Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

I think this is from a winupdates or winlog virus?


  • Please log in to reply

#1
kdfish

kdfish

    New Member

  • Member
  • Pip
  • 1 posts
I ran everything in the section that it says to do before posting a hijack this log, but my computer is still going very slow and I am getting a lot of pop-ups and random downloads. The hijack this said:

Logfile of HijackThis v1.99.1
Scan saved at 11:40:43 PM, on 9/24/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\kinv\nhygdg.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\winsupdater\winsupdater.exe
C:\WINDOWS\system32\ampk\mbfa.exe
C:\WINDOWS\system32\uewvfasf\pswhupnn.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\system32\ajnrb\uvgvjiwr.exe
C:\WINDOWS\system32\mqal\yvxuommk.exe
C:\WINDOWS\system32\efdstuu\dcssuhve.exe
C:\Program Files\Common Files\Windows\services32.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\Common Files\services.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\System32\dllhost.exe
C:\PROGRA~1\eZula\mmod.exe
C:\WINDOWS\system32\vidctrl\vidctrl.exe
C:\DOCUME~1\Kellie\LOCALS~1\Temp\brivtkp.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgwb.dat
C:\WINDOWS\system32\nsvsvc\nsvsvc.exe
C:\DOCUME~1\Kellie\LOCALS~1\Temp\brivtkp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Kellie\Local Settings\Temporary Internet Files\Content.IE5\4DC32BIR\HijackThis[1].exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c.../search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://my.coastal.e...youtRootNode.uP
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: (no name) - {E5CF4C94-CCC3-CA87-C9C6-DECC346D2252} - C:\WINDOWS\system32\mlganmjf\wmeagbne.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [ConMgr.exe] "C:\Program Files\EarthLink 5.0\ConMgr.exe"
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Piolet] C:\Program Files\Piolet\Piolet.exe SILENT
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [ProSiteFinder] C:\Program Files\ProSiteFinder\prositefinder.exe
O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto
O4 - HKLM\..\Run: [jxsxtm] C:\WINDOWS\system32\oxtxrhg\jxsxtm.exe
O4 - HKLM\..\Run: [etclia] C:\WINDOWS\system32\vxfvwlo\etclia.exe
O4 - HKLM\..\Run: [mffrmja] C:\WINDOWS\system32\btsih\mffrmja.exe
O4 - HKLM\..\Run: [tlrgl] C:\WINDOWS\system32\wwvq\tlrgl.exe
O4 - HKLM\..\Run: [imlusfig] C:\WINDOWS\system32\avtm\imlusfig.exe
O4 - HKLM\..\Run: [dkcfr] C:\WINDOWS\system32\jbtlefv\dkcfr.exe
O4 - HKLM\..\Run: [grtpkf] C:\WINDOWS\system32\upnaobo\grtpkf.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [FtkCPY] "C:\Program Files\Common Files\Java\ftkcpy.exe"
O4 - HKLM\..\Run: [tvs_b] c:\Program Files\tvs\tvs_ln.exe
O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINDOWS\srchupdt.exe
O4 - HKLM\..\Run: [vcn] C:\WINDOWS\vcn.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [nhygdg] C:\WINDOWS\system32\kinv\nhygdg.exe
O4 - HKLM\..\Run: [pswhupnn] C:\WINDOWS\system32\uewvfasf\pswhupnn.exe
O4 - HKLM\..\Run: [mbfa] C:\WINDOWS\system32\ampk\mbfa.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\brivtkp.exe
O4 - HKLM\..\Run: [yvxuommk] C:\WINDOWS\system32\mqal\yvxuommk.exe
O4 - HKLM\..\Run: [uvgvjiwr] C:\WINDOWS\system32\ajnrb\uvgvjiwr.exe
O4 - HKLM\..\Run: [dcssuhve] C:\WINDOWS\system32\efdstuu\dcssuhve.exe
O4 - HKLM\..\Run: [shnin] C:\DOCUME~1\Kellie\LOCALS~1\Temp\prreltp.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\RunServices: [] winlog.exe
O4 - HKLM\..\RunOnce: [UninstallCOM] C:\WINDOWS\System32\PreUninstallCOM.exe /s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000140.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000140.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Global Startup: Clean Access Agent.lnk = C:\Program Files\Cisco\Clean Access\CCAAgent.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://activation.rr...oad/tgctlcm.cab
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...e/bridge-c9.cab
O16 - DPF: {2AAE099F-1AA7-411D-B5F0-A9D4A2AD114F} (GBWordFever Control) - http://www.gamebonus...gbwordfever.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} (Pool Control) - http://www.worldwinn...5/pool/pool.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://bin.mcafee.co...76/mcinsctl.cab
O16 - DPF: {62969CF2-0F7A-433B-A221-FD8818C06C2F} (Blockwerx Control) - http://www.worldwinn...x/blockwerx.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {651E822E-364A-4BA2-A5FE-F753CE421884} (GBWordDrop Control) - http://www.gamebonus.../gbworddrop.cab
O16 - DPF: {6944D0ED-F974-40CC-AE94-5A6ABAA2557A} (GBSolitaire Control) - http://www.gamebonus...gbsolitaire.cab
O16 - DPF: {6C6FE41A-0DA6-42A1-9AD8-792026B2B2A7} (FreeCell Control) - http://www.worldwinn...ll/freecell.cab
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinn...ed/wwlaunch.cab
O16 - DPF: {94299420-321F-4FF9-A247-62A23EBB640B} (WordMojo Control) - http://www.worldwinn...jo/wordmojo.cab
O16 - DPF: {9903F4ED-B673-456A-A15F-ED90C7DE9EF5} (Sol Control) - http://www.worldwinn...v45/sol/sol.cab
O16 - DPF: {AC2881FD-5760-46DB-83AE-20A5C6432A7E} (SwapIt Control) - http://www.worldwinn...apit/swapit.cab
O16 - DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} (Hangman Control) - http://www.worldwinn...man/hangman.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.co...,16/mcgdmgr.cab
O16 - DPF: {CA00913E-FA18-47DC-8AF7-5797E160ABB8} (GBMunchnMatchOCX New Control) - http://www.gamebonus...unchnmatch2.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://fun.gamesvill...aploader_v6.cab
O16 - DPF: {E12EB891-D000-421B-A8ED-EDE1BDCA14A0} (GolfSol Control) - http://www.worldwinn...sol/golfsol.cab
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} (WWSpades Control) - http://www.worldwinn...es/wwspades.cab
O16 - DPF: {F7FAB51C-5552-440E-A957-63A542100824} (GBEliminati Control) - http://www.gamebonus...gbeliminate.cab
O16 - DPF: {F966DD44-E369-4390-A801-19D225BEB129} (GBScramble Control) - http://www.gamebonus.../gbscramble.cab
O16 - DPF: {FFAA1B89-8221-44E5-B959-527687C824A8} (GBForbiddencity Control) - http://www.gamebonus...rbiddencity.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: imlusfigavtm - Unknown owner - C:\WINDOWS\system32\avtm\imlusfig.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: nhygdgkinv - Unknown owner - C:\WINDOWS\system32\kinv\nhygdg.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Could you help me please? Thanks
  • 0

