Jump to content

Help removing Hicosmea


JakeUK
 Share

Recommended Posts

51a612a8b27e2-Zoek.png Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on 51a612a8b27e2-Zoek.png icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    createsrpoint;
    autoclean;
    emptyclsid;
    emptyalltemp;
    ipconfig /flushdns >>"%temp%\log.txt";b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.

Link to post
Share on other sites

Sadly The Zoek scan doesn't seem to complete. I disabled all antivirus and spyware and ran it as requested. It ran for 15 minutes and failed to complete. I had to reboot to stop it. I then ran it again after disabling all the aforementioned again and without any browsers or programs open and it was still running two hours later. Lots of NumLock on and Numlock off in the early stages but not much else going on. Again I had to reboot to stop it. The message it was showing throughout was as follows:

 

Zoek.exe v5.0.0.1 Updated 31-December-2015
Tool run by JK on 01/09/2016 at 22:17:15.69.
Microsoft Windows 7 Professional  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\JK\Desktop\zoek.exe [Scan all users] [Script inserted]

===== Runcheck 22:17:31.76 =====

--- Create Environment Variables 22:17:32.45
--- Create System Restore Point 22:17:36.76
--- Checking Input 22:17:42.32

 

Link to post
Share on other sites

Okay, we will skip it.

 

FRST.gif FRST search

Once again we shall use FRST for additional checks. Re-run FRST/FRST64 by double-clicking:

  • Copy {62BE5D10-60EB-11D0-BD3B-00A0C911CE86} into the Search: field in FRST then click the Search Registry button.
  • FRST will search your computer for files and when finished it will produce a log Search.txt in the same directory the tool is run.
  • Please attach it to your reply.

Link to post
Share on other sites

Okay, this should remove problematic lines from registry.

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif


icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

Link to post
Share on other sites

Thank you so much. I hope that's finally got rid of it. I have searched to try and find a list of programs that include Hicosmea, as it would seem that I probably installed it with some freeware at some point. But I didn't find anything. It actually seems quite rare as most of the references to it are from people who are in similar situations to me, and most of them lead to this forum.

Anyway I'm extremely grateful for the help.

Fixlog.txt

Link to post
Share on other sites

Okay, let's scan again:

 

FRST.gif Scan with Farbar Recovery Scan Tool
 
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.


Please upload them into your next reply.

Link to post
Share on other sites

Are you sure it returns only on Sunday?

 

FRST.gif Fix with Farbar Recovery Scan Tool

icon_exclaim.gif This fix was created for this user for use on that particular machine. icon_exclaim.gif


icon_exclaim.gif Running it on another one may cause damage and render the system unstable. icon_exclaim.gif

Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finishes FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.

fixlist.txt

Link to post
Share on other sites

OK thanks again. I have a program that I use only on Sundays. That program being Windows Media Encoder. I use it to stream audio to a VPS for a live radio show. I also log into the VPS using RDP. I'm wondering if there's a connection there. I won't be doing the radio show next Sunday, but will the on following one. If there's no return of Hicosmea this weekend but it then shows up the week after it would certainly point to something on that connection. I log in to that server on other occasions throughout the week but the connection is open for about 2 hours on Sundays.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.