silver
Hi ranled,
I'm glad your machine is running better, however your machine isn't quite clean yet:
Backup Your Registry with ERUNT:
Note: to restore your registry, go to the backup folder and start ERDNT.exe
Then, open Notepad (press Start->Run, enter notepad and press OK)
Copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file.
Change the Save As Type to All Files and save it as fix.reg to your Desktop.
Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom.
Double-click it, when it asks if you want to merge with the registry, click Yes.
If you wish to remove K-Lite Pro then:
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
If you wish to remove K-Lite Pro, then add this folder to the bottom of the list: C:\Program Files\K-litePro
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.
OTMoveIt file list:
Then please do an online scan with Kaspersky:
Open Kaspersky Online Scanner in Internet Explorer
You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
Once complete, please post the OTMoveIt log, the Kaspersky log and a new HijackThis log.
I'm glad your machine is running better, however your machine isn't quite clean yet:
Backup Your Registry with ERUNT:
- Please use the following link and scroll down to ERUNT and download it.
http://aumha.org/freeware/freeware.php - For version with the Installer: use the setup program to install ERUNT on your computer
- For the zipped version: Unzip all the files into a folder of your choice, such as C:\ERUNT
Note: to restore your registry, go to the backup folder and start ERDNT.exe
Then, open Notepad (press Start->Run, enter notepad and press OK)
Copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file.
Change the Save As Type to All Files and save it as fix.reg to your Desktop.
Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom.
REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\\DOCUME~1\\RANDYL~1\\LOCALS~1\\Temp\\win36.tmp.exe"=- "C:\\WINDOWS\\TEMP\\win64.tmp.exe"=-Locate fix.reg on your Desktop, if you did it right it should look like this:[external image: Posted Image]
Double-click it, when it asks if you want to merge with the registry, click Yes.
If you wish to remove K-Lite Pro then:
- Open HijackThis, choose Do a system scan only and place a checkmark next to the following line:
O4 - HKCU\..\Run: [Shareaza] "C:\Program Files\K-litePro\K-litePro.exe" -tray
- Close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
If you wish to remove K-Lite Pro, then add this folder to the bottom of the list: C:\Program Files\K-litePro
Then, press MoveIt!
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.
OTMoveIt file list:
C:\PROGRA~1\FNTS~1\rundll32.exe C:\WINDOWS\system32\yxhgyepa.dll C:\WINDOWS\system32\adqgimyg.dll C:\WINDOWS\system32\iswkuncv.dll C:\WINDOWS\retadpu1000272.exe C:\WINDOWS\TEMP\win64.tmp.exe C:\DOCUME~1\RANDYL~1\LOCALS~1\Temp\win36.tmp.exeNow reboot your computer normally
Then please do an online scan with Kaspersky:
Open Kaspersky Online Scanner in Internet Explorer
You will be prompted to install an ActiveX component from Kaspersky,
Click Yes.
- The program will launch and then begin downloading the latest definition files:
- Once the files have been downloaded click on NEXT and then Scan Settings
- In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
- Scan Options:
Scan Mail Bases - Click OK
- Now under select a target to scan:Select My Computer
- The program will start to scan your system.
- Once the scan is complete, click on the Save as Text button and save the file to your desktop
Once complete, please post the OTMoveIt log, the Kaspersky log and a new HijackThis log.
