boxig

Brian, Yes, I know about the inf that's why I did not touch them. It is now working fine and it seems I removed all malicious files. When you say "Swen" you don't mean "System32\swenum.sys" ??? Now I have working on start: Norton AVG Sygate and will run every day: Ad-Aware XoftSpy And will run on-line check once every few days at "Panda". I hope this will be enough. Thank you for your help and to all members who gave me ideas. Granot

Fred, Thanks. Mine is 23 August 2001 12 kb (12,160 bytes). I ask because I installed Saygate Firewall and I blocked it. Everything wroks fine but every few seconds this file is trying to upload or make contact. I have good news: After three days, I solved all problems (I hope). Even the shell.dll don't disappear any more. As I said above, Panda online scan found those bad files and removed them. BTW: I need opinion for my "Shopping List Maker" you, or anyone who want to check I'll be glad to send it. Thank you all for your help. Granot

Found this great tool which scann and remove malicious files from your PC. It found 14 files on my PC which Norton didn't find. I recommend to all: http://www.pandasoftware.com/activescan/com/ It seems as if it solved my problem but it's too early to tell. For the last hour I have no more pop-ups and ,my browser is not hijacked. (didn't check about the shell.dll yet). Brian, please continue on guiding me as for the inf files. And, does anyone know what is this: C:\WINDOWS\System32\DRIVERS\ndisuio.sys "Internal Windows driver; performs internal communications tasks within Windows". But I mean, what it downloads to our PC and from where ? What is good for ? Do we need it ? Is it enemy ? Thanks Granot

Guys, you are all great and I'm very happy i was attacked by this file, because i see there are also good people who are trying to help contrary to those who are looking only to make wrong. So, in a way, i was lucky, because i was not sure if there are still some good people in our world. This is really heart warming. Thank you all. I can't keep up with you guys but I'm following all suggestions in all replys and taking each very seriously. Brian, I have 40 ini files, moved them all to a new folder on my desktop. I have 700 inf files in inf folder. I can't find the specific file. Can I delete them all ? Please tell me what to do. Ken I have no problem with my site but on my PC. But it is good idea to protect it too. I'll check this link. Thanks. Alan Thank for help, I will check also all your links and let know on results. Thank you very much. I found a forum where this specific problem is discused but I'm getting lost there See here.. Granot After few hours: I probably managed to eliminate ljtio.dll but.. surprise: ljtio.dll has come back with a fiend called hzapn.dll and now my browser is hijacked using this: res://hzapn.dll/index.html#96676 From reading what people wrote in other forums about this problem, name of DLL can be changed to whatever. For now I just opened the DLL with Notepad and cleared the text (???). Granot The hours pass and now my enemy is changing the DLL it uses each time: res://orlha.dll/index.html#96676 Pop-up windows start to run over my screen and even "Google ToolBar" can stop them. But I still have hope... or should i jump from high building ? BTW, all pop-up windows offer programs to solve my problem and prevent it from happening again. Very clever, infect you and then sell you the medicine. Granot HUMMMM... night already and my enemy become smarter. I tried to kill it and now not only change DLL name but... http://search-to-find.com/sec.php?qq=&pin=96676 DO NOt CLICK !!! Granot

jeanie Spybot was good (thank you), it found another 31 malicious files on my PC, but unfortunatly didn't solve my problem. Brian IjTio.dll - Yes, I am downloading images, movies etc. but can't remember when problem stated. I deleted the IjTio.dll but not the problem. I removed from my registry all entries which include part of ijTio.dll/index.html#96676 but all entries come back, which means there is a file who puts it there. This happens when I open IE. It may or may not have connection to my disappearing "shell.dll" from system32 every time I put it back and use a program which needs this file, when close the program the shell.dll disappears. I did not removed any ini or inf files but I will look now and try to find them. All your suggestions are very helpful and I hope I can do it succesfuly. If I will have any question I will ask you. Thank you very much and now I'll go to look for the utilities you recommended and try to solve my problem. Many Thanks Granot

Good morning Back to my problem. And today's topic: WINDOWS\system32\msov.exe WINDOWS\apijr.exe What the hell are these ? ! I strongly recommen everyone to use "HijackThis" utility since my Norton and AVG and Ad-Aware didn't prevent and still can not find my problem, but "HijackThis" did find it and removed it, but still it's coming back, probably due to another vicious file. I will tell keep you update how it's going on. Thank you all again. Granot

Ken and AL Thank you both. I get more confused now. I removed both files but it asked for missing "apijr.exe" (???) while you, Ken, don't have this file and your system don't ask for it. I tried to make scan on line but it want to install things on my computer (?) and this is how all started when someone installed something on my computer. Is it safe ? Also, my browser become very very slow, any idea ? I also used the XP restore (never knew it exist) but... no change at all. Very strange. My Home Page is still being Hijacked, and my shell.dll still being deleted. I will try all other suggestions. Ken - the url you gave me http://www.networld.co.jp/msov/ is in... Japanese ! (or maybe I become crazy ?) I really become very "annoyed" and soon they will put me in a "close place". Now its Midnight, so good night to you all and hope for a lucky tomorrow. Granot

Ken, Thanks a lot, I will do all your suggestions. In the mean time I found two files which I suspect, so maybe someone knows if they are dangerous or belong to the system. Te files are: HKLM\..\Run: [msov.exe] C:\WINDOWS\system32\msov.exe HKLM\..\RunOnce: [apijr.exe] C:\WINDOWS\apijr.exe All XP users, please check if you have those files and let me know before I remove them if they belong to system. I also found a good program named: "hijackthis" which found my Home page hijacker but it comes back all the time even I remove it. Granot

Ok, solved part of the problem (stollen home Page) but my "shell.dll" is still getting deleted by itself (with a little help from "good people" somewhere there on the net). and this makes me CRAZY !

