Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!
This topic is locked
Member
computer.Edited by ShoalBear, 29 April 2005 - 10:52 PM.
Malware Expert
Member
Malware Expert
Member
Edited by ShoalBear, 01 May 2005 - 01:21 PM.
Malware Expert
Member
Run CleanUp again and see if it still gives you errors. It did give me an error again....so just moved onto the next step
Reboot into Normal Mode run a new HijackThis scan. Save the log file and post it here.
Malware Expert
Member
For right now, here is the current Find-It log and I will start the other steps while you look at it.
Member
The CleanUp program bombed on me yet again. I just get that error reporting box...so I have NO clue what is up with that.
Malware Expert
Member
OK, since CleanUp is giving you trouble, just uninstall it. Get this cleaner instead. Has a nice name to it to (take a look LOL).
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Go to Start->Run and type in services.msc and hit OK. Then look for Service: System Startup Service (SvcProc) and double click on it. Click on the Stop button and under Startup type, choose Disabled.
Go to Start->Run and type in cmd and hit OK. Then type in the following (hit Enter after each line):
cd windows
nail.exe /FullRemove
exit
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. While in the Registry Editor, navigate to the following (fix whatever applies, if it's not there just skip it):
HKEY_CURRENT_USER\Software\ and delete aurora
HKEY_CURRENT_USER\Software\ and delete Bolger
HKEY_CLASSES_ROOT\ and delete BolgerDll.BolgerDllObj
HKEY_CLASSES_ROOT\CLSID\ and delete {302A3240-4805-4a34-97D7-1645A0B08410}
HKEY_CLASSES_ROOT\Interface\ and delete {BB0D5ADC-028D-4185-9288-722DDCE2C757}
HKEY_CLASSES_ROOT\TypeLib\ and delete {92DAF5C1-2135-4E0C-B7A0-259ABFCD3904}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon Driver and delete DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon Driver and delete DrPMon.dll
If any of the above registry keys are giving you problems deleting, right click on them and click on Permissions. Then click on the Advanced button. Make sure the first box (Inherit from parent...) is checked. Click OK and OK. Then try deleting the entry again. Once you're done, close the Registry Editor.
Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click 'Kill process' for each one if they are still listed (they shouldn't be - but double check):
c:\windows\system32\xdsvdi.exe
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O4 - HKLM\..\Run: [rjalmxl] c:\windows\system32\xdsvdi.exe
Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:
C:\WINDOWS\system32\cajsir.exe
C:\WINDOWS\atndflmgy.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\svcproc.exe
C:\WINDOWS\Bolger.dll
c:\windows\system32\xdsvdi.exe
Run CCleaner. Restart. Give me a new log for HijackThis, FindIts, remv3 and rkfiles - all together in your next reply. I want to see all of them.
Malware Expert
Member
Yes, that's correct. Should be more clear next time.
After you are done with the fixes, restart first. Run HijackThis and then boot into safe mode to run rkfiles, remv3 and FindIts.
I swear I am not trying to be difficult.....but....this is the first time you are having me run findits in safe mode. Just want to be sure I don't garfarckle this up. 
Member
OK, since CleanUp is giving you trouble, just uninstall it. Get this cleaner instead. Has a nice name to it to (take a look LOL).
Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Go to Start->Run and type in services.msc and hit OK. Then look for Service: System Startup Service (SvcProc) and double click on it. Click on the Stop button and under Startup type, choose Disabled. This was all already done
Go to Start->Run and type in cmd and hit OK. Then type in the following (hit Enter after each line):
cd windows
nail.exe /FullRemove
exit
Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. While in the Registry Editor, navigate to the following (fix whatever applies, if it's not there just skip it):
HKEY_CURRENT_USER\Software\ and delete aurora
HKEY_CURRENT_USER\Software\ and delete Bolger
HKEY_CLASSES_ROOT\ and delete BolgerDll.BolgerDllObj There was also a BolgerDll.BolgerDllObj.1 so I got rid of that puppy too!
HKEY_CLASSES_ROOT\CLSID\ and delete {302A3240-4805-4a34-97D7-1645A0B08410}
HKEY_CLASSES_ROOT\Interface\ and delete {BB0D5ADC-028D-4185-9288-722DDCE2C757}
HKEY_CLASSES_ROOT\TypeLib\ and delete {92DAF5C1-2135-4E0C-B7A0-259ABFCD3904}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Print\Monitors\ZepMon Driver and delete DrPMon.dll
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\ZepMon Driver and delete DrPMon.dll This was not there, so I moved onto next step
If any of the above registry keys are giving you problems deleting, right click on them and click on Permissions. Then click on the Advanced button. Make sure the first box (Inherit from parent...) is checked. Click OK and OK. Then try deleting the entry again. Once you're done, close the Registry Editor.
Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click 'Kill process' for each one if they are still listed (they shouldn't be - but double check):
c:\windows\system32\xdsvdi.exe You were right, this was not there
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O4 - HKLM\..\Run: [rjalmxl] c:\windows\system32\xdsvdi.exe This did not exist
Delete the following Files/Folders (delete folders if no filename is specified) according to their directory (if none, just do a search for them) and delete them if they exist:
C:\WINDOWS\system32\cajsir.exe Did not exist
C:\WINDOWS\atndflmgy.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\svcproc.exe
C:\WINDOWS\Bolger.dll Access Denied, was not able to delete this file
c:\windows\system32\xdsvdi.exeDid not exist
Run CCleaner. Restart. Give me a new log for HijackThis, FindIts, remv3 and rkfiles - all together in your next reply. I want to see all of them.
Edited by ShoalBear, 04 May 2005 - 01:44 PM.
0 members, 0 guests, 0 anonymous users
Community Forum Software by IP.Board
Licensed to: Geeks to Go, Inc.
Sign In
Create Account
