Please Help

Hello tsm2011 ,

Important: Do this before any fix.

You need to update your version of HijackThis. Open HJT> Config> Misc Tools> Check for update online. If that doesn't work, download it from my signature and remove the hijackThis.exe you have now.

Also please put your HijackThis in it's own folder, (I create a new folder in C:\ named HJT).
You can do a Right Click on any open area on the desktop, New> Folder, then rename the folder HJT.

Go to where your HijackThis is and Right Click on HijackThis.exe, select Cut, then open the new folder you just created (HJT) Right Click in the folder and select paste.


After the above:



This is what I suggest you do.

Download CWShredder from my signature below. Unzip it on the desktop.
Open CWShredder and with ALL other windows closed, click fix.


Go here and run at least one of the online scans, allow them to delete whatever they find:

TrendMicro HouseCall
eTrust AntiVirus Web Scanner
Panda ActiveScan
Note any thing that can't be fixed
Reboot when done.

Next:

Even if you've already run these, make SURE they're up-to-date and run per instructions.

Make sure you have the up-to-date versions of Spybot V 1.3 and Ad-aware SE Build 1.05 . All are free and available below.

Download Spybot, install and update. Then download Ad-aware, install, and update.

Spybot:

Install the program and launch it.

Go to Start > Programs >Spybot > Search & Destroy and choose Spybot S&D

Close ALL windows except Spybot S&D
Click the button to "Search for Updates" and download and install the Updates.
Next click the button "Check for Problems"
When Spybot is complete, it will be showing "RED" (RED) entries "BLACK" entries and "GREEN" (GREEN) entries in the window
Put a check mark beside the RED (RED) entries ONLY.
Choose "Fix Selected Problems" and allow Spybot to fix the RED (RED) entries.

Ad-Aware FULL SCAN:

Install the program and launch it.

First in the main window look in the bottom right corner and click on Check for updates now then click Connect and download the latest reference files.

From main window :Click Start then under Select a scan Mode check Perform full system scan.
Next deselect Search for negligible risk entries.
Now to scan just click the Next button.

When the scan is finished mark everything for removal and get rid of it.(Right-click the window and choose select all from the drop down menu and click Next)

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment.

Download L2mfix from one of these two locations:

http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe

Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop. Double click l2mfix.bat and select option #1 for Run Find Log by typing 1 and then pressing enter. This will scan your computer and it may appear nothing is happening, then, after a minute or 2, notepad will open with a log. Copy the contents of that log and paste it into this thread.

IMPORTANT: Do NOT run option #2 OR any other files in the l2mfix folder until you are asked to do so!

