Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

I was told to post this from jfcap in live chat. [CLOSED]

Started by U_D , Aug 02 2005 03:11 PM

  • This topic is locked This topic is locked

#1
U_D
Posted 02 August 2005 - 03:11 PM

U_D

    Member

  • Member
  • PipPip
  • 50 posts
Well, I have alot of problems, and hope this will help me thanks.

Logfile of HijackThis v1.99.1
Scan saved at 5:09:21 PM, on 8/2/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\System32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\Media Manager\airsvcu.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\atwtusb.exe
C:\PROGRA~1\Cacheman\Cacheman.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\TBLMOUSE.EXE
C:\WINDOWS\system32\rundll32.exe
c:\progra~1\intern~1\iexplore.exe
C:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\U_D\My Documents\hjt\HijackThis.exe
C:\WINDOWS\system32\notepad.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fdlzcowcz...pG7V/VNPKPU.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.vznoceeoo...zTGZeS7VsM.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft...er=6&ar=msnhome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.microsoft...ie5update&O1=b1
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://traff-shop.co...an&fl=0&jv=true
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Program Files\iMesh\iMesh5\iMeshBHO.dll
O2 - BHO: (no name) - {0588F4DC-3E74-94F7-D4D8-AE466B37A62A} - C:\DOCUME~1\U_D\APPLIC~1\CURBKE~1\cool byte.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5E4B017A-A3AA-90AF-82E1-B5A0AFE23EE6} - C:\DOCUME~1\Dean\APPLIC~1\CURBKE~1\cool byte.exe
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [EasyMessage] "C:\Program Files\Zango Messenger\em2.exe" -wait
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [FILM PROXY SECT VIEW] C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\JoyLies.exe
O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta
O4 - HKCU\..\Run: [Steam] "c:\program files\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [DogMess] C:\DOCUME~1\U_D\APPLIC~1\MAPIMA~1\kind lies.exe
O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_02\bin\npjpi141_02.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O12 - Plugin for .tga: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin7.dll
O15 - Trusted Zone: http://www.listen.com
O15 - Trusted Zone: http://www.rhapsody.com
O16 - DPF: {0A79AAEF-0913-4E57-9429-59EA4377D8E9} (LaunchGame.launchGameCtrl) - http://cartoon.ongam.../LaunchGame.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O20 - Winlogon Notify: WB - C:\Program Files\Stardock\Object Desktop\WindowBlinds\fastload.dll
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  • 0

Advertisements

#2
Justin
Posted 02 August 2005 - 03:26 PM

Justin

    I do a little bit of everything

  • Member
  • PipPipPipPipPip
  • 2,353 posts
Hello, welcome to the GeekstoGo Forums!

My name is Justin, and I will be helping you clean up your system. Lets get started!

You have a CoolWebSearch infection.

Download CWShredder here to its own folder.

Update CWShredder

* Open CWShredder and click I AGREE
* Click Check For Update
* Close CWShredder

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about. Reboot your computer into normal windows.

Please reopen HiJackThis and scan your computer. Please place a check mark next to the following entries. Be sure to select only the entries that are listed below, as deleting the wrong file could cause harm to your system.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.fdlzcowcz...pG7V/VNPKPU.jsp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://web.vznoceeoo...zTGZeS7VsM.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapp...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,(Default) = about:blank
O2 - BHO: DownloadRedirect Class - {00000000-6CB0-410C-8C3D-8FA8D2011D0A} - C:\Program Files\iMesh\iMesh5\iMeshBHO.dll
O2 - BHO: (no name) - {0588F4DC-3E74-94F7-D4D8-AE466B37A62A} - C:\DOCUME~1\U_D\APPLIC~1\CURBKE~1\cool byte.exe
O2 - BHO: (no name) - {5E4B017A-A3AA-90AF-82E1-B5A0AFE23EE6} - C:\DOCUME~1\Dean\APPLIC~1\CURBKE~1\cool byte.exe


Next, please close all programs except for HiJackThis, and select Fix Checked.
Reboot your computer.

