therock247uk

Members
  • Content Count

    960
  • Joined

  • Last visited

Everything posted by therock247uk

  1. Go to where you saved Hijackthis.exe (C:\Program Files\Hijackthis) right click on Hijackthis.exe click rename, rename it to hjt.exe reopen it make a log then post it here in a reply...
  2. Please go here to upload a suspicious file for analysis. Enter your username from this forum Copy and paste the link to this thread Browse for this filename: C:\Documents and Settings\All Users\Application Data\ypwfkzup.exe In the comments, please mention that I asked you to upload this file Click on Send File Do the same for the following... C:\WINDOWS\System32\mcrh.tmp C:\WINDOWS\System32\gsaiijkj.exe C:\WINDOWS\System32\avjdrupo.dll C:\WINDOWS\System32\qhyfhewr.dll C:\WINDOWS\System32\xjs.dll C:\WINDOWS\System32\dllcache\hwxjpn.dll
  3. Download WindPFind Extract WinPFind.zip to your c:\ folder. Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode. Then open c:\WinPFind and double-click on WinPFind.exe. When the program is open, click on the Start Scan button to start scanning your computer. Be patient as this scan may take a while. When it is done, it will show a log and tell you the scan is completed. Reboot your computer back to normal mode and and post the contents of c:\WinPFind\WinPFind.txt as a reply to this topic.
  4. Open Hijackthis and click scan. Then check mark the following entries O2 - BHO: (no name) - {13F42AE3-5DB0-4D06-92BC-80E527371E37} - C:\WINDOWS\system32\nkfqldcl.dll (file missing) O2 - BHO: (no name) - {6826CC2B-8872-4FD8-AB86-5EB29702AE66} - C:\WINDOWS\system32\vtspq.dll (file missing) O2 - BHO: (no name) - {955C3849-D3A9-BD2B-D909-89ADABCC7797} - C:\WINDOWS\system32\xjs.dll O2 - BHO: (no name) - {BEA4543D-E96F-475B-8F30-C29924A74973} - C:\WINDOWS\system32\yabxy.dll (file missing) O2 - BHO: (no name) - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file) O3 - Toolbar: (no name) - {E0E899AB-F48
  5. Download ComboFix from Here or Here to your Desktop. Double click combofix.exe and follow the prompts. When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply Note: Do not mouseclick combofix's window while its running. That may cause it to stall
  6. First download AVG Anti-Spyware from HERE and save that file to your desktop. This is a 30 day trial of the program Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program. Once the setup is complete you will need run AVG Anti-Spyware and update the definition files. On the main screen select the icon "Update" then select the "Update now" link.Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed. [*]Once the update has completed select the "Scanner" icon at the t
  7. Run Vundofix again by following these instructions... Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log. Note: It is possible that VundoFix encountered a file it could not remove.
  8. Delete the files. (if present) C:\Documents and Settings\chadwickt\Local Settings\Temp\Tam01065.exe C:\Documents and Settings\chadwickt\Local Settings\Temp\TICHD003.exe C:\Documents and Settings\chadwickt\Local Settings\Temp\WinAntiVirusPro2007FreeInstall.exe C:\Documents and Settings\chadwickt\Local Settings\Temp\YazzleBundle-1281.exe C:\Program Files\Common Files\Yazzle1281OinAdmin.exe C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe C:\Program Files\Movie Maker\mepotyxo.dll C:\WINDOWS\dls0523pmw.exe C:\WINDOWS\jcgifmb.exe C:\WINDOWS\qwr67.exe C:\WINDOWS\rau001978.exe C:\WINDOWS\sy
  9. Go to where you saved Hijackthis.exe (C:\HijackThis\) right click on Hijackthis.exe click rename, rename it to hjt.exe reopen it make a log then post it here in a reply...
  10. Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Ma
  11. Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply foll
  12. Your log is clean. Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications: Detect and Remove Programs: How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware. How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to c
  13. Open Hijackthis and click scan. Then check mark the following entries O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Now close all open windows except Hijackthis and click fix checked Then post a new Hijackthis log here in a reply.
  14. Delete the backups... Then post a new Hijackthis log here in a reply and let me know how things are runnnig...
  15. Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Ma
  16. Download ComboFix from Here or Here to your Desktop. Double click combofix.exe and follow the prompts. When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply Note: Do not mouseclick combofix's window while its running. That may cause it to stall Can you also try running Vundofix in safemode? Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.
  17. Can you please give me a list of files that are in the root of the c drive? While showing hidden files? Please make sure your PC is set to show all hidden files and folders go here for instructions on how to do this. http://pchowtos.co.uk/index.php?page=tutor...=view&id=34
  18. Can you please post the log Vundofix made? c:\vundofix.txt.
  19. Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK. Please post the contents of C:\vundofix.txt and a new HiJackThis log. Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply foll
  20. Its a bug in the tool and its been pulled from use till its fixed by the coder.
  21. Congrats! *therock247uk makes a note to stay of new york roads if i ever get over there.
  22. Download WinPFind3U.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop. Close ALL OTHER PROGRAMS. Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program. Now click the Run Scan button on the toolbar. The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes. When the scan is complete Notepad will open with the report file loaded in it. Click the Format menu and make sure that Wordwrap is not checke
  23. Open Hijackthis and click scan. Then check mark the following entries O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O4 - HKCU\..\Run: [com11N] RunDll32.exe C:\WINDOWS\system32\com11N.dll,Setup O4 - HKCU\..\Run: [NSQU] "C:\Documents and Settings\Pete's\NSQU.exe" Now close all open windows except Hijackthis and click fix checked Then post a new Hijackthis log here in a reply.
  24. Open Hijackthis and click scan. Then check mark the following entries O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O4 - HKCU\..\Run: [com11N] RunDll32.exe C:\WINDOWS\system32\com11N.dll,Setup O4 - HKCU\..\Run: [wxluql] "C:\WINDOWS\system32\wxluql.exe" O4 - HKCU\..\Run: [explorer] C:\WINDOWS\explorer.exe O4 - HKCU\..\Run: [iexplore] C:\Program Files\Internet Explorer\iexplore.exe O4 - HKCU\..\Run: [1] "C:\WINDOWS\system32\1.exe" O4 - HKCU\..\Run: [wdlsjm] "C:\WINDOWS\system32\wdlsjm.exe" O4 - HK