virus removal

Hi i was just wondering if anyone can help me get rid of this virus, trojan conhook.aa.I have pc cillin anti virus and i am unable to delete or clean it. I have hijackthis downloaded but need help with what to check. If anyone can help id greatly appreciate it. thank you

Download a copy of HJTsetup.exe from one of these locations and save it to your Desktop:Location one.
Location two.
Location three.

• Double click HJTsetup.exe to begin installation.
• By default it will install to C:\Program Files\HijackThis.
• Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
• Put a check by Create a desktop icon then click Next again.
• Continue to follow the prompts from there.
• When HJT opens, click on the Do a system scan and save a log file button.
• When HJT has finished scanning, a window entitled "hijackthis.log" will open - when you close this window the log will be saved into the hijackthis folder.
• Copy and paste this into your next reply.

Also, run HJT and click on Open the Misc Tools section.

• Click Open Uninstall Manager…
• Click Save list… and save it to your Desktop.
• Copy and paste the file uninstall_list.txt into your next reply.

here is the uninstall log. I hope I did this right. Adobe Reader 7.0.9 AOL Instant Messenger ArcSoft Software Suite Atheros Client Utility Atheros Wireless LAN MiniPCI card Driver ATI - Software Uninstall Utility ATI Control Panel ATI Display Driver AVG Anti-Spyware 7.5 CD/DVD Drive Acoustic Silencer DVD-RAM Driver Google Toolbar for Internet Explorer High Definition Audio Driver Package - KB888111 Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows Media Format SDK (KB902344) Hotfix for Windows Media Format SDK (KB910998) Hotfix for Windows XP (KB893357) Hotfix for Windows XP (KB894871) Hotfix for Windows XP (KB895200) InterVideo WinDVD for TOSHIBA J2SE Runtime Environment 5.0 Update 4 Macromedia Flash Player 8 Macromedia Flash Player 8 Metamail (Toshiba Registration Utility) Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Microsoft .NET Framework 1.1 Hotfix (KB886903) Microsoft Office OneNote 2003 Microsoft Office Professional Edition 2003 Microsoft Office Standard Edition 2003 Microsoft Works MSXML 4.0 SP2 (KB927978) Office 2003 Trial Assistant Quicken 2005 QuickTime RealPlayer Basic REALTEK Gigabit and Fast Ethernet NIC Driver Realtek High Definition Audio Driver sat_screensaver_30mb Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929969) Seekmo Search Assistant Sonic DLA Sonic RecordNow! Synaptics Pointing Device Driver TOSHIBA Assist TOSHIBA ConfigFree TOSHIBA Controls TOSHIBA Hotkey Utility TOSHIBA PC Diagnostic Tool TOSHIBA Power Saver TOSHIBA Software Modem TOSHIBA Software Upgrades TOSHIBA Speech System Applications TOSHIBA Speech System SR Engine(U.S.) Version1.0 TOSHIBA Speech System TTS Engine(U.S.) Version1.0 TOSHIBA TouchPad ON/Off Utility TOSHIBA Utilities TOSHIBA Virtual Sound TOSHIBA Zooming Utility Touch and Launch Trend Micro PC-cillin Internet Security 2006 Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB931836) Viewpoint Media Player Windows Installer 3.1 (KB893803) Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB884018 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885855 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB889673 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893056

Personally I would go to Add/Remove Programs and get rid of Seekmo Search Assistant - it's slime, but it is your PC.

Download VundoFix.exe by Atribune from here and save it to your desktop.

• Close all open programs and windows as this may require a reboot.
• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will shutdown your computer, click OK.
• Turn your computer back on.
• Post the contents of C:\vundofix.txt and a new HijackThis log.

Note: It is possible that VundoFix encountered a file it could not remove - in this case, VundoFix will run on reboot - simply repeat the above instructions.

I am sorry I did the vundu but forgot to copy it and ended up removing the files without copying it. Will this effect your help?

1) Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O2 - BHO: (no name) - {54c388b2-0ab3-49bf-82a5-d62f4e2f9cd0} - C:\WINDOWS\system32\gpk127.dll (file missing)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O20 - Winlogon Notify: gpk127 - gpk127.dll (file missing)

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

2) Run Vundofix again and see if it detects anything - if it reports you're clean clean, you're about done.

3) I'd like you to run an online scan just as a double check:

Run the following online scan: Panda ActiveScan.

• Please note that IE is required to run this scan.
• You will need to fill in the "Country, region, email address" information before you can download and install the ActiveX components necessary to run the scan.
• Decide whether you want to click the radio button underneath this part that says -
  "I do not want to receive marketing information from Panda Software and/or its International Representatives where applicable." - it's your choice!
• When you are asked to "Select a device to scan…", click on "My Computer".

When the scan has finished, click See Report > Save Report which by default will save the scan results as Activescan.txt in My Documents.