Please run Panda ActiveScan<<<Accept default settings, save and post the log

Then post a new HiJackThis log and the log from PandaScan.
  • 0

#3
U_D
Posted 02 August 2005 - 03:59 PM

U_D

    Member

  • Topic Starter
  • Member
  • PipPip
  • 50 posts
I followed what you said for cws, and nothing was detected, I'm still in safe mode and about to do the rest. Man, 640x480 sucks lol.
  • 0

#4
U_D
Posted 02 August 2005 - 05:31 PM

U_D

    Member

  • Topic Starter
  • Member
  • PipPip
  • 50 posts
Here's the panda active scan report, i forgot to reboot, would you like me to run it again after my next reboot?

Incident Status Location

Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\Byte army.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\close bore.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\HEARTTHE.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\Inter Inside.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\iso soap.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\JoyLies.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\Junk Rule.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\mail hole.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\size idle.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\HOLESHIMSURFWIPE\Media Five.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\All Users\Application Data\HOLESHIMSURFWIPE\plan kind.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Dean\Application Data\Mapimathamok\Bias trust camp send.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Dean\Application Data\Mapimathamok\jwoypqzs.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Dean\Application Data\Mapimathamok\kind lies.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Dean\Application Data\Mapimathamok\POLLRDRTWO.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\Dean\Application Data\Mapimathamok\ywjpbdho.exe
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\file\1.0\Dummy.class-4ffef27c-57c23024.class
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\file\1.0\Dummy.class-5db50b5e-7942feca.class
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\archive.jar-36bf6efc-767afa6e.zip[BlackBox.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\archive.jar-36bf6efc-767afa6e.zip[VB.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\archive.jar-36bf6efc-767afa6e.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\archive.jar-36bf6efc-767afa6e.zip[Beyond.class]
Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-786e2528.zip[InstallerApplet.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\loaderadv410.jar-1818f7fb-28fceacd.zip[Counter.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\loaderadv410.jar-1818f7fb-28fceacd.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\loaderadv410.jar-1818f7fb-28fceacd.zip[Matrix.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\U_D\.jpi_cache\jar\1.0\loaderadv410.jar-1818f7fb-28fceacd.zip[Parser.class]
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\Bias trust camp send.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\fremqknr.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\gmvjxkhw.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\iqirjifq.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\jqcdjuov.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\kind lies.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\POLLRDRTWO.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\pziyhknb.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\qyevhrye.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\tupbvlce.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\vfeemnvx.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Application Data\Mapimathamok\xsvkjzss.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\68618b6a.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\68618bd1.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\6a7a8b0c.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\nilhvvvu.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\sta99.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\vulmhbfc.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\Local Settings\Temp\zkmkibln.exe
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\My Documents\hjt\backups\backup-20050802-182049-265.dll
Adware:Adware/Lop No disinfected C:\Documents and Settings\U_D\My Documents\hjt\backups\backup-20050802-182050-200.dll
Adware:Adware/FunWeb No disinfected C:\Program Files\FunWebProducts\Installr\4.bin\F3EZSETP.DLL
Adware:Adware/KeenValue No disinfected C:\WINDOWS\browserxtras\pn\remove.exe
Adware:Adware/MyWebSearch No disinfected C:\WINDOWS\Downloaded Program Files\CursorManiaInitialSetup1.0.0.8.exe
Adware:adware/gator No disinfected C:\WINDOWS\GatorPatch.log
Spyware:Spyware/New.net No disinfected C:\WINDOWS\NDNuninstall6_38.exe
Adware:adware/twain-tech No disinfected C:\WINDOWS\smdat32a.sys
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\system32\BO2809040510.exe
Spyware:spyware/betterinet No disinfected C:\WINDOWS\system32\in10b6s.dll
Adware:adware/virtualbouncer No disinfected C:\WINDOWS\system32\INNERVBINSTALL.LOG
Adware:Adware/nCase No disinfected C:\WINDOWS\system32\msbb321.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\PopOops.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\PopOops2.dll
Adware:Adware/nCase No disinfected C:\WINDOWS\system32\SplWbr.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\SWLAD1.dll
Adware:Adware/AdDestroyer No disinfected C:\WINDOWS\system32\SWLAD2.dll
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\system32\SWRT01.dll
Adware:Adware/DealHelper No disinfected C:\WINDOWS\system32\Tmvgip.exe
  • 0

#5
Justin
Posted 02 August 2005 - 06:13 PM

Justin

    I do a little bit of everything

  • Member
  • PipPipPipPipPip
  • 2,353 posts
Hello!

