# Win fixer2005



## SargeE7 (Aug 12, 2005)

How do I remove win fixer 2005 it keeps coming up when i reboot. I have tried all options such as deleting from control panel and statrup menu


----------



## Cheeseball81 (Mar 3, 2004)

Hi *SargeE7* 
Welcome to TSG!

Click here to download Hijack This: http://thespykiller.co.uk/files/hijackthis_sfx.exe

Let it extract to *C:\Program Files*

Close out any open browsers
Launch the program
Hit "do a system scan only"
When that finishes, hit "save log"
The log will open in Notepad
Copy & paste that log into this thread

*Do not fix anything yet*


----------



## SargeE7 (Aug 12, 2005)

How do I get the log to open in notepad?


----------



## Cheeseball81 (Mar 3, 2004)

After you click on "Save Log", it should automatically open in Notepad (or WordPad)


----------



## SargeE7 (Aug 12, 2005)

When I hit save log only desktop icons open and not notepad or wordpad


----------



## Cheeseball81 (Mar 3, 2004)

Okay let's try this...

Launch Hijack This

Click on "do a system scan and save a logfile"


----------



## fs80 (May 25, 2004)

i had the same problem. do the hijack scan and then open it. the file will open on your desktop. minimize it and then open notepad also on the desktop. then have them side by side and drag and drop the hijack this file on to the notepad screen.


----------



## SargeE7 (Aug 12, 2005)

When I do a system scan and save logfile I get the following:
W Script Error-Windows Scripting Host
(Red X circled) " There is no script engine for file Extension log"


----------



## Cheeseball81 (Mar 3, 2004)

I think you might need Visual Basic Runtime to get this to scan.

Download it here: http://www.microsoft.com/downloads/...f9-b5c5-48f4-8edd-cdf2d29a79d5&displaylang=en


----------



## SargeE7 (Aug 12, 2005)

I tried Visual basic runtime, no help any other suggestions?


----------



## Cheeseball81 (Mar 3, 2004)

What program do you usually use to open .log files?

We should check your file extension and also the spelling of your scripting language designation.

If you go into Windows Explorer, View, Folder Options, File Types
Scroll until you reach LOG file
Highlight over it
What program is indicated that it should open with?


----------



## SargeE7 (Aug 12, 2005)

WSCRIPT, I can open the log file on the desktop and open notepade and drag the file into note pad but how do I jeep it there? I am sorry I am such a pain but at 73 I am trying hard to learn


----------



## Cheeseball81 (Mar 3, 2004)

Can you copy and paste it?
If you can open the log, do CTRL A (which should select all the text)
Then CTRL C (copies the text)
Then come back to this thread
Do CTRL V (that should paste the contents here)

Or what we can do is change what program is used to open LOG files.
We can change it from WSCRIPT to Notepad instead.


----------



## SargeE7 (Aug 12, 2005)

CTRL A does


----------



## Cheeseball81 (Mar 3, 2004)

SargeE7 said:


> CTRL A does


----------



## SargeE7 (Aug 12, 2005)

CTRL does not select text


----------



## Cheeseball81 (Mar 3, 2004)

I think we should change what program is used to open LOG files.
From WSCRIPT to Notepad instead.


----------



## SargeE7 (Aug 12, 2005)

When I open the log file under hijack this CTRL A does not select text


----------



## Cheeseball81 (Mar 3, 2004)

Meaning within the Hijack This program, right?
Because yeah, that wouldn't work. 
But you haven't actually been able to save the log file.
Correct?


----------



## Cheeseball81 (Mar 3, 2004)

Go into Windows Explorer, View, Folder Options, File Types
Scroll until you reach LOG file
Highlight over it
Click Edit
Highlight over 'open'
Click Edit
Click Browse
Under 'Look in'
Go to your hard drive (C: drive), then Windows
Select Notepad
Click Open
Click OK
Then click OK again

Now run Hijack This again
Save the log file
All log files should open in Notepad now

When it opens in Notepad
Go to Edit>Select All
Then Edit>Copy
Come back to the this thread
Go to Edit>Paste


----------



## SargeE7 (Aug 12, 2005)

SargeE7 
View Public Profile 
Send a private message to SargeE7 
Find all posts by SargeE7 
Add SargeE7 to Your Buddy List 
#13 19-Aug-2005, 08:00 PM 
Cheeseball81 
Distinguished Member Join Date: Mar 2004
Location: New York
Posts: 16,504 
Experience: Nerd 

Can you copy and paste it?
If you can open the log, do CTRL A (which should select all the text)
Then CTRL C (copies the text)
Then come back to this thread
Do CTRL V (that should paste the contents here)


ctrl a does not select text


----------



## Cheeseball81 (Mar 3, 2004)

See my post above


----------



## SargeE7 (Aug 12, 2005)

Last suggestion does not work can't highlight log file


----------



## SargeE7 (Aug 12, 2005)

My last three post on quick reply have not been going through


----------



## MFDnNC (Sep 7, 2004)

Attach the log - do a post reply and scroll down to manage attachments


----------



## SargeE7 (Aug 12, 2005)

Your post of 19 aug does not work any other suggestions? Why are my post not going through this is the fifth time I have replied to you last post


----------



## Cheeseball81 (Mar 3, 2004)

What about the post from Aug 21?


----------



## dschoeck (Sep 8, 2005)

SargeE7 said:


> How do I remove win fixer 2005 it keeps coming up when i reboot. I have tried all options such as deleting from control panel and statrup menu


----------



## dschoeck (Sep 8, 2005)

SargeE7 said:


> How do I remove win fixer 2005 it keeps coming up when i reboot. I have tried all options such as deleting from control panel and statrup menu


----------



## MFDnNC (Sep 7, 2004)

dschoeck what is the purpose of your 2 posts???????

If you are seeking winfixer help start your own thread in the security forum, do not jump on anothers thread.


----------



## Cheeseball81 (Mar 3, 2004)

*dschoeck*,

Please stick to your thread here: http://forums.techguy.org/showthread.php?p=2937322#post2937322

Thank you


----------



## dongwen (Nov 10, 2005)

I already download the software from your link and paste the code in this thread. I don 't know that thread is gone now and I don 't see it on this thread any more. Here it is again:

Logfile of HijackThis v1.99.1
Scan saved at 10:58:23 PM, on 11/10/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\WINDOWS\system32\hphmon03.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe
C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\SurfAccuracy\SAcc.exe
C:\WINDOWS\system32\b01k9e0l.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\HEWLET~1\PHOTOS~1\HPSHAR~1\hpgs2wnf.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Vpskeys\vpskeys.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\HPHipm09.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopDisplay.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\program files\internet explorer\iexplore.exe
C:\Documents and Settings\Don Nguyen\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://yahoo.sbc.com/dsl
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MMTray] C:\PROGRA~1\MUSICM~1\MUSICM~3\mm_tray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [CXMon] "C:\Program Files\Hewlett-Packard\PhotoSmart\Photo Imaging\Hpi_Monitor.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\PhotoSmart\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [b01k9e0l] C:\WINDOWS\system32\b01k9e0l.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\adwarealert.Exe -boot
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [VPSKEYS] C:\Program Files\Vpskeys\vpskeys.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WinFixer2005] "C:\Program Files\WinFixer_2005\uwfx5.exe" /min
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE


----------



## Cheeseball81 (Mar 3, 2004)

dongwen, you have a thread here: http://forums.techguy.org/t415440.html


----------



## Cheeseball81 (Mar 3, 2004)

Since we have not heard from SargeE7 since August, I am closing this thread.

If you need it re-opened please PM me or one of the other Mods.

Anyone else with a similar problem please start a "New Thread".


----------

