Unable To Run Hijack This

My husband's computer has long had a problem hanging on reboot.

I ran adaware, which found and deleted DSS Agent, HI-Wire and Coulomb Dialer.
I ran Spybot which found Aournum, Burst Media, Minibug, MyWay.Mysearch, MyWay.MyWebSearch and Wild Tangent.
Spybot fixed all but one unspecified "problem". I rebooted, ran Spybot again and it found nothing.

I then downloaded HiJack This from a link on this site. When I clicked on HJT Install, it installed the Hijack This icon to my desktop. When I click the Hijack This icon, I receive the error message "Hijack This has encountered a problem and needs to close..."

Can you please help me so that I might proceed with an evaluation?

Thank you,
JC

Hi jacu,
Sorry for the delay. Been a little busy here.
You can "allow" both installation and running of HiJackThis on this computer.
If you are now able to post a log from HJT, please do. If you can't, let me know in a reply to this thread.
When you post, take extra care to post in the correct thread for each machine, since you have two.
Otherwise I could get mixed up.
askey127

Again, thanks for your help.

I tried unblocking on the properties of the Hijack Install, but no joy. It still came up that it had encountered a problem and needed to close.

I must tell you that when I first downloaded and tried to run Hijack This, and I got the "encountered a problem" stuff, I went to add/delete programs to delete it and start over. Hijack This was not in the add/delete list, so I went to start, search and deleted all I saw pertaining to that program. I then re-downloaded and tried over with the same result. Perhaps I mucked up?

Please advise,
jacu

jacu,
Go here http://vil.nai.com/vil/averttools.aspx
Under Utility, download the first item-Stinger v3.8.0
Run it on the computer and let it delete everything it finds.
You may have to download it onto a flash drive from a clean machine, and even run it from the flash, if it won't allow you to copy it to the desktop of the infected machine.

The instruction I use for installing HiJackThis is:
-----------------------------------------------
Download HJTInstall.exe and save to your Desktop.

• Doubleclick HJTInstall.exe to install it.
• By default it will install to C:\Program Files\Trend Micro\HijackThis .
• Click on Install.
• It will create a HijackThis icon on the desktop.
• Once installed, it will launch Hijackthis.
• Click on the Do a system scan and save a logfile button. It will scan and a text log file will open in notepad.
• Make sure Notepad's Format Menu has Word Wrap Unchecked.
• Copy/Paste the entire log to your next reply please.
• No matter what it says in the QuickStart Guide or elsewhere, DON'T USE the "ANALYZE THIS" button.
  Its Findings can be Dangerous for your machine.
• Please Don't have Hijackthis fix anything yet.
  Most of what it is in the log are legitimate entries, necessary for the operation of your computer.

Let me know how it goes
askey127

When I clicked to download Stinger, I chose "run" and got an error. (Sorry, didn't write it down) When I tried again and clicked on "save", it put an icon on my desktop. I doubleclicked the icon and the error "C:\Documents and Settings\Owner\Desktop\stinger.exe is not a valid Win32 application."

Did I do something wrong, or is this the case where it won't let me download and I have to go the flash drive route?

Please advise.

Thank you,
jacu

Update. Since my last post, I went back to the Stinger link and clicked on download and then "run". This time it did run and found nothing. (Only reported how may clean files there were.

I noticed that that site was related to McAfee. I failed to mention that his computer does have McAfee Virus Scan on it and never finds anything except a PUP (KillWind) courtesy of HP. It had run a scheduled scan earlier this morning and still that was all it found.

Regarding Hijack This, I followed your instructions but when I clicked on "install", it looked like it installed, a box came up asking if I wanted to replace the existing desktop icon (I said yes), the icon flashed slightly, then the error regarding encountering a problem and needing to close came up.

Thanks for your assistance,
jacu

jacu,
From your own machine, plug in a flash drive if you have one.
click on the Downloads tab at the top of the page here at malwareremoval.com
got to the second entry and click on the one I have outlined here in red (the .exe download).

2. HijackThis - old version 1.99.1 - Please Do NOT use this software on your own. Get advice from an expert. Powerful Removal Tool by Merijn.Help page
Also available as a exe download from HijackThis, Also a self-extracting zip from here

Save it to the flash drive.

Sign in to the misbehaving computer, using an account with administrative privileges.
Plug in the flash drive, then go to MyComputer and doubleclick on the (removable) flash drive.
It should show a file named HiJackThis1991.exe
Doubleclick it to run.
If it says it has a problem, like it thinks it is running from a temp folder, click OK, and just wait to see if it will scan.
If it does, Notepad will pop up with a log.
Post it if we get lucky.

If it won't work, tell me (Yes/No) if you know how to Boot into Safe Mode.
askey127

My husband is on his way to get a new flash drive.

When I posted last, I was going by memory and got it a bit off regarding the sequence of events. I'm not sure if it matters?

