Adaware on boot

[Dave_Lethal]

Adaware simply will not run after I reboot, even though it asks me if it can run on the next restart. I've tried in Safe Mode, Safe Mode with networking enabled, and normal mode, and it will not run on startup.

[teststrips]

if it won't automatically run itself, just manually run it under safe mode. Safe mode will prevent most spyware from loading, which makes it much easier to delete.

[Dave_Lethal]

These files cannot be deleted in safe mode. I've even tried deleting them via command promp with no success. Any ideas why adaware wont run before everything loads up?

[PCguy]

Do you have Home or Pro XP?

[Dave_Lethal]

I have home, and I was thinking maybe its because I keep my user name to log onto windows password protected? But I don't think I've had any problems before...but then again I may have never needed to run adaware on boot, I can't remember. I just purchased this machine a couple months ago.

[lilpinkflower]

[Dave_Lethal]

No, it needs to finish when the computer reboots, before everything loads up.

I don't know if theres a way to do it by choice on boot....

All I know is that it's not finishing its job!

[lilpinkflower]

If you go onto Ad-Aware... and click on the little cog at the top and then click on 'startup'.

Only trouble is... i think you need to be a paying person to use it.

lilpink x

[PCguy]

Can you print out a list of the files you cant delete?

[Dave_Lethal]

These are the files

Vendor: VX2
Type: Malware
In system32 folder: n4n60e5seh.dll, kedhu.dll, kedhu.dll

the file names change every time i restart, but i think they're the same actual files.

[PCguy]

I assume you find the name with VX2, so I will post accordingly.

Reboot your PC into Safemode. Log on as Administrator. Make sure you can see Hidden/System files and folders. There is a FAQ here in the forums on how to do tha. Run VX2 and find the names of the bad .dll's. Use MyComputer to browse to where they are located, I assume it will be C:\Windows\System32\badfile.dll

Right click on one of the bad dll's. Bring up Properties. Go to the Security tab. You many get a warning messege, just click ok. Click on the Advanced button at the bottom. Now click on the Owner tab. The Current owner of this item might be greyed out. So highlight Adminstrator in the Change owner of this item box. Now hit OK until all properties boxes close. Now right click on the file again and bring up properites. Go to the Security tab again. Under Group or user names make sure Administrator is there. If it is, highlight it and tick the Full Control box under Allow. Hit OK until all boxes close. Now delete the file. Do this for all of them.

[Dave_Lethal]

Yes the VX2 is with those files, but I found them on Adaware SE with the new log update, and the VX2 plugin.

I brought up the properties of each dll, but the only tab is General. There is no other tabs. I am logged on as administrator in safe mode, and I can see hidden files/folders.

[Dave_Lethal]

Update:

I hooked up my internet connection to do a google search really quick on my pc, and 30 secs. after I opened IE, I get the following error message:

An exception occurred while trying to run "C:\WINDOWS\SYSTEM32\MUOERT2.DLL, UMONITOR"

And this dll file is one of the one's I can't delete in the System32 folder, one that Adaware said was a VX2. What the heck is UMonitor? It's news to me....

[Dave_Lethal]

Found a solution...finally!!!

I'm not going to get myself too excited until I'm posotive it's gone, but I'm 90% sure it is.

I was doing some research on this UMonitor on the internet when I stumbled upon a little program called Killbox. It deletes any file you choose on your pc, regardless if it's protected or not.

So I used it to delete those 3 dll's and that weird gaurd.tmp in my System32 folder. I had it unregister the dll's before deletion, restarted, and the dll's were gone! I ran Adaware, and it found nothing! I ran HJT and got rid of the 01 autosearch entries, and they haven't come back since.

Life is grand.