iq454

You have to unmount that image and mount the new image(game). If you had something like "Alcohol 120%", you can make many virtual drives without taking any resources from the system. Though, you don't want to do that now do you

Your browser isn't being hijacked, but you can bet you sitll have the stuff on your system sending out info ... If a file won't delete, all you have to do is go to safe mode to delete it... And also make sure if you have xp to turn off system restore, clean everything, make sure it's clean, then turn system restore back on and create new restore point. Then guard yourself like Alec§taar said, and even try those new browsers, they're safer. You might only need IE for special cases. iq

After you get Hijack this, scan then save the log file to desktop and post it here so we can fix it.

there is no option to save as jpeg, because the file youre downloadnig is a bitmap file...if the file is a jpeg, then it can be saved as either, but if its a bmp then it can only be saved as that and edited later. IE doesn't handle uncompreesed-compressed, bmp-jpeg, only jpeg-bmp. bmp is an uncompressed file, jepg is compressed, meaning it can be both, and IE can handle that..that's why jpeg's can be saved as bmp also, because all it does is uncompress it.

A shot in the dark here....what's your systems date?

Get ExWatcher from HERE, once extracted, open the read me file and read what it's all about, and it will find the unknown file that's causing the raised exception. Then go HERE, and read up on how you can write your own exception handler if needed, so it doesn't get called up again if you can't find the troublesome file raising the exeception.

Good Job in resolving your own issuse. If you can take the time to explain exactly how and what you did to resolve this it would be much appreciated incase another case like yours ever turns up. You might want to check HERE for reasons how it could've happend, so as to be aware of the main thing(s)causing it, incase it happens again. And it also explains procedures to use to narrow the problem down also, and may even resolve future cases you may have.

Google is a good place to find out what eroror codes mean. In your case "Error Code : 88780078". Give him your sound cards model, if this is too technical for you to find, then try and find what sound card brand it is atleast, he would then be able to direct you in the right direction. The more information you can give, the easier it would be for him (or anyone that knows) to fix your problem in timely manner, and will be less confusing for everybody who responds. PS: If you're totally new to computers, say that you're a total "newbie" in your posts so we can atleast know what your knowledge is and how technical to be with you.

Edit: corrections.. "write protected"..

Yeah, could've been working for microsoft and making millions, or creating his own programs that maybe saves lives, pilots, controlled or anything. I guess he/she has nothing better to do, and gets a rush from it. Thanks for that acknowledgment though.

Ahh sorry, I missed your update, okay, so then you fixed machine 4? Nevermind about the log then. Although I'm sure it would be an active x control that's the cause, and then maybe created a hybird for notepad to send info off, which isn't really infected, because I found one file that was write protected "jlkopi.log". It seems that the main ocx file created dll's and dats first off, and if anyone of those files got deleted and we missed one, because all files are exactly the same thing, even though the extentions were different, (because I checked the javascripts) it was still the same file, just many variations of it. And notepad might have been infected to enable it to plant a log file for feedback on everything that was happening on the system and to the files it created. Now that log file would've created a hybrid link which talks to notepad evertime it's open to record info for the log, and when you hit the net it sends the info back to the creator, and the hybrid change will happen everytime you hit the net or change its routined files, it will enable it to tell the main dll to do the redirecting. And if all were deleted and the ocx was left, then that ocx would've created alternate files of different sizes with random names, sorta like a stage 2 infection. So, stage 1, ocx creates dll and dats, dats get deleted. stage 2, ocx creates dll. dll gets deleted, ocx creates new dll, and exe's to match. dll gets deleted, exe's can't find active dll, exe's tell ocx that dll can't be found, ocx then creates a new dll with another random name, and exe's to match, ocx finally gets found and deleted, dll can't find ocx and creates more exe's of itself incaase it's found, exe's recreate ocx incase both are found, dll gets deleted, exe's create another dll, exe's get deleted, dll creates more exe's with another dll that deletes itself. Restarts stage 2 with new instructions. ocx creates dll's and exe's with different file names and splits the files into smaller pieces changing the files size also. And ends there. Then starts all over again if any are left behind. Either of the files left behind(which have all got the same instuctions) will create what it needs again to start the process all over Log files link to the main ocx, dat, dll, exe's has been severed, notepads link to log file has been severed, log file goes ape shit and creates more dll's with random names but always the same size from now on, dll's get deleted, BHO turns the dll off, ocx can't find dll, ocx creates new dll, and so on and so forth... stage 1 dat=56kB x 1 dll x 1 dll(deleted itself) = 19kB =94kB stage 2 exe=32kB x 3 = 96kB...exe's are right protected. exe=32kB x 1 dll = 64kB = 96kB....exe and dll are right protected. txt=96kB...txt is right protected. dll=96kB...dll is right protected. ocx=96kB...ocx is right protected. Main point? ocx created 2 versions of itself in the beginning, then once tha tversion was found and defeated, it would then create another 6 versions of itself. Even though they are different extentions and different file sizes, they're still the same exact file combined.

Tick this also O2 - BHO: (no name) - {50B880E0-130E-F77B-46BB-0062598D56CC} -C:\WINDOWS\system32\mfced.dll Then boot into safe mode, and then delete these. *C:\WINDOWS\yyali.txt:mdvpi *C:\WINDOWS\netuy.exe Then clean these DIRECTORY CONTENTS (Dont Delete The Folder itself) *C:\Windows\Temp\ *C:\Documents and Settings\<Your Profile>\Local Settings\Temporary Internet Files\ <-This will delete all your cached internet content including cookies. *C:\Documents and Settings\<Your Profile>\Local Settings\Temp\ *C:\Documents and Settings\<Any other users Profile>\Local Settings\Temporary Internet Files\ *C:\Documents and Settings\<Any other users Profile>\Local Settings\Temp\ Empty your "Recycle Bin" and restart and post a fresh log. *Note* Next time you post your log, move hijack this to its own folder, don't place it in your documnets or your desktop C:\Documents and Settings\Christophe Lebreton\Desktop\HijackThis.exe<-Incorrect put it on your root C: Example: C:\HJT\HijackThis.exe<-Correct. This is just to make sure we can restore the back ups it creates if needed.

Originally posted by AlecStaar: Bet they wouldn't think it was so funny if one of their "monsters" pulled a Frankenstein monster on them & wrecked their own work, or the work for say a crucial deadline @ school or on the job for a relative either! ROF, that's classic HHH.... Hijacker got Hijacked from his own Hijack

no probs , I need you to run it so I can check to log to see if I can run you through it so we don't have to format their machine. It's just easier for me to read the log rather than post back and forth on theories. IQ

Ahhhhh, so that's why when I used notepad it would close down the pad I was reading or using ATT. Good call Andy'. How did you figure that one out? Can you post me a hijack this log on the 4th machine?