Downloader KL problems

[Simon Wheeler_1]

Hi - I'm experiencing problems. Running Windows ME, with IE6. When I open an internet connection, every couple of clicks I get adware windows pop-up. Annoying, but not the end of the world - untli I try and close any of them, when my pc goes click, screen darkens, and the shutdown dialogue box appears. Nothing works except a hard reboot.
I've run McAfee - but the only thing it finds is this Downloader KL program which I can't delete for love or money! Any suggestions please? The Downloader is living in a program called hmlidpsi.exe in the C:\windows\system directory - which again I can't seem to delete.

[JohnWRuffo]

Try using AdAware from Lavasoft to remove it.
http://www.lavasoftusa.com/

[Ron Kinner]

The antivirus programs don't recognize a lot of the nasty adware as malware so are of little use. Instead use my canned response:


"In order to fix this easily you need to download a few programs.

Hijack This:

http://tomcoyote.com/hjt/

CWshredder

http://www.majorgeeks.com/download4086.html

Adaware 6.181

http://www.majorgeeks.com/download506.html


and Spybot Search and Destroy 1.3.

http://www.majorgeeks.com/download2471.html

The first two are small and will fit on a floppy if you can't use your PC. Before running either, close all windows, right click on the Explorer Icon on your desktop and select Properties then select Delete Cookies and tell it OK. When that finishes hit Delete Files (check the box in front of Delete Off-line Content and tell it OK). This one can take a while to finish so be patient.

Next for safety's sake, create a Restore Point if your OS supports them (XP, ME) or an Emergency Recovery Disk with Registry Backup win2K or copy the files c:\windows\user.dat and system.dat to a floppy for 95 or 98.

Now shutdown all browsers and other programs, install the CWShredder and let it check your system. If it asks you if a file name is random, write down the file name and tell it NO then ask us. You can always run the program again and say Yes if need be.

Now run Hijack This (I think it works better if you run it in Safe Mode but you can try it the normal way first.) and copy the output and post it here and we will tell you which ones to check. Then you go back in to HijackThis and check the items we point out and then hit Fix Checked. Then reboot and run it again and post your results so we can make sure you are clean

Once you do this you should be able to download the other two programs. Install AdAware first and make sure you get the updates. Run it and tell it to remove anything it finds.

Now do Spyware S&D 1.3 and let it run. It shouldn't find much but you want to tell it to remove the junk it finds then let it immunize your system.

Go to windowsupdate.microsoft.com and let it check your system for needed updates. You don't need the .net updates nor the multiple language stuff but you should get all of the critical updates.

If you have System Restore, turn it off and then back on and make a new restore point. This will remove all of the bad stuff which might be stored in your old restore points. For non XP or ME system make new emergency repair disks or copies of the dat files and discard the old ones.

Finally get Zone Alarm (the free version) from http://www.zonelabs.com/store/content/catalog/products/sku_list_za.jsp and install it so you are protected from some attacks and will be notified if something odd starts running on your PC.

If you need help with any of the programs come back and ask. There are a few hijackers which prevent them from running but there are other programs which will kill them."

Following is one of my previous uses of the above. The responses will give you an idea of the output from Hijack This and how it works.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=629468

Ron

[pamela barber]

Hello. I am experiencing similar problems with Downloader KL and would like to submit my files to you for review. I have attached them. Is this the proper way to post results from both of these programs? I wasn't sure even after reading the faqs. Thanks in advance.

[pamela barber]

Hi, again. I had to send the files for cwshredder and hijackthis separately. So here goes for Hijackthis. Again, thanks in advance.

[pamela barber]

Please be patient. I'm new to posting on forums. The first were my random files for CWShredder. These are my Hijackthis files for fixing. THanks.

[Ron Kinner]

Pamela,

I would prefer it if you would start your own thread. That way I have a chance of getting points from you which is how the forum works. I will tell you that both of the "random files" from CWShredder are bad guys so run CWShredder again and tell it they are random and to delete them if it can. Then run HijackThis in Safe Mode and post the results in your own thread and I will be glad to look at the log for you.

Ron

[Kusuma]

Ron,

Here's the new thread link posted by Pamela.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=695313

- Kusuma

[Ron Kinner]

OK. I'm working on it now. The forum was down when I tried to log in this morning. Service not available.

Ron