TechSpot

Computer Check Up

By Mekaonija
Aug 22, 2006
  1. I just cleared out Spywarequake from my computer, But it seems alittle sluggish now and then, and every once and awhile an add pops up, I downloaded acouple scans off this website and they were very helpful, but im not sure if its completely gone, or is somthing else is up.
    Also, in my Task manager im not sure if there some processes I dont need on. Anyway ill send you my hjt. log. If it checks out, can you recommend any thing I can do to speed it up, or help protect it, I have Ad-aware, norton anti-virus, ccleaner, and ewido anti-spyware.
    I'm alwas running scans, I clean out everything I dont use, and I disk defrag, and use disk clean up often, so im just wondering if i should do anything else.

    Thx for your time :grinthumb
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Download the pocket Killbox programme for HERE. Extract it but don`t run it yet.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Go to add remove programmes in your control panel and uninstall anything to do with(if there).

    ??mbols the question marks can be any random letter/number etc.

    Run HJT with no other programmes open(except notepad). Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    R3 - URLSearchHook: (no name) - {99F9EC71-76EC-0165-95FF-75225689799C} - C:\WINDOWS\system32\ybeiia.dll

    R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

    O2 - BHO: (no name) - {99F9EC71-76EC-0165-95FF-75225689799C} - C:\WINDOWS\system32\ybeiia.dll

    O2 - BHO: (no name) - {D366F95A-339D-1F1E-B5FC-655391F53F90} - C:\WINDOWS\system32\fzmmqfwd.dll (file missing)

    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized

    O4 - HKCU\..\Run: [Orlpy] C:\Program Files\??mbols\l?gonui.exe

    O20 - Winlogon Notify: winrmd32 - C:\WINDOWS\SYSTEM32\winrmd32.dll

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Program Files\??mbols

    Run the killbox.exe file. When it loads type the full path to the file you would like to delete in the field and check the delete file on reboot button. press the Delete File button (looks like a red circle with a white X). It will prompt you to reboot, select no until you have finished inputting the files you want to delete, only then allow it to reboot and hopefully your files will now be deleted.

    These are the filepaths you need to enter into killbox.

    C:\WINDOWS\SYSTEM32\winrmd32.dll
    C:\WINDOWS\system32\ybeiia.dll

    Once your system has rebooted, turn system restore back on.

    Post a fresh HJT log and let me know how your system is running.

    Regards Howard :wave: :wave:

    This thread is for the use of Mekaonija only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  3. Mekaonija

    Mekaonija TS Enthusiast Topic Starter Posts: 114

    Wow thanks alot, your really fast xD

    Sorry forgot to give you new log =p

    Here it is,
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    The same nasty entries are still there.

    Install an antivirus programme and a firewall.

    The free AVG antivirus and the free Zonealarm or Kerio firewall programmes are very good. You can get them HERE, HERE and HERE.

    Install whichever firewall you chose, followed by AVG. reboot your system the required number of times and run the AVG updates.

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

    Turn off system restore.(XP/ME only) See how here.> http://www.bleepingcomputer.com/forums/tutorial56.html

    Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how here.> http://www.bleepingcomputer.com/forums/tutorial61.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how here.> http://www.bleepingcomputer.com/forums/tutorial62.html

    Run a full system scan with AVG and delete whatever it finds.

    Reboot into normal mode and turn system restore back on.

    Download and run these four tools in order. Follow the instructions for using each tool.

    Tool1 Tool2 Tool3 Tool4

    Post a fresh HJT log, only after doing the above.

    Regards Howard :)

    This thread is for the use of Mekaonija only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  5. Mekaonija

    Mekaonija TS Enthusiast Topic Starter Posts: 114

    Ok, I did everything but when I ran "Look2Me-Destroyer" and it said it would restart in about one minute, I waited 30 min and nothing happened. I tryed it agian acouple times but got nothing. But my firewalls are up now, and I deleted the stuff from the virus scan. :D

    Heres my new log
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Run HJT with no other programmes open. Click the scan button. Have HJT fix the following, by placing a tick in the little box next to(if there).

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)

    O20 - Winlogon Notify: winrmd32 - winrmd32.dll (file missing)

    Click on the fix checked button.

    Close HJT.

    Other than the above inactive entries, your HJT log is clean.

    If you have any further virus/spyware problems, please post in this thread.

    Regards Howard :)

    This thread is for the use of Mekaonija only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.
     
  7. Mekaonija

    Mekaonija TS Enthusiast Topic Starter Posts: 114

    Thanks alot =D
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...