Hi all, Sorry for this out of topic but you are my last chance to solve my problem. It is very strange and mysterious. It seems I got some "virus" (???) or something similar which deletes "shell.dll" from my "System32" folder. I run Norton and AVG and Ad-Aware but they found nothing (I just keep a copy of the file and put it again when it is gone, and then it vanish again). When I open my browser (IE) my Home Page was stollen and I always get : res://ljtio.dll/index.html#96676 (Do not try to visit it or you'll be infected too !!!). Then something happens and my "shell.dll" is deleted, and when I change page I get this one: http://www.lookfor.cc/ DO NOt CLICK !!! I rechange my home page but it always replaced by "something" to that page: res://ljtio.dll/index.html#96676 I tried to delete all my "index.dat" but can't (will it help ?). Any tip, any idea, whatever on your mind.... I'm ready to try anything. Thank you Granot

Hi all members, In the coming month I'm going to rebuild my web page and probably remove many of my programs/utilities. Then I want to enhance those utilities left. To do this I need your help. Please write here: 1) Which utilities are most wanted. 2) Which new features you want to see in existing utilities. 3) Any idea for new utility for PTE. 4) Any idea for new utility not PTE related. Check my web page here. Thank you Granot

Hi Guido, 1) Try the free Netscape Navigator. 2) Delete internet temporary files. Sometimes a corrupted file is the reason. 3) Disable all protections (norton, firewall, IE internet security etc) for try. 4) Allow to accept all cookies for try. 5) Check your HOSTS file to see if that page have been blocked !!! http://accs-net.com/hosts/what_is_hosts.html http://win98private.net/hosts_file.htm http://www.net-hosting.info/dir/windows_ho...ile/index.shtml http://www.jhsoft.com/help/df_hostsfile.htm http://homepage.ntlworld.com/alan.smith25/pchosts.htm Good luck Granot

Dave, Hummm... I downloaded your 65.6 MB show but you have entered a trial period and it was expired I hope you didn't give the new couple this file... Let us know when we can download new file. Granot

Chuck, This was a very good show and I enjoyed every second. The phone calles and the baby laugh were great idea. And a good choice of music. Granot

Graet work AL !!! Thank you Granot

Free Tray Paster - Version 7.0 Added: 1) "VideoInfo" to play and get video file information, see frames and time. 2) "SeeFonts" to display all your fonts. 3) "ReadOnly" to change attributes of all files in a folder. Useful when you copy files from CD to HD and all files are "readonly". 4) "ChooseColor" to find any color you want and send number to clipboard. Old features: 5) "DropMe" to retrieve files full path to clipboard by drag and drop a file the the blue window and to display thumbs of jpg and bmp images. Thumbs can be resized. 6) "XYimage" to get dimensions and path of image. And the main feature: 7) keep lines (up to 120 characters) fo be used when needed. When open "Tray Paster" it goes to taskbar as icon. Click on icon to select what you need. Just click on the line and it's ready to paste anywhere. Enjoy Granot

Many people buy or install freeware program like this while on win200/xp you have it already on your machine. This is a setup program which makes exe from your files and allow you to add messages including a Readme file. If you include an exe file it will run it. Aside from using it for what it was intended, you can find other uses. There is also a Help file called "IExpress.pdf" Download Help File here (right click and "Save Target as") Granot

... but keep it a secret and tell no one. IExpress.exe - wow ! IExpress is a tool that creates custom, self-installing, self-extracting packages (.cab) of applications (exe). You will find it in: C:\Windows\System32 To use IExpress, click on "Start", open the "Run" box and type: iexpress.exe. What else you can do with it ? Pack your show with "Unregistered" message so you don't have to make any change to your show. Hope it will help someone. Granot

Smile sigelr... and welcome. This is known problem with some servers deleting attachments or maybe Norton protection, or, even your own email program protection. Don't worry, just write again to support and you will get it soon. Igor (the author) is probably taking a nap Waiting a bit more will only make this wonderful program sweeter and there are many helpful members on this forum to help you whenever needed.

Thanks guys. To those who need to download the new version it is here: lame_enc.dll Granot

Wow ! Wow ! Wow ! Great show, great photograpy, ... etc.

Check this link maybe it can help: Template Tool If it does, please add your feedback about this tool. Granot

...they use all the good words those bad guys above ! (Maybe I will invent a new word ? ) .... beautiwow ! and thanks for the text. Now I not only know what I miss but also know how it is called

Thanks Guido for the info. Can you please give more details about the above quote ? Do I have to change some Norton's settings ? I found three lame_enc.dll on my machine, none on "System" folder (?) and each has different size , 85 kb, 212 kb, 223 kb. Are they all old versions ? Should I replace them all with new version or it just may be that some of them only have same name (who knows) but are different dlls ? Thank you Granot

And where it is ? Sorry for getting old and senile, just after a small heart attack due to stress (not caused by pte members). Granot