L2MFIX find log 1.03 These are the registry keys present ********************************************************************************** Winlogon/notify: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] "Asynchronous"=dword:00000000 "DllName"="" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Extensions] "Asynchronous"=dword:00000000 "DllName"="C:\\WINDOWS\\system32\\n6n6lg5s16.dll" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" ********************************************************************************** useragent: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "{5EB41C0D-55A6-4916-3C93-21DEFEE78171}"="" ********************************************************************************** Shell Extension key: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{8DD448E6-C188-4aed-AF92-44956194EB1F}"="Windows Media Player Play as Playlist Context Menu Handler" "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}"="Windows Media Player Burn Audio CD Context Menu Handler" "{F1B9284F-E9DC-4e68-9D7E-42362A59F0FD}"="Windows Media Player Add to Playlist Context Menu Handler" "{5464D816-CF16-4784-B9F3-75C0DB52B499}"="Yahoo! Mail" "{5F327514-6C5E-4d60-8F16-D07FA08A78ED}"="Auto Update Property Sheet Extension" "{F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4}"="Shell Extensions for RealOne Player" "{640167b4-59b0-47a6-b335-a6b3c0695aea}"="Portable Media Devices" "{cc86590a-b60a-48e6-996b-41d25ed39a1e}"="Portable Media Devices Menu" "{2559a1f7-21d7-11d4-bdaf-00c04f60b9f0}"="Set Program Access and Defaults" "{596AB062-B4D2-4215-9F74-E9109B0A8153}"="Previous Versions Property Page" "{9DB7A13C-F208-4981-8353-73CC61AE2783}"="Previous Versions" "{692F0339-CBAA-47e6-B5B5-3B84DB604E87}"="Extensions Manager Folder" "{1D2680C9-0E2A-469d-B787-065558BC7D43}"="Fusion Cache" "{1CE2AA40-1317-11D3-9922-00104B0AD431}"="CA_AntiVirus" "{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}"="" "{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}"="" ********************************************************************************** HKEY ROOT CLASSIDS: Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}] @="" [HKEY_CLASSES_ROOT\CLSID\{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}\InprocServer32] @="C:\\WINDOWS\\system32\\guard.tmp" "ThreadingModel"="Apartment" Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT\CLSID\{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}] @="" [HKEY_CLASSES_ROOT\CLSID\{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}\Implemented Categories] @="" [HKEY_CLASSES_ROOT\CLSID\{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}\Implemented Categories\{00021492-0000-0000-C000-000000000046}] @="" [HKEY_CLASSES_ROOT\CLSID\{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}\InprocServer32] @="C:\\WINDOWS\\system32\\wobclnt.dll" "ThreadingModel"="Apartment" ********************************************************************************** Files Found are not all bad files: Locate .tmp files: ********************************************************************************** Directory Listing of system files: Volume in drive C has no label. Volume Serial Number is 0023-062C Directory of C:\WINDOWS\System32 04/02/2005 08:33 AM 233,052 wobclnt.dll 04/02/2005 08:33 AM 234,005 fpnu0359e.dll 04/02/2005 08:32 AM 233,052 n6n6lg5s16.dll 04/01/2005 06:38 AM 233,909 i442leho1h4c.dll 03/18/2005 07:07 AM 234,910 en00l1dm1.dll 03/17/2005 11:55 PM 233,776 gp0ul3d91.dll 03/15/2005 07:34 PM 233,436 l88m0il1e8q.dll 03/15/2005 07:30 PM 233,248 KXDUZB.DLL 03/15/2005 02:06 PM 233,248 cibcatex.dll 03/15/2005 09:06 AM 232,736 vyregexp.dll 03/15/2005 09:05 AM 232,736 ucandlg.dll 12/02/2004 08:00 PM DLLCACHE 03/10/2004 04:24 PM Microsoft 11 File(s) 2,568,108 bytes 2 Dir(s) 23,415,988,224 bytes free

Close any programs you have open since this step requires a reboot.

From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.

IMPORTANT: Do NOT run any other files in the l2mfix folder unless you are asked to do so!

