money.cafreedom.com

[2k dummy]

This thing is very persistent and difficult to get rid of. The reason you can't find the .dll is because everytime you reboot the file name is regenerated, and it is random. When it next tries to connect, before you dismiss the window, bring up task manager and see what processes are running. Make note of any odd .exe files that should not be there. Make sure system restore is off and you have stopped the processes from running. Locate the odd files and delete them. Go into the registry and delete any entries that are "run once". Search for any entries for the files name(s) that you have found and delete the keys for those files.

[matt]

ok, but im not sure which .exe processes are considered normal, here are the ones i'm running after rebooting.

http://www.msu.edu/~rosemat2/images/processes.htm

also, where is the regestry, and how do i delete the 'run once' objects?

[matt]

also here are my running processes after a reboot and trying to open 'my computer'

i went through them, they are in a different order, but they are the same

[matt]

sorry, my after starting 'my computer' the processes are this:

http://www.msu.edu/~rosemat2/images/processes2.htm

[matt]

anyone?  how can i get to the regestry and clear that out?

[dl65]

matt...to get into the registry......do the following click Start.....then Run .......then type  Regedit in the run box and enter......( make sure you back up your registry just in case your remove the wrong thing ) .....Now when the registry editor opens.....up at the top click edit......now go down to..... find..... and click on it .....the find box will open enter what your looking for and press enter it will search and if it finds what it is your looking for it will be displayed ........so just delete it .........or if it finds nothing try searching for something else.

dl65  

[matt]

sweet, i did a search for 6ji.dll with in regestiry after a reboot and it found something, first i delet the entire entry with everthingin it correct? second how do i back up the regestry first?  thanks  

[Neil]

http://www.computerhope.com/registry.htm

[matt]

ok, i made a back-up, ran regedit, did a search for 6ji.dll.  i found it and delted the entire folder it was in.  that worked, however when i rebooted it came back agian. this thing is persestant.  could it be tied in with someprogram i have?  i cant think of what it would be, i am carefull about what i download.  anyideas of what might be putting it back in the regestry every reboot?

[matt]

ok, i booted into safemode and logged in as administrator, did the regedit thing, and cleared out c:\windows\temp and c:\d+s\default user(and matt)\local settings\temp, then rebooted in to normal.  when i open my documents or my computer, the firewall doesnt show anything trying to connect, but after i close, maybe 5 or 6 seconds later, explorer restarts like it did before, and when i run hijack this i am still getting 6ji.dll in there, as removing it, as before, fixed the problem.  so i think i got at least part of it in the temp folders, but something is still putting 6ji.dll in the regestry every reboot.

[merlin_2]

two things to remember here is the system restore and system  file prrotection  thats why the file keeps reappearing try this..>.http://www.dougknox.com/xp/tips/xp_undeletable_file.htm

[matt]

in hijack this it shows 6ji.dll in E:\windows\system32\6ji.dll,  when i try and delete it in command promt it says it can not find the file.  i tried closeing exploroer and removing it from the regertry using regedit, i actually found two entires for 6ji.dll but when i restarted explororer it came back agian.  i can get rid of it using hijack this but when ever explorer is restarted it comes back.  

[Raptor]

Then stop using Internet Explorer. There are alternative browsers out there.

[matt]

i have been using only firefox 1.0, which suprisses me that i have sometime like this.  the only thing that bugs me is it's all explorer windows, My Computer and My Documents included.  i guess i'll keep fooling around with it, but thanks for the help so far!!