Hijack This Log

well.. it's possible that I got those confused with the igfx or whatever they were.. lets trash em if we can, if it screws something up, Ill just delete this profile and redo it at work.. even if they are graphics files, they will reload themselves when I restart anyways…

Give me the exact locations: You said there's a 5th one? C:\WINDOWS\system32\dngxjcf_navps.dat C:\WINDOWS\system32\dngxjcf.dat C:\WINDOWS\system32\dngxjcf.exe C:\WINDOWS\system32\dngxjcf_nav.dat

yea.. all are in c:\windows\system32 c:\windows\system32\dngxjcf.exe " "dngxjcf.dat " "dngxjcf.exe " "dngxjcf_navps.dat " "dngxjcf_nav.dat there are no other system32 files that have similar names

Download Avenger by Swandog, and unzip it to your desktop or somewhere you can find it. (Do not run it yet).
http://swandog46.geekstogo.com/avenger.zip

Note: The Avenger must be run from a user account with administrator privileges,

and ONLY works on Windows 2000 and XP, and only on 32-bit versions!
If yours is a 64 bit version, do not use it, let me know.


Open a Notepad file by clicking Start > Run and typing Notepad.exe in the box, click OK.

Click Format, and ensure Word Wrap is unchecked.

Copy and Paste all the text inside the box below into Notepad.

Now save the file as RemoveFiles.txt in a location where you can find it.

Files to delete:
C:\WINDOWS\system32\dngxjcf_navps.dat
C:\WINDOWS\system32\dngxjcf.dat
C:\WINDOWS\system32\dngxjcf.exe
C:\WINDOWS\system32\dngxjcf_nav.dat

Start Avenger by double clicking on Avenger.exe.

Check Load script from file:

Click on the folder symbol below and to the right, and browse to RemoveFiles.txt.

Double click it to enter it into Avenger.

Click the green traffic light symbol.

You will be asked if you want to execute the script, answer Yes.

At this point you may get prompts from your protection systems, allow them please.

Avenger will set itself up to run the next time you re-boot, and will prompt you to re-start immediately.

Answer Yes, and allow your computer to re-boot.

Upon re-boot a command window will briefly appear on screen (this is normal).

A Notepad text file will be created C:\avenger.txt.

Copy and Paste it into your next post please, along with a new HJT log.

I dunno, but that program is the bomb! Here is the log… and Ill open some windows and see what I get.. Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\fkyhlpko ******************* Script file located at: \??\C:\oscypcih.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\WINDOWS\system32\dngxjcf_navps.dat deleted successfully. File C:\WINDOWS\system32\dngxjcf.dat deleted successfully. File C:\WINDOWS\system32\dngxjcf.exe deleted successfully. File C:\WINDOWS\system32\dngxjcf_nav.dat deleted successfully. Completed script processing. ******************* Finished! Terminate.

I think we got it beat! I went to myspace.. ebaumsworld… closed the window.. opened one.. checked the news.. opened another.. etc.. watched a video online.. and I GOT NO POPUPS! LD… you are the sheyot! I can't thank you enough! Thank you for patience, help, guidance, troubleshooting. EVERYTHING! Thank you. now.. I just have to make sure that kind of thing doesn't end up on here again.. no clue how it even got on here to begin with.. im very careful of what i browse and download…

Great job

You're more then welcome.
Glad we were able to help

Peace be with you

You can remove any programs I had you install. Use Add/Remove Programs to remove if listed there:

Log looks good


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.



If you dont have any programs like these, I would recommend that you get them.
Spywareblaster,
Spywareguard.


Also get a FREE FIREWALL and FREE ANTI VIRUS if you need one.

Only run one Anti-Virus and Firewall program.

It is critical to have both a firewall and anti virus to protect your system.

Keep your system up to date and run Adaware & Spybot, once a week works, and hopefully you will be ok from here on. Both are available below.

Do not use Ad-aware if you have McAfee's VirusScan and AntiSpyware


Safe Surfing.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

will do! thanks again.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php