I hope someone can help me with this persistant problem.
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
O18 - Filter hijack: application/octet-stream - {6585E5B4-4D2A-4A1D-A219-4102C64BA999} - C:\WINDOWS\chp.dll
This CWS file is visible in the HJT log, but it cannot be located on disk at all to be deleted.
Of course I used the usual methods to View all hidden files and folders in windows and also tried to delete it using these DOS commands:
attrib -r -s -h C:\WINDOWS\chp.dll
del C:\WINDOWS\chp.dll
It wasn't visible by using DIR command afterwards, but it obviously was not removed because the 018 entry still remains without the (file missing) attribute.
Also, tried, DelLater, Killbox, and MoveonBoot but the file remains.
Tried unregisitering the DLL by using this command:
regsvr32 -u chp.dll
and this:
regsvr32 -u C:\windows\chp.dll
Also ran this registry script (without the space in Filter: - bug?)
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Chp.CallThrough\CLSID]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Chp.CallThrough.1\CLSID]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6585E5B4-4D2A-4A1D-A219-4102C64BA999}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Filter\application/octet-stream]
"CLSID"="-
The only chp.dll registry entry by using RegSrch.vbs is this:
[HKEY_USERS\S-1-5-21-3660946461-4168701361-813958858-1006\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="chp.dll "
A CLSID search using RegSrch.vbs utility reveals zero registry entries.
TDS-3 finds nothing.
My question is this:
Are there any commands I can use to search the disk to make absolutely certain the file is not present, because the HJT 018 cannot be removed in normal or Safe mode?Any other helpful hints would be appreciated