I need help with with yield manager popups, HIJ log attached

[VintageStarlet]

I have been getting annoying pop ups from yieldmanager, if you could look at my HiJackThis log and help me out, I would really appreciate it

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and follow the instructions exactly.

Once you have done that, post a fresh Hijackthis log.

Regards Howard :wave: :wave:

 

[VintageStarlet]

Thank you for responding :giddy: i followed the directions, my new hijack log is attached.

 

[howard_hopkinso]

Your system is infected with delfin adware.O4 - HKLM\..\Run: [vidctrl] C:\WINNT\system32\vidctrl\vidctrl.exe. Removal instructions can be found HERE

Once you have completed the above, please post a fresh HJT log.

Regards Howard

 

[VintageStarlet]

did i get it off? my log is attached...

 

[howard_hopkinso]

No it`s still there. you need to follow the instructions exactly.

Regards Howard

 

[VintageStarlet]

i think i got it now....

 

[RealBlackStuff]

MOVE HJT to its OWN directory, not in Desktop or Temp!
C:\Documents and Settings\Administrator.JHU-ME6KOJ489K6\Local Settings\Temp\HijackThis.exe

Boot in Safe Mode.
Press Ctrl/Alt/Del simultaneously, select Taskmanager/Processes, select the process (if there), click "End Process" for:
kapuhl.exe

Next, run a HJT scan and place a tick-mark in the little square before (if still there):
...................................................................................................
C:\WINNT\system32\kapuhl.exe

O4 - HKLM\..\Run: [KavSvc] C:\WINNT\system32\kapuhl.exe reg_run
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
...................................................................................................
Now click on the Fix Checked button in HJT.

When done, from between the dotted lines, delete the highlighted bold files.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Delete all files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
Boot normal.