Thank you for being a valued part of the CNET community. As of December 1, 2020, the forums are in read-only format. In early 2021, CNET Forums will no longer be available. We are grateful for the participation and advice you have provided to one another over the years.

Thanks,

CNET Support

General discussion

c:\secure32.html -- need help

Dec 8, 2005 6:16AM PST

WindowsXp Sp2
Norton 2005
Ad-aware 6.0+Ad-watch 3.0


Hi, I got this virus hijacked Internet Explorer home page and create new file in the Temp folder every time I run IE - any idea what can I do to get rid of this sh*t.

Please help

Discussion is locked

- Collapse -
Re: c:\secure32.html -- need help
Dec 8, 2005 6:25AM PST
- Collapse -
it's not
Dec 9, 2005 3:24AM PST

thanks for the link.
I don't think that is it; I followed the instruction to clean the registry but couldn't find any file it was saying. must be something else.

any other ideas, please?

- Collapse -
Re: it's not
Dec 9, 2005 4:26AM PST
- Collapse -
sorted!
Dec 9, 2005 6:07AM PST

thanks for the suggestions

the culprit was the file "paytime.exe" in the system32 folder.

gone. what a relief... Happy

- Collapse -
(NT) (NT) Glad it's fixed & Thanks for posting back
Dec 9, 2005 6:33AM PST
- Collapse -
little help?
Jan 3, 2006 2:57AM PST

Hey, what did you have to do to take care of this? Just remove that file from the system32 dir?

Thanks,
Kelly2.0

- Collapse -
Kelly ...
Jan 3, 2006 4:30AM PST

Kelly, These instructions might be helpful:

Download SmitRem from here:http://noahdfear.geekstogo.com/click%20counter/click.php?id=1 and save the file to your desktop.
Alternate link: http://www.downloads.subratam.org/smitRem.exe
Double click on the file to extract it to its own folder on the desktop.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Please download Ad-Aware SE Personal and install it. If you already have Ad-Aware SE, please configure it as indicated below. If you have a previous version of Ad-Aware, please uninstall your current version and install the newest version SE 1.06.
Run Ad-Aware, and click Check for updates now. After updating, do not run a scan yet!
Exit Ad-aware.

Next, please reboot your computer in SafeMode by doing the following:
[*]Restart your computer
[*]After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
[*]Instead of Windows loading as normal, a menu should appear
[*]Select the first option, to run Windows in Safe Mode.

Then search for and DELETE the following files IF STILL PRESENT:
C:\WINDOWS\SYSTEM32\paytime.exe <--file
c:\secure32.html <--file

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

Open Ad-aware and do a full scan. Remove all it finds.

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck ''Security Info'' if present.

Reboot back into Windows.

If you are using Windows XP, do a follow-up scan with Ewido:
1. Download trial version:
Ewido: http://www.ewido.net/en/download/

2. Update Ewido and run a scan.

3. Let it clean what it finds.

HTH

- Collapse -
Can't get rid of it!
Jan 3, 2006 1:26PM PST

bugbatter,

I just tried everything in the previous post and I still cannot get rid of it (even though ewido found 228 items AFTER adaware came out clean).

The same time I got this I also became unable to access several websites I use on a regular basis. Any chance they are connected (I have contacted my ISP and it is not due to them)?

Any further recommendations?

TIA

Tami

- Collapse -
adware
Dec 27, 2005 2:53AM PST

It appears that this is not a virus, but is simply clever adware. Try scanning your system with Webroot Spy Sweeper (you can download the trial version on downloads.com). Then quarantine all spyware/adware found. Let me know if this works!

- Collapse -
(NT) (NT) Pearl, This User Fixed The Problem Weeks Ago??
Dec 27, 2005 3:11AM PST