L2Mfix 1.03 Running From: C:\Documents and Settings\[removed]\Desktop\l2mfix RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Setting registry permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Denying C(CI) access for predefined group "Administrators" - adding new ACCESS DENY entry Registry Permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (CI) DENY –C——- BUILTIN\Administrators (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Setting up for Reboot Starting Reboot! C:\Documents and Settings\Todd\Desktop\l2mfix System Rebooted! Running From: C:\Documents and Settings\[removed]\Desktop\l2mfix killing explorer and rundll32.exe Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 [removed] Killing PID 1580 'explorer.exe' Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03 Copyright© 2002-2003 [removed] Error, Cannot find a process with an image name of rundll32.exe Scanning First Pass. Please Wait! First Pass Completed Second Pass Scanning Second pass Completed! Backing Up: C:\WINDOWS\system32\cibcatex.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\en00l1dm1.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\fpnu0359e.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\gp0ul3d91.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\i442leho1h4c.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\KXDUZB.DLL 1 file(s) copied. Backing Up: C:\WINDOWS\system32\l88m0il1e8q.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\ucandlg.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\vyregexp.dll 1 file(s) copied. Backing Up: C:\WINDOWS\system32\wobclnt.dll 1 file(s) copied. deleting: C:\WINDOWS\system32\cibcatex.dll Successfully Deleted: C:\WINDOWS\system32\cibcatex.dll deleting: C:\WINDOWS\system32\en00l1dm1.dll Successfully Deleted: C:\WINDOWS\system32\en00l1dm1.dll deleting: C:\WINDOWS\system32\fpnu0359e.dll Successfully Deleted: C:\WINDOWS\system32\fpnu0359e.dll deleting: C:\WINDOWS\system32\gp0ul3d91.dll Successfully Deleted: C:\WINDOWS\system32\gp0ul3d91.dll deleting: C:\WINDOWS\system32\i442leho1h4c.dll Successfully Deleted: C:\WINDOWS\system32\i442leho1h4c.dll deleting: C:\WINDOWS\system32\KXDUZB.DLL Successfully Deleted: C:\WINDOWS\system32\KXDUZB.DLL deleting: C:\WINDOWS\system32\l88m0il1e8q.dll Successfully Deleted: C:\WINDOWS\system32\l88m0il1e8q.dll deleting: C:\WINDOWS\system32\ucandlg.dll Successfully Deleted: C:\WINDOWS\system32\ucandlg.dll deleting: C:\WINDOWS\system32\vyregexp.dll Successfully Deleted: C:\WINDOWS\system32\vyregexp.dll deleting: C:\WINDOWS\system32\wobclnt.dll Successfully Deleted: C:\WINDOWS\system32\wobclnt.dll Desktop.ini sucessfully removed Zipping up files for submission: adding: cibcatex.dll (164 bytes security) (deflated 4%) adding: en00l1dm1.dll (164 bytes security) (deflated 5%) adding: fpnu0359e.dll (164 bytes security) (deflated 5%) adding: gp0ul3d91.dll (164 bytes security) (deflated 4%) adding: i442leho1h4c.dll (164 bytes security) (deflated 5%) adding: KXDUZB.DLL (164 bytes security) (deflated 4%) adding: l88m0il1e8q.dll (164 bytes security) (deflated 4%) adding: ucandlg.dll (164 bytes security) (deflated 4%) adding: vyregexp.dll (164 bytes security) (deflated 4%) adding: wobclnt.dll (164 bytes security) (deflated 4%) adding: clear.reg (164 bytes security) (deflated 37%) adding: echo.reg (164 bytes security) (deflated 8%) adding: desktop.ini (164 bytes security) (deflated 14%) adding: direct.txt (164 bytes security) (stored 0%) adding: lo2.txt (164 bytes security) (deflated 79%) adding: readme.txt (164 bytes security) (deflated 49%) adding: report.txt (164 bytes security) (deflated 66%) adding: test.txt (164 bytes security) (deflated 69%) adding: test2.txt (164 bytes security) (deflated 20%) adding: test3.txt (164 bytes security) (deflated 20%) adding: test5.txt (164 bytes security) (deflated 20%) adding: xfind.txt (164 bytes security) (deflated 61%) adding: backregs/258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D.reg (164 bytes security) (deflated 70%) adding: backregs/9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD.reg (164 bytes security) (deflated 70%) adding: backregs/shell.reg (164 bytes security) (deflated 61%) Restoring Registry Permissions: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Revoking access for predefined group "Administrators" Inherited ACE can not be revoked here! Inherited ACE can not be revoked here! Registry permissions set too: RegDACL 5.1 - Permissions Manager for Registry keys for Windows NT 4 and above Copyright © 1999-2001 Frank Heyne Software (http://www.heysoft.de) This program is Freeware, use it on your own risk! Access Control List for Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify: (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (NI) ALLOW Full access NT AUTHORITY\SYSTEM (IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-NI) ALLOW Read BUILTIN\Users (ID-IO) ALLOW Read BUILTIN\Users (ID-NI) ALLOW Full access BUILTIN\Administrators (ID-IO) ALLOW Full access BUILTIN\Administrators (ID-NI) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access NT AUTHORITY\SYSTEM (ID-IO) ALLOW Full access CREATOR OWNER Restoring Sedebugprivilege: Granting SeDebugPrivilege to Administrators … successful deleting local copy: cibcatex.dll deleting local copy: en00l1dm1.dll deleting local copy: fpnu0359e.dll deleting local copy: gp0ul3d91.dll deleting local copy: i442leho1h4c.dll deleting local copy: KXDUZB.DLL deleting local copy: l88m0il1e8q.dll deleting local copy: ucandlg.dll deleting local copy: vyregexp.dll deleting local copy: wobclnt.dll The following Is the Current Export of the Winlogon notify key: **************************************************************************** Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] "Asynchronous"=dword:00000000 "DllName"="" "Impersonate"=dword:00000000 "Logon"="WinLogon" "Logoff"="WinLogoff" "Shutdown"="WinShutdown" The following are the files found: **************************************************************************** C:\WINDOWS\system32\cibcatex.dll C:\WINDOWS\system32\en00l1dm1.dll C:\WINDOWS\system32\fpnu0359e.dll C:\WINDOWS\system32\gp0ul3d91.dll C:\WINDOWS\system32\i442leho1h4c.dll C:\WINDOWS\system32\KXDUZB.DLL C:\WINDOWS\system32\l88m0il1e8q.dll C:\WINDOWS\system32\ucandlg.dll C:\WINDOWS\system32\vyregexp.dll C:\WINDOWS\system32\wobclnt.dll Registry Entries that were Deleted: Please verify that the listing looks ok. If there was something deleted wrongly there are backups in the backreg folder. **************************************************************************** REGEDIT4 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved] "{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}"=- "{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}"=- [-HKEY_CLASSES_ROOT\CLSID\{9ABBEDC1-BE4E-4DFF-A93D-E43EC9F4F2CD}] [-HKEY_CLASSES_ROOT\CLSID\{258BFFAC-9F61-4BA4-8D31-8F3E289B5E2D}] REGEDIT4 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform] "SV1"="" **************************************************************************** Desktop.ini Contents: **************************************************************************** [.ShellClassInfo] CLSID={645FF040-5081-101B-9F08-00AA002F954E} {98709AA6-FA5A-438E-8B07-5A4C5F299D0C} DS3 200 **************************************************************************** 

