Hijack This log file: Infected with "mediacodec"

netdde.dll
arpa.exe

I would like to see a copy of the files in bold.

Click start / then my computer / local disk then follow the process tree.
Or using Windows Explorer, locate the first file you want to zip.
Right click on the file and select Send To and Compressed (zipped) Folder.
This makes a copy it does not delete it.
Please zip the file and upload it here
Or email it here

Please include a link to this thread.


———————————————–

Look in your control panels add/remove programs for PuritySCAN By OIN, OuterInfo, OIN or similar , click on it and click remove.
Reboot and delete this folder if found:
C:\Program Files\PurityScan

If not listed, download and run this uninstaller:
http://www.outerinfo.com/OiUninstaller.exe

Tutorial for the uninstaller if needed

Reboot when done and delete this folder if found:
C:\Program Files\PurityScan


—————————-

Reboot & Rescan with HJT and post a new log here.
Also please describe how your computer behaves at the moment.

I'm not sure what you mean about sending you those files. I did a search for "NETDDE" and it found three files with NETDDE.EXE but none with NETDDE.DLL. One of the .EXE files was in a folder C:\I386, one was in C:\WINDOWS\SYSTEM32, and one was in C:\WINDOWS\ServicePackFiles\i386. Do you want me to compress one of those folders and send it to you? I also searched for the "ARPA" and it came back with a couple of results. ARPA.EXE-0BD7DF36.pf in C:\WINDOWS\Prefetch the others were similar to: StatusBarPanel.class in com/ms/wfc/ui Please let me know how you want to proceed. I will be going out of town as of 4:30 today until Tuesday morning. So if you don't see a reply until then, that is why. Thanks for all the help.

Download win32delfkil.exe.
Save it on your desktop. Do not run it yet.

RIGHT-CLICK HERE and Save As (in IE it's "Save Target As") in order to download DelDomains.inf to your desktop.
RIGHT-CLICK DelDomains.inf and select: Install

Double click on win32delfkil.exe and install it. This creates a new folder on your desktop: win32delfkil.
Close all windows, open the win32delfkil folder and double click on fix.bat.
The computer will reboot automatically.
Post the contents of the logfile c\windelf.txt, along with a new hijackhislog.

Due to a lack of a responce this topic is now closed.

If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

To help keep your PC clean follow the recommendations here by shelf life.