There is no need to run Pandascan again...for now anyways :tazz:

1) Please download the Killbox.
Unzip it to the desktop but do NOT run it yet.

2) Then please reboot into Safe Mode by restarting your computer and pressing F8 as your computer is booting up. Then select the Safe Mode option.

3) Once in Safe Mode, please run Killbox.

4) Select "Delete on Reboot".

5) Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:(You may copy the entire list, as is. Killbox will manually take out the file name and delete it)

C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\Byte army.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\close bore.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\HEARTTHE.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\Inter Inside.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\iso soap.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\JoyLies.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\Junk Rule.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\mail hole.exe
C:\Documents and Settings\All Users\Application Data\Atomfirstfilmproxy\size idle.exe
C:\Documents and Settings\All Users\Application Data\HOLESHIMSURFWIPE\Media Five.exe
C:\Documents and Settings\All Users\Application Data\HOLESHIMSURFWIPE\plan kind.exe
C:\Documents and Settings\Dean\Application Data\Mapimathamok\Bias trust camp send.exe
C:\Documents and Settings\Dean\Application Data\Mapimathamok\jwoypqzs.exe
C:\Documents and Settings\Dean\Application Data\Mapimathamok\kind lies.exe
C:\Documents and Settings\Dean\Application Data\Mapimathamok\POLLRDRTWO.exe
C:\Documents and Settings\Dean\Application
C:\Documents and Settings\U_D\Application Data\Mapimathamok\Bias trust camp send.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\fremqknr.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\gmvjxkhw.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\iqirjifq.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\jqcdjuov.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\kind lies.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\POLLRDRTWO.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\pziyhknb.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\qyevhrye.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\tupbvlce.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\vfeemnvx.exe
C:\Documents and Settings\U_D\Application Data\Mapimathamok\xsvkjzss.exe
C:\Documents and Settings\U_D\Local Settings\Temp\68618bd1.exe
C:\Documents and Settings\U_D\Local Settings\Temp\6a7a8b0c.exe
C:\Documents and Settings\U_D\Local Settings\Temp\nilhvvvu.exe
C:\Documents and Settings\U_D\Local Settings\Temp\sta99.exe
C:\Documents and Settings\U_D\Local Settings\Temp\vulmhbfc.exe
C:\Documents and Settings\U_D\Local Settings\Temp\zkmkibln.exe
C:\Documents and Settings\U_D\My Documents\hjt\backups\backup-20050802-182049-265.dll
C:\Documents and Settings\U_D\My Documents\hjt\backups\backup-20050802-182050-200.dll
C:\Program Files\FunWebProducts\Installr\4.bin\F3EZSETP.DLL
C:\WINDOWS\browserxtras\pn\remove.exe
C:\WINDOWS\Downloaded Program Files\CursorManiaInitialSetup1.0.0.8.exe
C:\WINDOWS\GatorPatch.log
C:\WINDOWS\NDNuninstall6_38.exe
C:\WINDOWS\smdat32a.sys
C:\WINDOWS\system32\BO2809040510.exe
C:\WINDOWS\system32\in10b6s.dll
C:\WINDOWS\system32\INNERVBINSTALL.LOG
C:\WINDOWS\system32\msbb321.dll
C:\WINDOWS\system32\PopOops.dll
C:\WINDOWS\system32\PopOops2.dll
C:\WINDOWS\system32\SplWbr.dll
C:\WINDOWS\system32\SWLAD1.dll
C:\WINDOWS\system32\SWLAD2.dll
C:\WINDOWS\system32\SWRT01.dll
C:\WINDOWS\system32\Tmvgip.exe

6) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

7) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try TheKillbox again..

Let the system reboot.

Then post a new HJT log for me to look at.

Edited by Jfcap, 03 August 2005 - 11:24 AM.

  • 0

#6
U_D
Posted 03 August 2005 - 03:57 AM

U_D

    Member

  • Topic Starter
  • Member
  • PipPip
  • 50 posts
Ok, today when I get back from school and finish my homework I'll do that. Thanks.
  • 0

#7
Justin
Posted 21 August 2005 - 10:14 PM

Justin

    I do a little bit of everything

  • Member
  • PipPipPipPipPip
  • 2,353 posts
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP