Search:

Hi Blade

Once again, many thanks for your help – and respect for your knowledge and expertise. I think that the computer is now clean – we have not noticed any further symptoms.

I have:
-...

Hi Blade

I ran ATF Cleaner. I then had a bit of difficulty running the Kaspersky scan. I could not get the link to work so I hope I have accessed the right version of the scanner. I did not get...

Hi Blade

Many thanks for your help. I can see that you good people have been really, really busy. I need to update you. I was getting desperate to get the computer back on line so I scanned...

I would very much appreciate some help in removing this bogus software from my computer. I have read the “Before you Post” information. I have not made any other requests for help. HJT log follows....

Hi Shaba,

My computer seems really, really good now. :bigthumb: No sign of any problems at the moment. Thank you for all your help. I could never cope with this type of stuff on my own. Most...

Hi Shaba,

Well this is a bit strange, but after NAV got rid of some stuff last night, Spybot S&D found Smitfraud-C.Toolbar888 and the cookies. I then used Spybot S&D to fix the problems. Now,...

No it is back again! I was not even using the computer but returned to the screen to find NAV had found the following "Trojan Horses" in C/WINDOWS/system32/:

jkff.dll
mllml.dll
ssqrs.dll...

Hi,

Thanks. That did it, C:\WINDOWS\system32\sstts.dll is gone. Is that it? Is the computer clean now? If so, are there any back-up or restore files that should be removed.

Everything...

Hi Shaba,

It's looking very good - no abnormal behaviour at the moment. Thank you very much for all the help.

I deleted C:\WINDOWS\system32\embdtxpe.dll and emptied the Recycle Bin. However I...

Kaspersky Log Part 5 (Final)

C:\Documents and Settings\Viv\Recent\TMA01 Part 1 - LETTING GO.lnk Object is locked skipped
C:\Documents and Settings\Viv\Recent\TMA01 Part 2 - THE...

Kaspersky Log Part 4:

C:\Documents and Settings\Viv\Local Settings\Temp\~WRF0000.tmp Object is locked skipped
C:\Documents and Settings\Viv\Local Settings\Temp\~WRF0001.tmp Object is...

Kaspersky Log Part 3:

C:\Documents and Settings\Viv\Local Settings\Application Data\Corel Photo Album\6\PhotoAlbumCache\10.cpathm Object is locked skipped
C:\Documents and Settings\Viv\Local...

Kaspersky Log Part 2:

C:\Documents and Settings\Viv\Application Data\Microsoft\Internet Explorer\Quick Launch\Corel Paint Shop Pro X.lnk Object is locked skipped
C:\Documents and...

Kaspersky Log Part 1:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, April 30, 2007 8:58:58 PM
Operating System:...

Hi Shaba,

I have followed your last instructions and here is the HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 21:04:00, on 30/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE:...

Final Part 5 :

C:\Documents and Settings\Viv\Recent\MARKED TMA01 Part 1.lnk Object is locked skipped
C:\Documents and Settings\Viv\Recent\MOV00158.lnk Object is locked skipped
C:\Documents and...

Part 4:

C:\Documents and Settings\Viv\Local Settings\Application Data\Microsoft\Wallpaper1.bmp Object is locked skipped
C:\Documents and Settings\Viv\Local Settings\Application...

Part 3 :

C:\Documents and Settings\Viv\Cookies\desktop.ini Object is locked skipped
C:\Documents and Settings\Viv\Cookies\index.dat Object is locked skipped
C:\Documents and...

Part 2:

C:\Documents and Settings\Viv\Application Data\Microsoft\CryptnetUrlCache\Content\2BF68F4714092295550497DD56F57004 Object is locked skipped
C:\Documents and Settings\Viv\Application...

Here is the Kaspersky log - part 1:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, April 29, 2007 9:20:28 PM
...

Hi Shaba,

I followed your latest instructions and here is the latest HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 21:29:37, on 29/04/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)...

Hi Shaba,

OK - I ran HJT and found, checked and deleted all the items in your last post.

Then deleted:
C:\WINDOWS\system32\npanyxtp.dll
C:\WINDOWS\system32\uhxndjqc.dll

I could not find:...

Hi Shaba,

This is the vundofix.txt:


VundoFix V6.3.20

Checking Java version...

Java version is 1.4.2.3

Hi Shaba,

First of all, many thanks for your help with this and thanks for the quick response. As you instructed, I downloaded HJT from the link supplied to the desktop and then opened it. It is...

Hi, We have had this menace infecting our home computer for about a week now. I have tried a lot of things myself to get rid of it, and looked up a number of previous threads, all of which has...