Re: tricky question
From: Jim Byrd (jrbyrd_at_spamlessadelphia.net)
Date: 06/28/04
- Next message: Jason Wade: "Re: No luck"
- Previous message: tool: "BHODemon"
- In reply to: a tricky problem: "Re: tricky question"
- Next in thread: a tricky problem: "Re: tricky question"
- Reply: a tricky problem: "Re: tricky question"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 28 Jun 2004 09:37:20 -0700
Hi Mariyan - I'm a little confused about what you did. Are you refering to
Merijn's workaround? If so, what's being referred to is the actual .dll
with the random name - in your case, togwh.dll - which will be located IIRC
in C:\Windows\System32 (if you're on XP), not anything in the Registry.
What you need to do is to open Notepad by going to Start|Run and entering
"Notepad" (without the quotes). In Notepad click on File|Open and navigate
to that file at C:\Windows\System32\togwh.dll. If you can't find it, then
do the Tools\Folder Options|View sequence to unhide it as described by
Merijn in my original post. Now do the Cntl-A, Delete, File|Save sequence.
Now go to Start|Run and enter "Explorer" (without the quotes). Click on
the - sign in front of MyDocuments to close it, then click on the + sign
before MyComputer, and then on the one before C:\. Now navigate to
C:\Windows\System32\ and then find this togwh.dll file. When you've found
it, then right click on the file and select Properties and then put a
checkmark in Read Only.
This help any?
-- Please respond in the same thread. Regards, Jim Byrd, MS-MVP In news:52D9C479-D02F-48F5-927C-373ED276116D@microsoft.com, a tricky problem <atrickyproblem@discussions.microsoft.com> typed: > Hi, Jim > > I've just tried the recommendation made in the second paragraph, > I went to regedit /selected the unsolicited link/ when I right click on it, > the only available options are - modify,modify binary data,delete,rename . > Next,I tried to export it to a notepad,it gives me the export registry file,but > there is no notepad in there .When I reseach for notepad under C: drive I can see > it but in export registry file there is no notepad. > > The recommnedation in the first paragraph seems to be a lot time-consuming, > I will give it a try though . > > If you have anything in mind let me know . > > Mariyan > > "Jim Byrd" wrote: > >> Hi Mariyan - See: http://forums.spywareinfo.com/index.php?showtopic=7447 >> Also: >> >> >> From merijn: >> >> June 18, 2004: >> Please stop emailing me about the new CWS variant that hijacks you to >> res://<random>.dll/sp.html#96676. I am aware of this new thing, but it's a >> beast to remove. >> A solution is being worked on, see this thread on the SWI forums >> <http://forums.spywareinfo.com/index.php?showtopic=7447>. >> >> If it's not working for you, or it's too complicated, I heard from several >> people that this workaround works as well: >> Open the DLL you get hijacked to in Notepad >> Select all content (Ctrl-A) and delete it >> Save the file and exit Notepad >> Find the file in Explorer, right-click it, select Properties, put a >> checkmark in 'Read-Only' and click OK. >> If you can't find the DLL file, make sure your settings allow you to view >> "Hidden files". Open up any explorer windows and click on "Tools", "Folder >> Options", "View" and be sure to check off "Show Hidden Files and Folders". >> >> >> -- >> Please respond in the same thread. >> Regards, Jim Byrd, MS-MVP >> >> >> >> In news:465C5049-5E4F-4196-AF80-B4BC7BC49F10@microsoft.com, >> a tricky problem <a tricky problem@discussions.microsoft.com> typed: >>> whenever I bring up internet explorer,I get a web site authomatically >> launched. >>> Surely,this is a spyware,the link in the address bar is : >>> res://togwh.dll/index.html#37049 >>> >>> I went to the registry under the folder named main,I can see the above >> mentioned >>> url along with res://c:\WINDOWS\togwh.dll/sp.html#37049 I deleted >> them,closed the >>> IE,when I reopened it I have the same entries in the registry.Can anybody >>> resolve this ? >>> >>> Mariyan
- Next message: Jason Wade: "Re: No luck"
- Previous message: tool: "BHODemon"
- In reply to: a tricky problem: "Re: tricky question"
- Next in thread: a tricky problem: "Re: tricky question"
- Reply: a tricky problem: "Re: tricky question"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