Advertisements


#2
Metallica

Metallica

    Spyware Veteran

  • GeekU Moderator
  • 31,671 posts
Download and unzip BFUzip from http://computercops..../Merijn/bfu.zip
Run the program and click the Web button as shown here:
Posted Image

Use this URL to copy into the address bar of the Download script window:
http://metallica.geekstogo.com/p2pnetwork.bfu

Execute the script by clicking the Execute button.

If you have any questions about the use of BFU please read here:
http://metallica.gee...structions.html


Check the following items in HijackThis.
Close all windows except HijackThis and click Fix checked:

R3 - Default URLSearchHook is missing
O1 - Hosts: 216.39.69.102 view.atdmt.com

O2 - BHO: (no name) - {0AD937E7-2F37-4873-A05E-548A67EF1D0E} - (no file)
O2 - BHO: (no name) - {E5CF4C94-CCC3-CA87-C9C6-DECC346D2252} - C:\WINDOWS\system32\mlganmjf\wmeagbne.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll

O4 - HKLM\..\Run: [ProSiteFinder] C:\Program Files\ProSiteFinder\prositefinder.exe
O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto
O4 - HKLM\..\Run: [jxsxtm] C:\WINDOWS\system32\oxtxrhg\jxsxtm.exe
O4 - HKLM\..\Run: [etclia] C:\WINDOWS\system32\vxfvwlo\etclia.exe
O4 - HKLM\..\Run: [mffrmja] C:\WINDOWS\system32\btsih\mffrmja.exe
O4 - HKLM\..\Run: [tlrgl] C:\WINDOWS\system32\wwvq\tlrgl.exe
O4 - HKLM\..\Run: [imlusfig] C:\WINDOWS\system32\avtm\imlusfig.exe
O4 - HKLM\..\Run: [dkcfr] C:\WINDOWS\system32\jbtlefv\dkcfr.exe
O4 - HKLM\..\Run: [grtpkf] C:\WINDOWS\system32\upnaobo\grtpkf.exe

O4 - HKLM\..\Run: [FtkCPY] "C:\Program Files\Common Files\Java\ftkcpy.exe"
O4 - HKLM\..\Run: [tvs_b] c:\Program Files\tvs\tvs_ln.exe
O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINDOWS\srchupdt.exe
O4 - HKLM\..\Run: [vcn] C:\WINDOWS\vcn.exe

O4 - HKLM\..\Run: [nhygdg] C:\WINDOWS\system32\kinv\nhygdg.exe
O4 - HKLM\..\Run: [pswhupnn] C:\WINDOWS\system32\uewvfasf\pswhupnn.exe
O4 - HKLM\..\Run: [mbfa] C:\WINDOWS\system32\ampk\mbfa.exe
O4 - HKLM\..\Run: [version] C:\WINDOWS\system32\brivtkp.exe
O4 - HKLM\..\Run: [yvxuommk] C:\WINDOWS\system32\mqal\yvxuommk.exe
O4 - HKLM\..\Run: [uvgvjiwr] C:\WINDOWS\system32\ajnrb\uvgvjiwr.exe
O4 - HKLM\..\Run: [dcssuhve] C:\WINDOWS\system32\efdstuu\dcssuhve.exe
O4 - HKLM\..\Run: [shnin] C:\DOCUME~1\Kellie\LOCALS~1\Temp\prreltp.exe
O4 - HKLM\..\Run: [vidctrl] C:\WINDOWS\system32\vidctrl\vidctrl.exe
O4 - HKLM\..\Run: [Nsv] C:\WINDOWS\system32\nsvsvc\nsvsvc.exe
O4 - HKLM\..\RunServices: [] winlog.exe

O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000140.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000140.exe
O4 - HKCU\..\Run: [eZmmod] C:\PROGRA~1\ezula\mmod.exe

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...e/bridge-c9.cab

O23 - Service: imlusfigavtm - Unknown owner - C:\WINDOWS\system32\avtm\imlusfig.exe

O23 - Service: nhygdgkinv - Unknown owner - C:\WINDOWS\system32\kinv\nhygdg.exe

Reboot into safe mode and delete:
C:\WINDOWS\system32\mlganmjf <= entire folder
C:\Program Files\DNS <= entire folder
C:\Program Files\ProSiteFinder <= entire folder
C:\WINDOWS\system32\oxtxrhg <= entire folder
C:\WINDOWS\system32\vxfvwlo <= entire folder
C:\WINDOWS\system32\btsih <= entire folder
C:\WINDOWS\system32\wwvq <= entire folder
C:\WINDOWS\system32\jbtlefv <= entire folder
C:\WINDOWS\system32\upnaobo <= entire folder
C:\Program Files\Common Files\Java\ftkcpy.exe
c:\Program Files\tvs <= entire folder
C:\WINDOWS\srchupdt.exe
C:\WINDOWS\vcn.exe
C:\WINDOWS\system32\uewvfasf <= entire folder
C:\WINDOWS\system32\ampk <= entire folder
C:\WINDOWS\system32\brivtkp.exe
C:\WINDOWS\system32\mqal <= entire folder
C:\WINDOWS\system32\ajnrb <= entire folder
C:\WINDOWS\system32\efdstuu <= entire folder
C:\WINDOWS\system32\vidctrl <= entire folder
C:\WINDOWS\system32\nsvsvc <= entire folder
C:\Program Files\Common Files\Windows\mc-58-12-0000140.exe
C:\Program Files\Common Files\mc-58-12-0000140.exe
C:\Program Files\PartyPoker <= entire folder
C:\WINDOWS\system32\kinv <= entire folder
C:\WINDOWS\system32\avtm <= entire folder

And (still in safe mode) use the DiskCleanup Tool to empty all your Temp folders.

Click Start > Run type services.msc > OK
In the list of services find:
nhygdgkinv
Rightclick that line and choose Properties.
On the General tab Stop and set the service to disabled.
In HijackThis click Config > Misc Tools > Delete an NT service
In the dialog box paste: nhygdgkinv

Repeat that procedure for:
imlusfigavtm

Boot back to normal and post a new HIjackThis log.

Regards,
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP