also my Symantec Antivirus and neither program has detected any problems. A free trial of a registry fixing program stated that there were some 600 registry errors. I'm not sure what that means but I am not ready to spend the $100 on some product that I don't even know if it will even solve anything.

If you could let me know how to go about solving this problem it would be greatly appreciated. Thank you.

Quik
 

A:Solved: c:\secure32.html Virus

Read other 16 answers
RELEVANCY SCORE 66.8

I hope someone can help me to be rid of secure32.html. I've followed other posts on the subject in the past few days and ran Ad-aware; ewido; smitRem; and Panda. They all found something and took care of it and I've saved the logs. But that was several days ago and I haven't been able to get someone knowledgeable to read my logs or HJT Log. I will most likely need to do it all over again. Can someone please help me?
 

A:Solved: Help needed to get rid of secure32.html

Read other 16 answers
RELEVANCY SCORE 66.8

When I am trying to open IE I am having this pop up menu: cannot 'find file:///c:/secure32.html'. Make sure the path or Internet address is correct.

Here is the HJ log

Logfile of HijackThis v1.99.1
Scan saved at 2:19:12 PM, on 1/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\msasvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\cjyvmpqr.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Common Files\{B0CF23F6-03E8-1033-0215-000620200001}\Update.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Ipwindows\ipwins.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 -... Read more

A:Solved: C:/secure32.html problem !!!

Read other 16 answers
RELEVANCY SCORE 66.8

hey

i have tried many solutions posted to others with the same problem but i cannot seem to fix mine.
here is a copy of my hijack this
Logfile of HijackThis v1.99.1
Scan saved at 10:57:47, on 13/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\msasvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\Copperhead\razerhid.exe
C:\Program Files\Common Files\Logitech\LCD Manager\lcdmon.exe
C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
C:\WINDOWS\system32\kernelex3.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDPOP3.exe
C:\Program Files\Common Files\Logitech\LCD Manager\Applets\LCDCountdown.exe
C:\Pr... Read more

A:secure32.html problem- have tried other solutions

hey

i have now scanned my computer with avg anti virus and avg spyware and found something called Trojan.small and Trojan.sinowal.bh and quarantined them, but this still does not help fix the secure32.html problem
any ideas?

Thanks a lot
 

Read other 2 answers
RELEVANCY SCORE 66.8

I get the blue screen with "Detected SPYware! System Error #384" with a bunch of other information that follows. in the address box it reads "C:\secure32.html" when I try to use IE. Along with this when my computer starts up I get 2 errors... The first is Run DLL32.exe- Bad Image, and the second is Error Loading 0s0s0raw.dll %1 is not a valid Win32 Application. I think the three are all related and branching from the same problem. Thank you in advance. Any help will be greatly appreciated. Logfile of HijackThis v1.99.1Scan saved at 12:20:45 AM, on 1/20/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\System32\Ati2evxx.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\WINDOWS\System32\QCONSVC.EXEC:\WINDOWS\system32\ZoneLabs\vsmon.exeC:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeC:\... Read more

A:System Error #384, Secure32.html

* Click here to download smitRem.exe. Save the file to your desktop. It is a self extracting file.Doubleclick the smitRem.exe and it will extract the files to a smitRem folder on your desktop. Do not do anything with it yet. You will run the RunThis.bat file later in safe mode.* Download the trial version of Ewido Security Suite here.Install ewido.During the installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".Launch ewidoIt will prompt you to update click the OK button and it will go to the main screenOn the left side of the main screen click updateClick on Start and let it update.DO NOT run a scan yet. You will do that later in safe mode.* Click here for info on how to boot to safe mode if you don't already know how.* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.* Restart your computer into safe mode now. Perform the following steps in safe mode:* Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.Wait for the tool to complete and disk cleanup to finish.* Run Ewido:Click on scannerClick Complete System Scan and the scan will begin.During the scan it will prompt you to clean files, click OKWhen the scan is finished, look at the bottom of the screen and click the Save report button.Save the report to your desktop* Go to Control Panel > Internet Options. Clic... Read more

Read other 1 answers
RELEVANCY SCORE 66.8

Hello,Didn't realise how bad spyware could be, so here I am!I have tried numerous antispyware programs recommended on this web and other reputable ones: Spy Sweeper, Windows Defender, CounterSpy and now am trying HijackThis. I've also removed ADS streams I found on my laptop with ADSSpy. Problem is the laptop keeps becoming reinfected after I remove all the found threats so the programs must be missing something. I also noticed that on some instances when I look at the users allowed for certain folders there is a "user" that is there for a split second and then disappears! I have also disabled System Restore but that doesn't help.Please help.Here is the last logfile from HijackThis.Logfile of HijackThis v1.99.1Scan saved at 03:36:18 PM, on 2007/01/08Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.5730.0011)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Windows Defender\MsMpEng.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared&... Read more

A:Hijackthis Log - Cannot Remove C:/secure32.html

Hi SABTIN, Welcome to Bleeping Computer !!You may wish to print out a copy of these instructions to follow while you complete this procedurePlease disable SpySweeper, as it may hinder the removal of some entries. You can re-enable it after you're clean.To disable SpySweeper:Open it Click Shield Settings on the right(or Shields on the left, depending what screen you're on)Click Internet Explorer and uncheck all itemsClick Windows System and uncheck all itemsClick Hosts File and uncheck all itemsClick Startup Programs and uncheck all items.Exit SpysweeperWhile TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.This is a two step process : First : Right click Spybot in the System Tray (looks like a calendar with a padlock symbol) Choose Exit Spybot S&D Resident Second : Open Spybot S&D Click Mode, check Advanced Mode In the Left Panel, Click Tools, then also in left panel, click Resident If your firewall raises a question, say OK UNcheck the box labeled Resident Tea-Timer and OK any prompts. Use File, Exit to terminate Spybot Reboot your machine for the changes to take effect. If you don't do it this way, the registry settings remain when you exit. In addition TeaTimer may put itself backWe need to disable your Windows Defender Real-time Protection as it may interfere... Read more

Read other 13 answers
RELEVANCY SCORE 66.8

Logfile of HijackThis v1.99.1Scan saved at 10:50:05 PM, on 25/11/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\ACS.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\WINDOWS\system32\DVDRAMSV.exeC:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\wdfmgr.exeC:\WINDOWS\System32\alg.exeC:\PROGRA~1\COMMON~1\Stardock\SDMCP.exeC:\Program Files\Stardock\Object Desktop\WindowBlinds\wbload.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\inet20003\services.exeC:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exeC:\Program F... Read more

A:Hijackthis Help - Please Help Diagnose - Secure32.html

Welcome to Bleeping Computer fortress79.After reviewing your log I see a few items that require our attention. Please print out the instructions here (or save it in Notepad) so that you can follow along more easily.1.) You need an Anti-Virus Program or you will continue to get infected! Please pick between - AVG Anti-Virus Free Edition or Anti-Vir. An Anti-virus program is a must have with any computer.Download/Install/update the selected Anti-virus program as required and run a full scan.Note: Only install one of the aboved recommended programs.Restart you computer.2.) Download smitRem.exe and save the file to your desktop.Double click on the file to extract it to it's own folder on the desktop.3.) Place a shortcut to Panda ActiveScan on your desktop.4.) Please download the trial version of Ewido Security Suite here:http://www.ewido.net/en/download/Please read Ewido Setup InstructionsInstall it, and update the definitions to the newest files. Do NOT run a scan yet.5.) If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:Ad-Aware SE SetupDon't run it yet!6.) Next, please reboot your computer in SafeMode by doing the following:Restart your computerAfter hearing your computer beep once during startup, but before the Windows icon appears, press F8.Instead of Windows loading as normal, a menu should appearSelect the first option, to run Windows in Safe Mode.7.) Now scan with HJT and place a ... Read more