Copy and paste the result of the above scan into your next reply along with a fresh HJT log AND a description of how your PC is running.

here is the log from the activescan. I ran the vundo prior to this and nothing came up. Incident Status Location Adware:adware/zango Not disinfected c:\windows\downloaded program files\ClientAX.dll Potentially unwanted tool:application/winantivirus2006 Not disinfected c:\program files\common files\WinAntiVirus Pro 2006 Adware:adware/seekmo Not disinfected c:\program files\Seekmo Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@2o7[2].txt Spyware:Cookie/888 Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@888[2].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@adrevolver[1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@adrevolver[3].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@adultfriendfinder[1].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@advertising[1].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@apmebf[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@atwola[2].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@azjmp[2].txt Spyware:Cookie/Banner Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@banner[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@belnk[1].txt Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@bravenet[1].txt Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@casalemedia[1].txt Spyware:Cookie/Ccbill Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@ccbill[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@cgi-bin[1].txt Spyware:Cookie/360i Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@ct.360i[2].txt Spyware:Cookie/Coremetrics Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@did-it[1].txt Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@doubleclick[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@drivecleaner[1].txt Spyware:Cookie/Entrepreneur Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@entrepreneur[1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@errorsafe[1].txt Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@fastclick[1].txt Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@findwhat[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@go[1].txt Spyware:Cookie/Humanclick Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@hitbox[2].txt Spyware:Cookie/Screensavers Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@maxserving[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@mediaplex[1].txt Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@questionmarket[2].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@realmedia[2].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@statcounter[2].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Reliablestats Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Systemdoctor Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@systemdoctor[2].txt Spyware:Cookie/Mammamediasolutions Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@targetnet[1].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@target[1].txt Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@trafficmp[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@tribalfusion[1].txt Spyware:Cookie/WebPower Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@webpower[1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@winantispyware[2].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@winantivirus[2].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/Winantivirus Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][2].txt Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica [removed][1].txt Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Jessica Senger\Cookies\jessica senger@zedo[2].txt Potentially unwanted tool:Application/Winantivirus2006 Not disinfected C:\Documents and Settings\Jessica Senger\Local Settings\Temp\ICD2.tmp\UERS_9999_N91S2507NetInstaller.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Jessica Senger\Local Settings\Temp\tmp14.tmp.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Jessica Senger\Local Settings\Temp\tmp168.tmp.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Jessica Senger\Local Settings\Temp\tmp1B.tmp.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Jessica Senger\Local Settings\Temp\tmp37.tmp.exe Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Jessica Senger\Local Settings\Temp\tmp67.tmp.exe

1) Download ATF Cleaner by Atribune from here and save it to your Desktop.
Double click ATF-Cleaner.exe to run the program.
Check the boxes to the left of:Windows Temp
Current User Temp
All Users Temp
Cookies - You have a lot of tracking cookies showing in the Panda log and this will remove them. If you have any cookies that you keep, such as for automatically logging into forums, then you will either need the passwords to log in as normal or you will need to refer to the Panda log and delete each of the detected cookies manually and omit this particular option.
Temporary Internet Files
Java Cache
The rest are optional - if you want to remove the lot, check "Select All".
Finally click Empty Selected. When you get the "Done Cleaning" message, click OK.

If you use the Firefox or Opera browsers, you can use this program as a quick way to tidy those up as well.

When you have finished, click on the Exit button in the Main menu.

For Technical Support, double-click the e-mail address located at the bottom of each menu.

2) Remove any/all of the following files/folders that you can find:

Files

c:\windows\downloaded program files\ClientAX.dll

As an example:
To delete C:\WINDOWS\system32\filetogo.bye
Double click the My Computer icon on your Desktop.
Double click on Local Disc (C:)
Double click on the Windows folder,
Double click on the System 32 folder,
Right click on filetogo.bye and from the menu that appears, click on 'Delete'

Folders

c:\program files\common files\WinAntiVirus Pro 2006

As an example:
To delete C:\WINDOWS\system32\foldertogo
Double click the My Computer icon on your Desktop.
Double click on Local Disc (C:)
Double click on the Windows folder,
Double click on the System 32 folder,
Right click on foldertogo and from the menu that appears, click on 'Delete'

3) You are running an old version of Sun Java which needs updating:

• Go here and click on the Download button to the right of Java Runtime Environment (JRE) 6.0.
• Accept the license agreement by clicking the appropriate radio button and then continue.
• Under Windows Platform - Java™ SE Runtime Environment 6, click the Windows Offline Installation, Multi-language link.
• Go to Add/Remove Programs and remove any entries that refer to Java 2 Runtime Environment and then reboot your PC.
• Navigate to and delete the following folder, if it exists: C:\Program Files\Java.
• Finally double click the installation file that you downloaded earlier.

4) As long as the above goes OK, I want you to run your PC as normal for a few days. When you are happy that everything is fine, do the following:

Update your anti-virus program,
Disable System Restore,
Boot into Safe Mode,
Scan your computer for viruses.
When you get the all clear, reboot into Normal Mode.
Re-enable System Restore,
Create a Restore Point.
This will give a clean Restore Point should you need it in the future.
A tutorial for System Restore is available here.

The reason for waiting is that if removing the malware has caused a problem, which it occasionally does, you can put your PC back to how it was before the fix. This will re-install the malware, but an infected PC is better than an expensive paperweight!

Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php