I went back and clicked your HJTInstall.exe link and saved it to Desktop. It then asked if I wanted to replace the pre-existing. I clicked yes. It downloaded and said "Download Complete". My options were "Run", "Open Folder" and "Close". I chose Close. I then rightclicked the HJTInstall icon on my desktop, went to properties and after Security: etc., chose "Unblock". I then doubleclicked the HJTInstall icon and clicked "Install". THEN I got the encountered a problem error.

What would happen if I chose "Run" after "Download Complete"?

And do I need to still be on the internet to install after it's been downloaded?

Tell it to run, and OK any "errors"
You don't need to be on the Internet after it's downloaded.
You only need to be on the Internet to post the log.

Blast. Itried "Run" after download and it came up with the same encountered a problem error.

I've also followed your instructions re the flash drive. I downloaded the version in red to the flash drive from my machine. I plugged the flash drive into his machine. Found HiJack This on the flash and doubleclicked on it. Immediately got the blasted problem/close error.

Yes. I do know how to get into safe mode.

Yikes.

Thanks,
jacu

jacu,
Use My Computer and rename the file on the flash drive (right click it) from HiJackThis1991.exe to Myscan.exe
and see if it runs.
If not, boot into Safe mode and see if you can get Myscan.exe to run.
Otherwise we will go to plan B, or C.
-----------------------------------------------------------
Download Blacklight from here:
http://www.f-secure.com/security_center/
Under "Downloads", click on Blacklight and Save it to your Desktop
or
Link to it from the ftp site: ftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe
and save it to your desktop from there.

Go to Start-->Run, copy in the following text, and press Enter:

"%userprofile%\desktop\fsbl.exe" /expert

Accept the license agreement.
Click > scan, wait for it to fimish, then click Close

There will be a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers).
Copy and paste the contents of this log into your next reply.

askey127

I renamed HiJackThis1991.exe on the flash drive to Myscan.exe. Got the encountered problem error.

I booted into Safe Mode and got the same.

Regarding Blacklight, when I clicked on "Blacklight" from the website, it goes to "Internet Explorer cannot display the webpage". I verified that my connection was good and tried again. Same thing.

His computer has had the Windows Firewall for some time now. Just before I posted here, I installed Zone Alarm on his computer. They are both running. I vaguely remember that I had a problem on my own computer reaching ftp sites after installing SP2 with the Windows Firewall. I can't remember how I resolved that at the time, other than maybe shutting off the Windows Firewall. Could this be my problem with my not being able to reach a ftp site on his computer?

jacu
First, when you go to Control Panel, Security Center, what is reported about the Firewall item, like which firewall and is it running?
----------------------------------------------------------
Download and Install CCleaner

• Download CCleaner from here
• Double click on ccsetupXXX_slim.exe to start the installation of CCleaner. (XXX is the version number)
• Click OK
• Click Next
• Click I agree
• Click Next
• Click Install
• Once the installation has finished, click Finish

-----------------------------------------------------------
Retrieve the Installed Programs List from CCleaner
Open CCleaner if it's not already running.
In the Left Pane, click Tools
Verify that Uninstall is highlighted in color, or click on it.
In the lower Right, click Save to Text File.
Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
You can leave the filename as install.txt
Click Save
Exit CCleaner by clicking on the X button in the upper right of the CCleaner window.
Post the contents of install.txt here.
-----------------------------------------------------------
Press Start->Run, copy/paste the following command into the box and press OK:

cmd /c dir C:\*.* /L /A /B /S|Find "hijack" >> "%userprofile%\desktop\look.txt"

A file called look.txt should appear on your Desktop. Please post the contents of look.txt also

askey127

Good morning Askey!

When I looked at the Security Center, Zone Alarm is on and Windows is off. Boy was I wrong. Maybe Zone Alarm turned it off when it was installed?

Below are install.txt and look.txt

3D Groove Playback Engine
Active Disk
Ad-Aware 2007
Adobe Acrobat 4.0
Adobe Acrobat 5.0
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player 9 ActiveX
Adobe Photoshop Album 2.0 Starter Edition
Adobe Reader 7.0.9
ArcSoft Software Suite
Atomic Pop
AudibleManager
Betty Bad
Bicycle Casino 2.0
Blackhawk Striker
Blasterball 2
Blasterball Wild
BurnPlugin for Audible
Canon S200
CCleaner (remove only)
Construction Zone
Crayola Magic 3D Coloring Book Demo
Dark Orbit
Detto IntelliMover Demo
DLA
easy Internet sign-up
Fisher-Price® - Toddler
Fisher-Price® Big Action Construction
GemMaster 2
Greeting Card Creator 32
Harry Potter
Harry Potter II
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
Hoyle Kids Games 2
hp center
hp instant support
hp learning adventure
HP Memories Disc
HP Photo and Imaging 1.1 - Photosmart Cameras
HP Photo and Imaging 2.2 - Scanjet 3970 Series
hp toolkit
IBM & Crayola Magic Wardrobe
Inactive HP Printer Drivers (Remove only)
Intel(R) 845G Chipset Graphics Driver Software
InterVideo WinDVD
IomegaWare 4.0.3
iTunes
KBD
Kublox
Learn to Speak Spanish 7.0
Lernout & Hauspie TruVoice American English TTS Engine
Linksys Wireless-N USB Network Adapter WUSB300N
LiveReg (Symantec Corporation)
LiveUpdate 1.7 (Symantec Corporation)
Macromedia Shockwave Player
Maurice Ashley Teaches Chess
McAfee SecurityCenter
McAfee Shredder
McAfee VirusScan
Microsoft .NET Framework 1.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Digital Image Library 9 - Blocker
Microsoft Digital Image Standard 2006
Microsoft Digital Image Standard 2006 Editor
Microsoft Digital Image Standard 2006 Library
Microsoft Encarta Encyclopedia Standard 2006
Microsoft Location Finder
Microsoft Money 2006
Microsoft Office Excel Viewer 2003
Microsoft Streets & Trips 2006
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Word 2002
Microsoft Works
Microsoft Works Suite 2006 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
Mozilla Firefox (1.0)
MSN Money Investment Toolbox
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MUSICMATCH Jukebox
My Little Pony
My Sam's Club Digital Photo Center
NVIDIA Windows 2000/XP Display Drivers
Pajama Sam Life is Rough When You Lose Your Stuff
PC-Doctor for Windows
PigPen
PS2
Python 2.2 combined Win32 extensions
Python 2.2.1
Quicken Financial Center
QuickTime
QuickTime 3.0
Reader Rabbit(R) I Can Read! With Phonics
RecordNow
RecordNow Update Manager
S3Display
S3Gamma2
S3Info2
S3Overlay
SabreWing 2
Scooby-Doo(TM), Activity Challenge(TM)
Scooby-Doo(TM), Jinx At The Sphinx(TM)
Scooby-Doo(TM), Phantom of the Knight(TM)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB943460)
ShareIns
Shockwave
Snowboard Extreme
Space Rocks
Speedway
Spybot - Search & Destroy
Tetris
The American Heritage Talking Dictionary
Time to Play Pet Shop
Triple Play '98
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Virtual Warfare
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows Messenger 5.0
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Service Pack 2
WordPerfect Productivity Pack
Works Upgrade
ZoneAlarm


c:\documents and settings\all users\start menu\programs\hijackthis
c:\documents and settings\all users\start menu\programs\hijackthis\hijackthis.lnk
c:\documents and settings\owner\desktop\hijackthis.lnk


Thanks,
jacu

jacu,
Do you use Adobe Acrobat 4.0 and Adobe Acrobat 5.0 ? I am NOT referring to Adobe Reader 7.0.1
The automatic updates for the old versions of Adobe Acrobat is a buggy, broken system that can cause long delays in reboot or in surfing.
The solution is:
1) remove the automatic updates startup
or
2)Uninstall Adobe Acrobat 4.0 and Adobe Acrobat 5.0 (not a good solution if you use them to generate pdf files)
You probably should remove Adobe Acrobat 4.0 anyway, without regard to other issues.
You can include it in the Uninstalls below.
Please let me know your requirements vis-a-vis Acrobat versions.

Right-click the Zone Alarm icon in the System Tray, and select Shutdown Zone Alarm.
-----------------------------------------------------------
Remove Program(s) with CCleaner
Open CCleaner. In the Left Pane, click Tools. Verify that Uninstall is highlighted in color, or click on it.
Click and Highlight the Following Programs, one at a time, and click the Run Uninstaller button for each one.
Wait for completion of each one before highlighting and Uninstalling the next.

Adobe Reader 7.0.9
Spybot Search and Destroy
Ad-Aware
LiveReg (Symantec Corporation)
LiveUpdate 1.7 (Symantec Corporation)

Take extra care in answering questions posed by any Uninstaller. Some questions may be worded to deceive you into Keeping the program.
If you still want an Adobe Reader we can install one afterwards. The version you have is vulnerable as an avenue for infections.
-----------------------------------------------------------
Install WinPatrol - Download and Install the Free WinPatrol, and view Instructions here: http://www.winpatrol.com/winpatrol.html
We can use it to remove startups in the absence of HiJackThis. Here we will try to remove any Adobe Startups and see if it corrects the long reboot issue.

Right click the blue Scotty Dog icon in the System Tray (lower right).
Click options, and UNCHECK the box labeled "Automatically Run WinPatrol when the computer starts".
Click on the Startup Programs tab.
Highlight any item that looks like it's related to Adobe updates and choose Remove. They will say "Adobe" under the Company column.
Any of these entries that are removed will not delete any programs; they only prevent automatic startup.
The programs are still available in your "All Programs" list.
Click the "X" to exit.
Right click the blue Scotty Dog icon in the System Tray (lower right).again. Choose Exit Program.

Tell me about the Adobe Acrobat business, and how things are. Try a reboot.
You can try HiJackThis again also if you wish., but make sure any time you reboot you check that ZoneAlarm is off in the System Tray.
askey127