Read other 2 answers
RELEVANCY SCORE 66.8

Logfile of HijackThis v1.99.1
Scan saved at 11:38:44 AM, on 2/2/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\OpenManage\Client\Iap.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\rundll32.exe
c:\windows\winsysban4.exe
C:\WINDOWS\system32\mdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\sophea\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\In... Read more

A:Spyware Secure32.html and websearch

Read other 6 answers
RELEVANCY SCORE 66.8

First time post so needless to say I have no idea what's wrong, only that I downloaded a package that screamed worm and stupidly opened it...Everyone makes mistakes I guess I was able to rid myself of SpySheriff thank God but both of my browsers now open on their own with ads and my pages are redirected every few seconds to ads. I've run eight different anti-spyware/virus programs and it hasn't stopped!! Logfile of HijackThis v1.99.1Scan saved at 3:47:19 AM, on 11/28/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\TGTSoft\StyleXP\StyleXPService.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Common Files\LightScribe\LSSrvc.exeC:\WINDOWS\Explorer.EXEc:\program files\mcafee.com\agent\mcdetect.exec:\PROGRA~1\mcafee.com\vso\mcshield.exec:\PROGRA~1\mcafee.com\agent\mctskshd.exec:\PROGRA~1\mcafee.com\vso\OasClnt.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEc:\program files\mcaf... Read more

A:Log Analysis Needed - Secure32.html

Hi,

The forums are really busy, that explains why logs get behind. We start with the oldest logs first. If you still need some help, please start with posting a new hijackthislog in this thread. Don't start with a new thread.
Then I'll take a look.

Read other 2 answers
RELEVANCY SCORE 66.8

I just experienced a massive infection. I was able to identify and remove look2me and spysheriff, but am still stuck with one last problem. Norton auto-protect is showing that my computer is attempting to send spam e-mail (viagra, sex sites, etc). None seem to be getting out (I don't run outlook or any other e-mail program), and the only reason I know it is happening is that Norton Auto-Protect is reporting that an attempt to send an e-mail has failed. These are being generated at a very high rate, 20 or so a minute, to a point that the Norton messages are bogging down my system. The only way I am able to use it is to turn off the 'scan outgoing e-mail' option in Norton. I have run ad-aware, ewido, stinger, and Housecall online scan (Panda would not run for me). I have Norton running, but I have not purchased the latest defs and it is out of date. I have also gone into msconfig and disabled anything that I did not think I needed. Any help is greatly apreciated. Here is the hijackthis log:Logfile of HijackThis v1.99.1Scan saved at 12:31:43 PM, on 11/22/2005Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exe... Read more

A:My Computer Is Trying To Spam....need Help - C:\secure32.html

Problem solved.....I did a complete windows reinstall. There was just too much that looked fishy for me to ever feel safe with it as is. Still curious what exactly it was, but I don't expect any effort put towards it now that I'm clean.

BTW, keep up the GREAT work all! This is my first personal infection, but I have used this site to help many many many other people.

Read other 1 answers
RELEVANCY SCORE 66.8

Here is my log. Ran Adaware scan, Ew, Killbox etc.. nothing works.

Logfile of HijackThis v1.99.1
Scan saved at 1:48:31 PM, on 5/18/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\svchost.exe
C:\DOCUME~1\Don\LOCALS~1\Temp\load44.exe
C:\WINDOWS\System32\wuauclt.exe
c:\krxbh.exe
c:\rgfkoh.exe
C:\WINDOWS\System32\msiexec.exe
c:\Program Files\fqbsqg.exe
c:\hjmmrf.exe
C:\Documents and Settings\Don\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Softwa... Read more

A:Solved: Spysheriff, Secure32.html....HELP!!!!

Read other 8 answers
RELEVANCY SCORE 66.4

I hope this is the right forum. Help with this will be greatly appreciated. Every time I turn on the computer a box titled Windows Internet Explorer displays the following message "Cannot find the 'file:\\\". Make sure the path or Internet Address correct." In addition, I am receiving error messages that state " (program) has encountered a problem and needs to close." The programs include RegCure, IE, and AdAware. Thanks.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:09:04 PM, on 6/23/2009Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v8.00 (8.00.6001.18702)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSvcHst.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSer... Read more

A:Windows Internet Explorer: Cannot find the 'file:///"...

