I believe there are some hidden hijacks on my aunt's computer. I've scanned with spybot and ad-aware and it has removed WinAntivirus, etc. But I still can't scan on antivirus.com. Here's my log. Thanks for the help.
Download
VundoFix.exe to your desktop from here:
VundoFix.exe CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
1. Double-click
VundoFix.exe to run it.
2. Click the
Scan for Vundo button.
3. Once it's done scanning, click the
Remove Vundo button.
4. If it doesn't find anything, in the main program window, choose "
Add more files? ".
Type the next line in the box
EXACTLY AS SHOWN :
C:\WINDOWS\System32\gebyx.dll
Click
Close Window , then
Remove Vundo .
5. You will receive a prompt asking if you want to remove the files, click
YES .
6. Once you click yes, your desktop will go blank as it starts removing Vundo.
7. When completed, it will prompt that it will shutdown your computer, click
OK .
8. Turn your computer back on.
Post a new HijackThis! log , along with the contents of this file:
into this thread .
Thanks for your help.
Disable teatimer .
on the Teatimer icon in the system tray and "exit".
Then do this:
Disable Teatimer
After we have cleaned your system, please be sure to reverse this process, and re-enable Teatimer.
CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!
Run Hijack This!
Click "
Do a systen scan only ".
Then "check" the box to the left of these item(s):
Then click "
Fix checked ".
Reboot and "copy/paste" a new HijackThis log file
into this thread .
Things running better now?
Securing Your PC After An Attack
Here's my new log:
Looks good.
Thank you for choosing TomCoyote for your malware removal solutions.
M68
Securing Your PC After An Attack
Thanks for all your help. I tried to do a housecall scan on antivirus.com and when I press the launch housecall button my browser window is closed. This happens with firefox and IE. Do you think i have some more malware, or do I need to upgrade something or turn something off.
It could be just a setting someplace…..
The only other thing I can think of to check for something that might cause that would be to download/install/run the trial version of Ewido Trojan Scanner…..
You game for that?
If so, here are the directions:
Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
This program is for XP and Windows 2000 only
Don't run it yet.
Please download, install, and update the NEW free version of Ewido trojan scanner:
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu". When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK . We will fix this in a moment. From the main ewido screen, click on update in the left menu, then click the Start update button. After the update finishes (the status bar at the bottom will display "Update successful") Close Ewido. Boot in "safe" mode Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All . Click the Empty Selected button. Close the program. Run Ewido. Click on the Scanner button in the left menu, then click on Complete System Scan . This scan can take quite a while to run. If ewido finds anything, it will pop up a notification. Select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK. When the scan finishes, click on "Save Report" . This will create a text file. Make sure you know where to find this file again. Boot in normal mode.
Please post the results from
ewido and a new
hijackthis log .
I downloaded ewido, but there was no place for "Additional Options", so I could not uncheck "background guard" and "install scan via context menu". Should I continue with the rest of the instructions, or download another version?
The directions may be a bit out dated.
Please continue.
Ok here are my new logs:
Delete these files (if still present):
C:\WINDOWS\system32\actskn45.ocx -> Downloader.IstBar : No action taken.
C:\VundoFix Backups\campppid.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
C:\VundoFix Backups\kaqpmlqv.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
C:\VundoFix Backups\xpenbxrh.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
C:\VundoFix Backups\xygmoehc.exe -> Not-A-Virus.Downloader.Win32.WinFixer.i : No action taken.
C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : No action taken.
C:\WINDOWS\system32\asrrsvcj.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : No action taken.
C:\WINDOWS\system32\ywwajrld.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : No action taken.
C:\VundoFix Backups\ciagqwgm.exe -> Trojan.Small.ju : No action taken.
C:\VundoFix Backups\pbjpotwp.exe -> Trojan.Small.ju : No action taken.
C:\VundoFix Backups\yiypdljy.exe -> Trojan.Small.ju : No action taken.
I don't suppose your online virus scan problem is fixed?
Nope, It still doesn't work. I'm guessing that it is some kind of setting. Thank you again for all of your help. I think all the malware is gone now. You can consider this topic closed.
