TechSpot

hjt log...please help!

By pwig
Jun 28, 2006
  1. Attached is my hjt log after following all forum instructions. Please help!

    Thanks in advance!
     
  2. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Hello and welcome to Techspot.

    Go HERE and follow the instructions.

    Then, go HERE and do likewise.

    Post a fresh HJT log as a .txt attachment into this thread, only after doing the above.

    Regards Howard :wave: :wave:
     
  3. pwig

    pwig TS Rookie Topic Starter

    fresh hjt log

    after following your directions, here is a fresh log.

    again, thanks for helping.
     
  4. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


    Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

    Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

    In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html


    Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

    Click on the processes tab and end process for(if there).

    cc3bf148.exe
    rdgUS2404.exe

    Close task manager.

    Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

    O4 - HKLM\..\Run: [cc3bf148.exe] C:\WINDOWS\system32\cc3bf148.exe

    O4 - HKCU\..\Run: [cc3bf148.exe] C:\Documents and Settings\Ralph Bryant\Local Settings\Application Data\cc3bf148.exe

    O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgUS2404.exe

    O20 - Winlogon Notify: winrvc32 - C:\WINDOWS\SYSTEM32\winrvc32.dll

    Click on the fix checked button.

    Close HJT.

    Locate and delete the following bold files and/or directories(if there).

    C:\Documents and Settings\Ralph Bryant\Local Settings\Application Data\cc3bf148.exe
    C:\WINDOWS\system32\cc3bf148.exe

    Run HJT again and click on the cofig button, then the misc tools button. Click the delete file on reboot button and browse to C:\WINDOWS\SYSTEM32\winrvc32.dll
    Click on the winrvc32.dll file and click open. You wil be prompted to reboot your computer, click yes.

    Once your computer has rebooted, turn system restore back on and post a fresh HJT log.

    Regards Howard :)
     
  5. pwig

    pwig TS Rookie Topic Starter

    ok, i have followed the directions and attached a new hjt file.

    i should mention that all usually appears ok for a while after following the directions, then my avg software pops up and tells me that i have a trojan horse generic.wue or .bzb. i have also had a box pop up that says i have bgates.exe.

    i hope that is enough information...thanks again.
     
  6. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Have HJT fix this entry.

    O20 - Winlogon Notify: winrvc32 - winrvc32.dll (file missing)

    Other than that, your HJT log is clean.

    Regards Howard :)
     
  7. pwig

    pwig TS Rookie Topic Starter

    attached is the last hjt log. i think we are getting close to being healed. i will keep monitoring the situation and will post if there are more issues.

    THANK YOU FOR YOUR HELP!
     
  8. howard_hopkinso

    howard_hopkinso TS Rookie Posts: 24,177   +19

    Well done. Your HJT log is now clean.

    Regards Howard :)
     
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...