Hello and welcome to Bleeping ComputerWe apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.??If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.If you have already posted a DDS log, please do so again, as your situation may have changed.Use the 'Add Reply' and add the new log to this thread.Thanks and again sorry for the delay.We need to see some information about what is happening in your machine.??Please perform the following scan:Download DDS by sUBs from one of the following links.??Save it to your desktop.DDS.scrDDS.pifDouble click on the DDS icon, allow it to run.A small box will open, with an explaination about the tool.??No input is needed, the scan is running.Notepad will open with the results.Foll... Read more

Read other 34 answers
RELEVANCY SCORE 66

internet explorer errors out when starting. message pops up with file:///c:/secure32.html' Make sure the path or Internet address is correct. also once this occurs cant get norton to open up unless restart computer. thanks for the help.
Logfile of HijackThis v1.99.1
Scan saved at 1:28:16 AM, on 12/31/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\HPConfig.exe
C:\Program Files\HPQ\Notebook Utilities\HPWirelessMgr.exe
C:\Program Files\Instant Message Grabber 2.x\IMGrabber2.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\carpserv.exe
C:\Program Files\HPQ\One-Touch\OneTouch.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Instant Message Grabber 2.x\IMGrabber2.exe
C:\Program Files\Instant Message Grabber 2.x\IMViewer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\The Weather Channel FW\Desktop Weather\D... Read more

A:secure32.html problems hijack log included

Read other 9 answers
RELEVANCY SCORE 66

Logfile of HijackThis v1.99.1Scan saved at 22:37:14, on 14/11/2005Platform: Windows XP (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 (6.00.2600.0000)Running processes:H:\WINDOWS\System32\smss.exeH:\WINDOWS\system32\csrss.exeH:\WINDOWS\system32\services.exeH:\WINDOWS\system32\lsass.exeH:\WINDOWS\system32\svchost.exeH:\WINDOWS\System32\svchost.exeH:\WINDOWS\System32\svchost.exeH:\WINDOWS\System32\svchost.exeH:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeH:\WINDOWS\system32\spoolsv.exeH:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exeH:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exeH:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exeH:\WINDOWS\System32\svchost.exeH:\Program Files\Spyware Doctor\sdhelp.exeH:\WINDOWS\System32\svchost.exeH:\WINDOWS\System32\wdfmgr.exeH:\WINDOWS\System32\wuauclt.exeH:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exeH:\Program Files\Spyware Doctor\swdoctor.exeH:\Program Files\PC Tools AntiVirus\PCTAV.exeH:\Program Files\PC Tools AntiVirus\ScanningProcess.exeH:\Program Files\PC Tools AntiVirus\Monitor.exeH:\Program Files\Windows Registry Repair Pro\RegistryRepairPro.exeF:\My Documents\My Recei... Read more

A:Hijackthis Log: Please Help Diagnose - Secure32.html Ieproxy.exe

has any one got any idea what i should do please!! i reli need some help

Read other 2 answers
RELEVANCY SCORE 66

Good afternoon all,

I'm hoping someone can help.

I've read on here that a few people seem to have had the same virus and I have tried to self diagnose it but to no avail.

I am getting the following error when ever I try to open up Internet Explorer.
"Cannot find 'file:///c:/secure32.html'. Make sure the path or Internet address is correct."

I have gotten round this so far by reinstalling Firefox and that is what I am using now to browse the net.

I have run AVG Antispyware and deleted a few trojans that were on my system but I can't seem to shake this one off.

I have tried to install IE7 but it blue screens during installation. I'm guessing this is as a result of the virus.

If anyone could help it would be much appreciated. Many thanks in advance,

Stuart

Here is my Hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 13:49:40, on 06/01/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\TDK Systems\Bluetooth Software\bin\btw... Read more

A:Solved: c:\secure32.html virus - autosys.exe

Read other 16 answers
RELEVANCY SCORE 65.6

Lately, I have been getting a Windows Internet Explorer message at computer start up...
"Cannot find 'file:///'. Make sure the path or internet address is correct".
This is not causing any problems that I can see so far after I close the message window but it is annoying to me to see this at every start up of my computer.
I have Windows XP Professional, SP3 on my PC. Could somebody help me to get rid of this message? Thank you.

Craig O2

I have attached a screen shot of the message to this email.
 

Read other answers
RELEVANCY SCORE 64.8

paytime.exe keeps showing up in my task manager and from what i researched, it poses a threat to my computer and i do not know how remove it. Also when using Internet Explorer something keeps changing my homepage to a html file on my C: drive entitled secure32.html which refers me to a spy sheriff program. i delete the html file it somehow reappears again when i restart my computer. please help!Logfile of HijackThis v1.99.1Scan saved at 2:06:53 AM, on 1/25/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\LEXBCES.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\LEXPPS.EXEC:\Program Files\Common Files\AOL\ACS\AOLAcsd.exeC:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\WINDOWS\System32\imapi.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\Program Files\Norton AntiVirus\navapsvc.exeC:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXEC:... Read more

A:Infected With Paytime.exe, Secure32.html And Possibly Other Viruses/worms Etc...

Hello,It's better to print out the next instructions or save it in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.It is also important you don't miss a step and perform everything in the right order!!I see Viewpoint installed.Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.ViewpointViewpoint ManagerViewpoint Media PlayerAre you aware that there is a Keylogger installed on your system?Did you install HomeKeylogger yourself? I strongly suggest you uninstall it because keyloggers you installed yourself are in general unwanted tools.http://securityresponse.symantec.com/avcen...ekeylogger.html* Please set your system to show all files; please see here if you're unsure how to do this.* Please download ATF Cleaner by Atribune to your desktop.Do not use it yet.Please download Ewido anti-malware ; it is a free version of the program.Install ewido security suiteWhen installing, under "Additional Options" uncheck..Install background guardInstall scan via context menuLaunch ewido by double-clicking on the icon on your desktop.... Read more

Read other 2 answers
RELEVANCY SCORE 64

Hello, this is my first time here, and I hope that one of you can help me out.Symptoms:Desktop is flat grey, cannot change back.Home page is now C:\secure32.html cannot change back.Default search page is the same as above.Constant notices of infection. "Your computer is infected!"I made a mistake and clicked on it, which installed Spy Sheriff.I uninstalled it fast.I've tried running Ad-aware and SpyBot search and destroy.Ad-aware deletes some spyware but the symptoms persist.SpyBot search and destroy doesn't pick up any spyware.I've also ran both programs in safe mode, symptoms still continued!Here is the HijackThis log=============================================================Logfile of HijackThis v1.99.1Scan saved at 11:49:45 PM, on 4/9/2006Platform: Windows XP SP1 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\System32\hpb2ksrv.exeC:\WINDOWS\System32\hpbhksrv.exeC:\Program Files\Zone Labs\ZoneAlarm\zlclient.exeC:\Program Files\iTunes\iTunesHelp... Read more

A:Constant Notices Of Infection, Changed Desktop And Homepage Is Now C:\secure32.html

Hello and welcome.. Please navigate to the following file:C:\WINDOWS\System32\win_0q.dllRight-click it with mouse. Choose to send it to a zipped folder (zip the file). Then once zipped:Please surf HEREand hit New Topic.In the post, paste this link: http://www.bleepingcomputer.com/forums/t/49377/constant-notices-of-infection-changed-desktop-and-homepage-is-now-csecure32html/Make the thread name: file for RaweAttach the file you just zipped to your message and hit post.See this for Instructions for uploading files.==Then once done, please post back with a fresh HijackThis log.Thank you!

Read other 6 answers
RELEVANCY SCORE 63.2

I have read and followed the preparation guide posted by Griner but I am still fighting these problems.Clean out all temporary internet files, temp files, and recycle bin - DoneAd-Aware run and re-run. All finding removed - DoneSpyBot run - DoneBitDefender Run - log can be provided.Norton Antivirus 2006 run - no findingsMcAfee Stinger Run - no findingsWindows Update critical updates are current.I get a RUNDLL popup for each user on login: Error loading 0wso0fis.dll The specified module could not be found.I cannot get this to go away.Norton Antivirus complains about an attempt to change my homepage regularly.I would appreciate any help you can provide as this is tremendously frustating.Hijack This log below:Logfile of HijackThis v1.99.1Scan saved at 3:29:36 PM, on 1/8/2006Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\... Read more

A:Error Loading 0wso0fis.dll On Login And Secure32.html Home Page Hijack

Hi,You have probably been helped elsewhere, but if you still need help can you post a new log from HijackThis. The notification system will tell me that you posted.In case you are not using the latest version of HijackThis (1.99.1), please download the latest version from one of these addresses:http://www.bleepingcomputer.com/files/hijackthis.phphttp://209.133.47.12/~merijn/files/HijackThis.exehttp://www.downloads.subratam.org/hijackthis.zip

Read other 1 answers
RELEVANCY SCORE 62.8

Hi. I get this message and the empy window that go's along with it. I read where several people have had the same problem. I used adaware ect. I am not sure how to do a reg. restore. here is the hijack this log. thanks for any help you can offer.

Logfile of HijackThis v1.97.7
Scan saved at 4:27:06 PM, on 4/5/2004
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\dl.exe
C:\WINDOWS\dlm.exe
C:\WINDOWS\sxchost.exe
C:\PROGRA~1\AIMANT~1\Draw eggs.exe
C:\Program Files\Skype\Phone\Skype.exe
c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\CRAZY_~1\LOCALS~1\Temp\Rar$EX00.735\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6B... Read more

A:cannot find 'file:///c:/windows/dlm.html'.

Hi shane04

Welcome to TSG!

Run Hijack This again and put a check by these. Close all windows except HijackThis and click "Fix checked"

O4 - HKLM\..\Run: [Dial32] C:\WINDOWS\dl.exe

O4 - HKLM\..\Run: [Dial33] C:\WINDOWS\dlm.exe

O4 - HKLM\..\Run: [Upgrade Service] C:\WINDOWS\sxchost.exe

O4 - HKLM\..\Run: [32 audio] C:\PROGRA~1\AIMANT~1\Draw eggs.exe

O16 - DPF: {11111111-1111-1111-1111-111111111157} - ms-its:mhtml:file://c:\nosuch.mht!http://hard-virgins.com/dl/ms/x.chm::/load.exe

Restart to safe mode.

How to start your computer in safe mode

First in safe mode click on My Computer. Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and "Hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Now find and delete:

The C:\WINDOWS\dl.exe file
The C:\WINDOWS\dlm.exe file
The C:\WINDOWS\sxchost.exe file
The C:\Program Files\AIMANT~1 folder (See below)

I have no way of knowing the exact name of that last folder, but the first six letters of the folder name will be AIMANT.
 

Read other 1 answers
RELEVANCY SCORE 61.6

Hi all,

I had tried cracking a software and the keygen i got had virus. After i executing it i was not able to crack the software also i was not able to access my desktop

There was a hyperlinked image on the whole desktop. I was not able to right click. But i was able to move this image and reduce the size. Also i found tht the image was present in the SYSROOT directory and i deleted the same. But every time i restarted this folder re appears and then the same problem again

I installed AVG free antivirus. I did not install the one recommened by the hyperlink and scanned my computer. It has removed every treat it found but still instead of the image there is a white image on the desktop

Please suggest me what can be done. Also i am not sure what should i paste for your references. Please let me know if i you need any information

Rgds
Aditya

A:Cannot find 'file:///C:/WINDOWS/privacy_danger/index.html'

Sorry, we can not help you. We do not provide support for any kind of piracy matters.

You can learn more about this by reading the TSF Rules. .
http://www.techsupportforum.com/rules.php

Read other 1 answers