Empty Recycle Bin Reboot and "copy/paste" a new HJT log file into this thread. Also please describe how your computer behaves at the moment.

Download this file to your desktop.
http://www.mvps.org/winhelp2002/DelDomains.inf

Right-click on the deldomains.inf file and select 'Install'

Once it is finished your Zones should be reset.

Note, if you use SpywareBlaster and/or IE/Spyads, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE/Spyads, run the batch file and reinstall the protection





Run HijackThis again and put a check by these.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com

O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch

O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rramin.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

Close ALL windows and browsers except HijackThis and click "Fix checked"




Restart in Safe Mode:
Restart your computer.

Press F8 after the Power-On Self Test (POST) is done. If the Windows Advanced Options Menu does not appear, try restarting and then pressing F8 several times after the POST screen.
Choose the Safe Mode option from the Windows Advanced Options Menu then press Enter.


Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Search for and delete these files if listed:
C:\WINDOWS\system32\rramin.exe




Open C:\Windows\Prefetch\ Delete ALL files in this folder.


Do this also if these Temp Folders are part of your OS.

Also in safe mode navigate to the C:\Windows\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.


Next navigate to the C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp folder. Open the Temp folder and go to Edit > Select All then Edit > Delete to delete the entire contents of the Temp folder.

Finally go to Control Panel > Internet Options. On the General tab under "Temporary Internet Files" Click "Delete Files". Put a check by "Delete Offline Content" and click OK. Click on the Programs tab then click the "Reset Web Settings" button. Click Apply then OK.


Empty the Recycle Bin

Reboot and "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

Download KillBox.zip from here:
http://www.downloads.subratam.org/KillBox.zip
Place it in a folder on your Desktop.

Extract KillBox from the zip file and double-click on KillBox.exe to run it.

In the main screen of Pocket KillBox, go to Tools in the top menu bar, and select: Delete Temp Files.

Back at the main screen of KillBox, select the option: Delete on Reboot

In the Full Path of File to Delete box, copy and paste this entry:
C:\WINDOWS\system32\rramin.exe
Press the button with a red circle and a white X.
When asked if you would like to Reboot, select Yes.




Run Hijack This again and put a check by these. If listed:

O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rramin.exe

Close ALL windows and browsers except HijackThis and click "Fix checked"

Open C:\WINDOWS\system32\rramin.exe <–Delete file.

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.
Also please describe how your computer behaves at the moment

Lets try a few different ways. If one works, you can stop and post a new HJT log. 1.use ALT/CTRL/DEL and end the process for rramin.exe Open C:\WINDOWS\system32\rramin.exe <–Delete File 2.use ALT/CTRL/DEL and end the process for rramin Search for rramin delete everything with that name. 3.Open C:\WINDOWS\system32\rramin.exe Right click on the file Select Security see if you can add yourself to have full permissions. Then try and delete it. 4.Click Start> Run> type in CMD tap enter. type in: CD C:\WINDOWS\system32\ tap enter. Del rramin.exe