You may recognize the instructions below from your malware preparation bulletin.

Step 6: HijackThis

Please run HijackThis only after the above steps have been completed

Download and rename HijackThis.exe (HJT)

* Double-click on HJTInstall.
* Click on the Install button.
* It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
* Upon install, HijackThis should open for you.

    * Close HijackThis and rename it.
    * Go to C:\Program Files\Trend Micro\HijackThis.exe
    * Right click on HijackThis.exe and select Rename.
    * Type in sniper.exe and press Enter.
    * Right-click on sniper.exe and select Send To > Desktop (create shortcut)


I already had HijackThis installed but I re-installed it.  Stilll, inside the Trend Micro folder, there was no HijackThis.exe file, only a Backups folder, hijackthis text document  and a HijackThis icon which opens the program when you double-click it.  I did a search and the HijackThis.exe file did not show up.  Is it necessary to rename this file to sniper.exe (and why do you do that, anyway)?

I have initiated this malware removal process because I started getting this error when starting up:  "Error loading dll32  The specified module could not be found."  I cannot open my web browser (Firefox) now on my user account.  I'm assuming the error message relates to the browser problem.  So I now have to go into my daughter's user account to get online and begin this process of communicating with you.  By the way, I have given her account administrator rights so I can proceed. I have done all the steps in your prepatory bulletin up to the "HijackThis - rename to sniper" step and now am hitting this snag of not finding the HijackThis.exe file.  What do you propose?

Quote

and a HijackThis icon which opens the program when you double-click it.

• R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/ymsgr/*http://www.yahoo.com/ext/search
• O4 - HKUS\S-1-5-21-1960408961-448539723-725345543-1003\..\Run: [dll] rundll32 dll32,sm (User \'user pc\')

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.
• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.
.
----------

Go to:

• Start
• Run
• type: CLEANMGR.EXE
  
• Press Enter.
When prompted select the

• Temporary Internet Files
• Downloaded Program Files
• Recycle Bin
• Temporary Files

And I'm still wondering why we re-named HijackThis to Sniper?

Also, what was the problem(s) you saw with all of the logs I sent you?  It seems Notepad had something to do with it.

Error Loading dll32  The specified module could not be found

• Double click on dds to run it.
  
• When done, DDS.txt will open.
• You will receive another prompt after a while. Click Yes at the prompt. It will take another few minutes to scan.
  
• When done, Attach.txt will open.
• Please copy and paste the contents of DDS.txt and Attach.txt in your next reply.