windows explorer problem

[trevelyanrules]

I had been having a problem with Windows Explorer.  I would be browsing through files, and about 5-6 seconds into it, it would tell me that it had an error and needed to be closed...I followed the steps you guys provided, and I think everything is working now...anyway here's the logs that I got out of SuperAntiSpyware and Anti-Malware and HijackThis...let me know if you see anything else - THANKS!



[Saving space - attachment deleted by admin]

[CBMatt]

Looks like we've got yet another Vundo infection here at our forums...

Download ComboFix and save it to your desktop.  Run the program and read its disclaimer (it's fairly short) and make sure you really pay attention to what it says.  Follow the prompts and when finished, it will produce a log at C:\ComboFix.txt.  Go ahead and post that here, along with a new HijackThis log.  Note: Don't click on the window while it's running; this may cause stalls.

[trevelyanrules]

Ok, here is the ComboFix log and the new HijackThis log....thanks for your help again!!!!

[Saving space - attachment deleted by admin]

[CBMatt]

You should be relatively clean by now.  Has your situation improved at all?  Just a few more steps to follow...

Once we start, you won't have access to this post anymore, so I recommend that you print out this post or save it to a Notepad file.  Open HijackThis and scan again.  Check the following entries, but don't do anything to them yet...

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')

Now, close all windows (including this one) besides HijackThis, then click Fix Checked.  Close HijackThis and reboot into Safe Mode and enable hidden files and folders.

Navigate to and delete the following file(s) if present...

C:\WINDOWS\blank.html or C:\WINDOWS\system32\blank.html

Once you've done all of this, reboot into Normal Mode and post a new HijackThis log so we can see if there's any other junk we need to clean up.  Let me know how everything's running now and if you had any problems following my steps.

[trevelyanrules]

Hey...it seems like things are going very well.  The crash issue seems to have been fixed, everything else is running fast and smooth, even the internet!  Anyway, followed your directions, didn't find the blank.html in the windows or system 32 directories after going into safe mode, but I think that's ok

Here's the latest HijackThis log....THANKS AGAIN!!!

[Saving space - attachment deleted by admin]

[CBMatt]

Great, I'm glad to hear that.  Unfortunately, some files aren't always where we expect them to be.  I'd feel more comfortable knowing for sure that the file is gone, but as long as it's not running anymore, it's currently not a threat.

Now that that's taken care of, you should uninstall ComboFix by going to Start > Run, typing in combofix /u (note the space), and clicking OK.

Also, you are in need of anti-virus protection.  I suggest using AVG Free, but Avast and AntiVir are good programs as well.  You also need a firewall.  You're vulnerable without a firewall, so you should look into getting either ZoneAlarm, Kerio Personal Firewall, or Comodo.  They're all good free firewalls.  Just be sure you only have one installed at a time!  Download the firewall of your choice, disconnect from the internet, disable Windows Firewall, and install your new firewall.



One more thing...I should note that you are using a program called SpyHunter 3.  Although it has been taken off the list, this was once considered to be a rogue program.  It has been decided that they have changed their ways, but I personally don't trust them.  I would advise uninstalling this product, but that is up to you.

[trevelyanrules]

Didn't know that about SpyHunter....I've been using them for a while now and it seems like it does a pretty good job...but I will keep that in mind

Downloaded ZoneAlarm and got that going along with some anti-virus.  Thanks very much for your help!

[CBMatt]

If you feel that it's a worthy program, then feel free to keep using it.  As a malware remover, I am simply obligated to point out rogue programs, even if they are no longer considered to be rogues.  But as long as things are running smoothly and you're happy, then it's all good.