When right clicking the link in the info bar at the top and going down to properties, the name given is zheltaya_hernya. When this top bar appears, the favorites menu disappears and will not come back until IE is restarted.
Logfile of HijackThis v1.99.1
Scan saved at 1:48:57 PM, on 11/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
2. Double click on RVAXO.exe and choose unzip.
It will install to a folder called Rvaxo.
3. Now open up the Rvaxo folder and double click on RVAXO.cmd
You will see a small window pop up, and quickly some lines will run , then the window will close by itself, this is normal behavior.
Then it is possible for an uninstaller of some roque scanner to start up, do not close this but follow all prompts there, and let it run its course.
4. When it's done the computer will reboot…..press any key to reboot.
5. After reboot RVAXO will run again, let it finish
6. After it's done it will create a file called RVAXO-results.log in C:\RVAXO-results.log
7. Copy and paste it back here with a fresh HJT log.
Note:
You can use Uninstall.cmd to remove everything from RVAXO, it will be found in the RVAXO-folder on your desktop.
Thank you so much for your awesome help so far! I ran RVAXO but had some problems. I got 2 error messages. It said "Cannot export templ.txt: Error opening the file. There may be a disk or system error. The second message was the same but templ.txt was replaced with ssodl.txt. After closing the messages, it quit running and did nothing else. However, it did save a log file with no info.
—————-RVAXO.exe first run————-
Files found:
—————-RVAXO.exe first run————-
Files found:
This morning, the computer had lots more problems too. The desktop image was seemingly changed but it was actually a massive icon. It was red with a Danger message. The url for the icon is file:///C:/windows/privacy_danger/images/spacer.gif. The user is also getting a tremendous amount of popups. They look very official and say things like "Windows Security Alert: Windows has detected an internet attack attempt. Somebody's trying to infect your PC" and "Spyware Alert: Windows has detected worm.win32.NetSky"
Not sure if a new hijackthis log will help but:
Scan saved at 9:49:03 AM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Please move HJT into its own permanent folder so backups can be made and found.
example: C:\MyHJT\HiJackThis.exe, C:\Program Files\MYHJT\HiJackThis.exe or C:\MyDocuments\MyHJT\HiJackThis.exe
2. Please double-click OTMoveIt.exe to run it.
Where it says: "Paste List of Files/Folders to be Moved", copy and paste next blue part into that Window:
3. Then click the red Moveit! button below.
This will display the results in the right windows where it says Results on top
4. Copy and paste everything present in the Results window (right window) and save these results in notepad and save it on your desktop, because I need to see those results afterwards.
5. Close OTMoveIt
Note:
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
Reboot and post a fresh HijackThis log, the log from OTMoveIt and we'll take another look. MrC
I saved both HiJack This and OTMoveIt to my documents folder. Here are the logs:
OTMoveIt:
File/Folder C:\WINDOWS\advrepvto.dll not found.
File/Folder C:\WINDOWS\sdrmod.dll not found.
File/Folder C:\WINDOWS\hupsrv.dll not found.
File/Folder C:\WINDOWS\bindmod.dll not found.
File/Folder C:\WINDOWS\privacy_danger not found.
Created on 11/02/2007 11:42:01
HJT after restart:
Logfile of HijackThis v1.99.1
Scan saved at 11:46:26 AM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Open up the RVAXO folder and double click on the Uninstall.cmd, this will remove the items in C:\.
Now delete the RVAXO folder and the RVAXO.exe that you downloaded.
Now you shouldn't have any of the RVAXO on your system.
Now download RVAXO.exe again and run the ;program as outlined before.
Posts the logs back here, MrC
Hosts-file was reset, If you use a custom hosts file please replace it…
————–RVAXO.exe last run—————
Files found:
Folders Found:
————–RVAXO.exe finished—————-
HJT:
Logfile of HijackThis v1.99.1
Scan saved at 1:55:41 PM, on 11/2/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Everything seems to be going great! We have had 2 users experience similar problems within the last several months with no IT person at this location. We greatly appreciate your help and will be donating to your site. Many many thanks
Some of the programs you may have run create backups of what was deleted - you can safely delete them now: (delete folders in blue) You can also delete/uninstall the programs themselves.
If you used AVG Anti-Spyware and/or SuperAntiSpyware………..
Open up SuperAntiSpyware > Preferences > General and Start-up > Start-up Options > Uncheck > Start SAS when Windows Starts.
"SAS free" provides no real time protection so there's no need for it to be running, I suggest you keep the program and update regularly - you can use it to scan for malware. It's an excellent program. When you want to start it - just double click on the SAS icon.
AVG Anti-Spyware will provide 30 days of real time protection and then after that you can use it to scan for malware - you'll have to manually update it first.
——————Must have or do:—————–
Now that you're clean: <—-Important Step!!!!
Delete your system restore files and create a new restore point (XP only):
Note: This will remove all previous Restore Points!
1. Turn off System Restore:
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab. Check Turn off System Restore.
Click Apply, and then click OK.
Restart your computer,
2. Turn on System Restore:
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab. UnCheck Turn off System Restore.
Click Apply, and then click OK.
Visit Windows Update and install all the lastest critical updates.
Install these two free programs, they sit in the backround and protect your system from spy and adware being installed on your system, also from your browser being hijacked.
IE-SPYAD
Puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
or try the new ZonedOut
How about a firewall? The front door to your computer.
Windows firewall is not suffient…install a better one. Comodo Free Firewall ZoneAlarm*free Other free firewalls
Keep those temp files off your system use ATF Cleaner - hit "select all" then just uncheck "cookies" (uncheck cookies is optional - leave it checked if you want to delete all cookies) then "empty selected"
or CCleaner
Uncheck "Cookies" under "Internet Explorer".
That will clear out all the temp files on the system.
IMPORTANT!!
Keep your Sun Java up-to-date JRE Version 6 Update 3<–newest version
Delete ALL old versions from add/remove programs if listed first! Check HERE
Don't open e-mail attachments without first scanning them with an up-to-date anti virus program, even after doing that I would be very careful. Don't click on any executables in e-mails or any other links that you're not sure of.
Don't believe e-mails from your bank, financial institution, etc asking for personal informations - they're most likely fraudulent no matter how authentic they look.
Watch your surfing habits, don't click on or download anything you're not sure of. Don't install a program that hasn't been recommended by a reputable organization.
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
✨ Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI
