Please do not use 'Code Boxes' - it makes it very hard to review and directly address the content listing.
Please download
SmitfraudFix (by
S!Ri)
Extract the content (a folder named
SmitfraudFix) to your Desktop.
Open the
SmitfraudFix folder and double-click
smitfraudfix.cmd
Select option #1 -
Search by typing
1 and press "
Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
DO NOT RUN ANY OTHER OPTIONS UNTIL REQUESTED TO. This is very important to get an optimal and comprehensive fix.
Warning : running option #2 on a non infected computer will remove your Desktop background.
Note :
process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm
SELECT HijackThis FIX ITEMS: Scan with HijackThis and place a check next to these items:
O2 - BHO: (no name) - {2DA8327F-277A-4112-8615-05CBB1C51C9C} - C:\WINDOWS\system32\jkkjh.dll (file missing)
O2 - BHO: (no name) - {55EDB93B-6FCC-2A25-DA97-095A187E5D18} - C:\Program Files\Dnonezsy\rlzoyrvd.dll
O2 - BHO: (no name) - {66CAB10F-77BA-48F8-98BC-09B9F717E840} - C:\WINDOWS\system32\awvts.dll (file missing)
O2 - BHO: (no name) - {7BAC7AC8-F276-4202-A83B-BD841314D4CF} - C:\WINDOWS\system32\jkhfd.dll (file missing)
O4 - HKLM\..\Run: [J2211830] rundll32 C:\WINDOWS\system32\j2211830.dll sook
O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll (file missing)
O20 - Winlogon Notify: jkkjh - C:\WINDOWS\system32\jkkjh.dll (file missing)
Make sure that all browser windows and internet links are closed, even this one!
CLICK ’FIX CHECKED’ with HijackThis.
Run Vundo again using slightly different instructions:- Double-click VundoFix.exe to run it.
- Click the Scan for Vundo button.
- Once the scan is complete, Right Click inside the listbox (white box) and click add more files
- Copy&Paste the 2 entries below into the top 2 boxes
Quote:
- C:\WINDOWS\system32\qomkihi.dll
- C:\WINDOWS\system32\vtutu.dll
|
- Click Add Files and Click Close Window
- Click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click YES
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will shutdown your computer, click OK.
- Turn your computer back on.
- Please post the contents of C:\vundofix.txt and a new HiJackThis log.