Re: tricky question
From: Jim Byrd (jrbyrd_at_spamlessadelphia.net)
Date: 06/28/04
- Next message: Santiago Pereira: "Re: cant press mY Y keY......"
- Previous message: Cris: "Re: Stinger"
- In reply to: a tricky problem: "Re: tricky question"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 28 Jun 2004 14:33:13 -0700
OK Mariyan - Trek on. Just for you information: IIRC = If I Recall
Correctly :)
-- Please respond in the same thread. Regards, Jim Byrd, MS-MVP In news:A35BC6AA-826B-469B-A4E4-F2059E541F52@microsoft.com, a tricky problem <atrickyproblem@discussions.microsoft.com> typed: > Hi, > > Yes,I was refering to Marijn's workaround, > I 've just followed the instructions you proposed today/ > However,there isn't any togwh.dll file or IIRC . > I did a search using the search engine of XpPro but to no avail. > I would be happy to remove this plague from my system but it seems that > it will take certain time . > Meanwhile,I am stilll working on the first part of your propolsal from yesterday. > > Thanks > > > "Jim Byrd" wrote: > >> Hi Mariyan - I'm a little confused about what you did. Are you refering to >> Merijn's workaround? If so, what's being referred to is the actual .dll >> with the random name - in your case, togwh.dll - which will be located IIRC >> in C:\Windows\System32 (if you're on XP), not anything in the Registry. >> What you need to do is to open Notepad by going to Start|Run and entering >> "Notepad" (without the quotes). In Notepad click on File|Open and navigate >> to that file at C:\Windows\System32\togwh.dll. If you can't find it, then >> do the Tools\Folder Options|View sequence to unhide it as described by >> Merijn in my original post. Now do the Cntl-A, Delete, File|Save sequence. >> Now go to Start|Run and enter "Explorer" (without the quotes). Click on >> the - sign in front of MyDocuments to close it, then click on the + sign >> before MyComputer, and then on the one before C:\. Now navigate to >> C:\Windows\System32\ and then find this togwh.dll file. When you've found >> it, then right click on the file and select Properties and then put a >> checkmark in Read Only. >> >> This help any? >> >> -- >> Please respond in the same thread. >> Regards, Jim Byrd, MS-MVP >> >> >> >> In news:52D9C479-D02F-48F5-927C-373ED276116D@microsoft.com, >> a tricky problem <atrickyproblem@discussions.microsoft.com> typed: >>> Hi, Jim >>> >>> I've just tried the recommendation made in the second paragraph, >>> I went to regedit /selected the unsolicited link/ when I right click on >> it, >>> the only available options are - modify,modify binary data,delete,rename . >>> Next,I tried to export it to a notepad,it gives me the export registry file,but >>> there is no notepad in there .When I reseach for notepad under C: drive I >> can see >>> it but in export registry file there is no notepad. >>> >>> The recommnedation in the first paragraph seems to be a lot >> time-consuming, >>> I will give it a try though . >>> >>> If you have anything in mind let me know . >>> >>> Mariyan >>> >>> "Jim Byrd" wrote: >>> >>>> Hi Mariyan - See: http://forums.spywareinfo.com/index.php?showtopic=7447 >>>> Also: >>>> >>>> >>>> From merijn: >>>> >>>> June 18, 2004: >>>> Please stop emailing me about the new CWS variant that hijacks you to >>>> res://<random>.dll/sp.html#96676. I am aware of this new thing, but it's >> a >>>> beast to remove. >>>> A solution is being worked on, see this thread on the SWI forums >>>> <http://forums.spywareinfo.com/index.php?showtopic=7447>. >>>> >>>> If it's not working for you, or it's too complicated, I heard from >> several >>>> people that this workaround works as well: >>>> Open the DLL you get hijacked to in Notepad >>>> Select all content (Ctrl-A) and delete it >>>> Save the file and exit Notepad >>>> Find the file in Explorer, right-click it, select Properties, put a >>>> checkmark in 'Read-Only' and click OK. >>>> If you can't find the DLL file, make sure your settings allow you to view >>>> "Hidden files". Open up any explorer windows and click on "Tools", >> "Folder >>>> Options", "View" and be sure to check off "Show Hidden Files and >> Folders". >>>> >>>> >>>> -- >>>> Please respond in the same thread. >>>> Regards, Jim Byrd, MS-MVP >>>> >>>> >>>> >>>> In news:465C5049-5E4F-4196-AF80-B4BC7BC49F10@microsoft.com, >>>> a tricky problem <a tricky problem@discussions.microsoft.com> typed: >>>>> whenever I bring up internet explorer,I get a web site authomatically >>>>> launched. Surely,this is a spyware,the link in the address bar is : >>>>> res://togwh.dll/index.html#37049 >>>>> >>>>> I went to the registry under the folder named main,I can see the above >>>>> mentioned url along with res://c:\WINDOWS\togwh.dll/sp.html#37049 I deleted >>>>> them,closed the IE,when I reopened it I have the same entries in the >>>>> registry.Can >> anybody >>>>> resolve this ? >>>>> >>>>> Mariyan
- Next message: Santiago Pereira: "Re: cant press mY Y keY......"
- Previous message: Cris: "Re: Stinger"
- In reply to: a tricky problem: "Re: tricky question"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
