Hello friends! I have a problem with this little keyloger. Spyboot find this malware in my pc and it says it's a registry key modified.The registry key is something with windows logon dll. When i click fix button and restart my pc nothing is working.I can't log in in my pc because logon file missing.It is possible that spyboot delete logon dll? Everytime i have to reformat my pc and after reformat the malware is in the same place in spyboot list.I try to follow the registry key (as show in spyboot) before click fix, but that key does not exist there exactly how the program say.
I make a scan in my pc with nod 32 antivirus, the sistem is clean, and this:
Logfile of HijackThis v1.99.1
Scan saved at 11:48:28 AM, on 6/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
D:\NOD\ekrn.exe
C:\WINDOWS\system32\nvsvc32.exe
D:\NOD\egui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
D:\cwshreeder\SpyNoMore\SNM.exe
D:\WINZIP\wzqkpick.exe
D:\cwshreeder\hijackthis_sfx\HijackThis.exe
O4 - HKLM\..\Run: [egui] "D:\NOD\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - Global Startup: WinZip Quick Pick.lnk = D:\WINZIP\WZQKPICK.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - D:\NOD\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - D:\NOD\ekrn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
What should i do in this case?Thank you very much!