Log files from infected pc

[stevefj]

Hello all, I'm in need of some help in cleaning a virus/malware from my computer. I've followed the 8 steps for removal, and have created the requested 3 log files, which are attached.

I had a red x in my system tray that would flash a message every couple of seconds saying my computer was infected. After running the cleanup programs specified in the 8-step process, I'm no longer seeing the red x. But, please check my logs and let me know if I need to do more.

Thanks for the help.

 

[rf6647]

Option 1)
Post fresh logs. A 2nd swing through the programs may remove what follows.

Option 2)
O20 - AppInit_DLLs: karna.dat
When you fix this o20 entry it will remove the key from the registry but leave the file. You must then manually delete this file.
I did not attempt to evaluate if this was reasonable when considering all of HJT.

O21 - SSODL: ShProc - {29D1DDB4-1C38-1A51-1BEE-08C9DF958305} - C:\Program Files\kvkegn\ShProc.dll
When you fix o21 entries, HijackThis not delete the offending file listed. It is recommended that you reboot into safe mode and delete the offending file.

Here is a single result from "google" that suggests this is malware. I cannot read the language. At the end "ShProc.dll" was gone as o21 entry.
http://www.commentcamarche.net/forum/affich-8835932-your-computer-is-infected

 

[JungleNP]

Hi, I'm running Vista Home Premium SP1 and recently had a number of problems (e.g. couldn't open Task Manager) which indicated my notebook was infected. I followed the instructions on Techspot, and my logs are attached. Malware and Spyware logs now look OK (I had to run Malware three times!) but I don't know about the HijackThis log. Can someone look at it? And can you recommend what firewall and anti-virus software I should be running? I was using Norton for both.

 

[kimsland]

post removed, wrong thread, sorry

 

[rf6647]

JungleNP

It's expected that you use your own thread for submitting your logs.

Security and the Web >Upper, left corner > New Thread

Thusly you will proceed to here