Logfile of HijackThis v1.99.1
She'll live… But the rabbit died…
Rename this file:
C:\Documents and Settings\Sam\Desktop\
HijackThis.exe
To:
C:\Documents and Settings\Sam\Desktop\
fungus.exe
Reboot.
Run it and post a new log file
into this this thread .
fungus, eh?
Renaming it made the malware entries show up:
O2 - BHO: (no name) - {74BF7BD5-38B6-4217-A066-36230DC65B6B} - C:\WINDOWS\system32\jkkli.dll
The first two are "Vundo".
The last one we'll need something else to get rid of it.
This needs to go as well:
C:\Program Files\Common Files\{320D180E-0708-1033-0220-060330050002}\Update.exe
That takes something else as well….
Download
VundoFix.exe to your desktop from here:
VundoFix.exe CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
1. Double-click
VundoFix.exe to run it.
2. Click the
Scan for Vundo button.
3. Once it's done scanning, click the
Remove Vundo button.
4. If it doesn't find anything, in the main program window, choose "
Add more files? ". Type this in the box
EXACTLY AS SHOWN :
C:\WINDOWS\system32\jkkli.dll
Click
Close Window , then
Remove Vundo .
4. You will receive a prompt asking if you want to remove the files, click
YES .
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will shutdown your computer, click
OK .
7. Turn your computer back on.
Post a new HijackThis! log , along with the contents of this file:
into this thread .
Logfile of HijackThis v1.99.1
Close all browser and fix this:
O2 - BHO: (no name) - {74BF7BD5-38B6-4217-A066-36230DC65B6B} - C:\WINDOWS\system32\jkkli.dll (file missing)
Please download/unzip this:
Registry Search by Bobbi Flekman
on
regsearch.exe , and search for this:
Make sure all the boxes are chcked under "Search"
It may take a while to run, so be patient. When finished, the search results will appear in your text editor,
Paste the contents of the search results into your next post.
REGEDIT4
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.1.0
; Results at 09/08/2006 11:32:39 AM for strings:
; '{320d180e-0708-1033-0220-060330050002}'
; Strings excluded from search:
; (None)
; Search in:
; Registry Keys Registry Values Registry Data
; HKEY_LOCAL_MACHINE HKEY_USERS
[HKEY_USERS\S-1-5-21-612055754-1992646540-3716503783-1005\Software\Microsoft\Internet Explorer\TypedURLs]
"url1"="C:\\Program Files\\Common Files\\{320D180E-0708-1033-0220-060330050002}"
[HKEY_USERS\S-1-5-21-612055754-1992646540-3716503783-1005\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"{320D180E-0708-1033-0220-060330050002}"="\"C:\\Program Files\\Common Files\\{320D180E-0708-1033-0220-060330050002}\\Update.exe\" mc-110-12-0000272"
[HKEY_USERS\S-1-5-21-612055754-1992646540-3716503783-1005\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"C:\\Program Files\\Common Files\\{320D180E-0708-1033-0220-060330050002}\\Update.exe"="Update"
; End Of The Log…
Copy and paste the contents of the quote box below into notepad.
Save it as file name: "
fixme.reg " (not including the quotes). Save as file type: *All files* and save it on your Desktop.
REGEDIT4
Then, locate
fixme.reg on your desktop and it.
You will receive a prompt similar to: "Do you wish to merge the information into the registry?".
Answer '
Yes ' and wait for a message to appear similar to "Merged Successfully".
Reboot.
Delete this folder:
C:\Program Files\Common Files\
{320D180E-0708-1033-0220-060330050002} <–
FOLDER
Reboot.
Post a new HijackThis! log
into this thread .
Logfile of HijackThis v1.99.1
If this file is still around, remove it:
C:\WINDOWS\SYSTEM32\
winjjq32.dll
The log looks good.
How's it running?
Well, the file isn't there but I just got a norton popup for Dialer.generic
Is it kind enough to give you a "full path name" (i.e. C:\Windows\virus.exe)?
C:\windows\system32\cool.exe
Norton removed it but it tends to come back every hour or so. Atleast, it did before all of this. I'm not to sure what it'll do now.
If it comes back again, let me know.
If you don't post again, I'll assume things are "OK", and close this thread tomorrow.
Is it kind enough to give you a "full path name" (i.e. C:\Windows\virus.exe)?