Re: Welcome to the SVT Discussion forum -Steps to take before posting a HijackThis lo
How to Quarantine Files
You may be told to Quarantine certain files.
When your Hijack This log is analyzed by our SWAT Team members or experienced users, we will identify HJT entries which are known bad, or appear suspicious because their file names are random, nonsense, or fit patterns of certain infection problems. If you are told to "Manually locate all the .exe / .dll / htm / html files indicated above and quarantine them", this means you need to look at each HJT entry that has been highlighted for you and identify the location of the files. For example, here are a couple of HJT entries, with the actual file location highlighted in red:
O2 - BHO: (no name) - {5EA09FEA-707B-FB28-AF23-9B7F1EA97C20} -
C:\WINNT\mfcwz32.dll
O3 - Toolbar: sitemove - {45084689-F2B1-ACD4-5C96-37D71CCC71D7} -
C:\PROGRAM FILES\VC JUNK\FIVE MAPI.DLL
O4 - HKLM\..\Run: [sdkql.exe]
C:\WINNT\sdkql.exe
Examine the HJT entries identified to you to determine the locations of any files you need to quarantine.
What you need to do is open My Computer, then open your C drive, then work your way to the folder(s) and file(s) indicated. If you cannot see the files, you may need to set your system to Show Hidden Files and Folders, as per the instructions
here.
Sometimes a directory name will not be shown fully, but will be "truncated" to 8 characters, with a "~" in the name. For example:
C:\PROGRA~1\THATTI~1\castplay.exe
C:\PROGRA~1\ELSETONS\2DOES.exe
Anything with a "~" in the name is a folder with a longer name, but it starts with the letters indicated. In these examples, "progra~1" = Program Files. The folder "thatt~1" with the letters "thatt" and have more letters after that. It may be "thattimeof year" or, with spaces "that time of year." Locate the folder that is most likely to be the match, and open it. See if the exe or dll file in question is inside of it, for instance, castplay.exe in the 1st example.
To quarantine the files, open My Computer, open your C drive, and create a new folder by right-clicking, selecting New Folder, and naming it QUARANTINE. Then, move each of the files you have located above into the Quarantine folder by dragging and dropping them. (If you are moving them from a different hard drive, make sure to actually move them, not just copy them. A drag and drop between hard drives will
copy a file, not move it. Hold down the SHIFT key when dragging and dropping between hard drives to do a move instead of a copy.)
One you have all the suspect files in the Quarantine folder, you now need to rename them to prevent them from accidentally (or purposefully) being re-run on your computer. Right click on each file, and rename the 3 letter "extension" part of the names. I recommend using the following naming system:
- rename .exe files to .xxx
- rename .dll files to .ddd
- rename .htm or html files to .hhh or .hhhh
- rename .tmp files to .ttt
- if quarantining a whole folder, add an XXX to the end of the folder name. You do not need to rename everything inside the folder, as having moved it to a different location and renaming the folder as well will break the filepath of any startup entries or services, so nothing inside it will run at startup.
If you are told to quarantine a file type that is not on this list, just take one of the 3 letters in the extension that will make it easy to remember what type of file it is (eg, using "x" for .exe's) and type that letter 3 times.
Why quarantine files? Why not delete them?
Well, we are all human. We all make mistakes sometimes. You may grab the wrong file by accident, and if you delete it and empty the recycle bin...it's gone. Or someone helping you with your HJT log may make a mistake, and tell you to get rid of a certain file, which is actually a legitimate file. If one of the HJT entries identified to you turns out to be a legitimate entry, and you delete the file associated with it, then you may encounter problems with some software package. Or, if you delete files instead of quarantining them, and you delete the wrong file by mistake, you can have software problems. Quarantining files is safer than deleting them, as you can always rename them and move them back if you need to. If you cannot remember where to move a file back to, you can always check your HJT log you posted here on Short-Media to find out where it came from.
Deleting Quarantined Files
If you want to clean out the quarantine after a couple of weeks, feel free to do so. Just make sure you have run most of your other programs to make sure that nothing appears to have been affected. If everything is running properly, go ahead and delete the quarantined files after 2 weeks or so.
If you need assistance with any of these steps, feel free to ask, and someone will help at the earliest convenience.
Similar Threads
