Please Please check my logs...Please

[JasonCO]

Can Somebody Please Help Me


OK so i was a bad boy and picked up smitfraud and a bunch of other nasties...
I have followed the intrsuctions on how to remove these and at last reboot everything seems to be clean...no Bio hazzard desktop..no constant nags and the fake desktop shortcuts seem to have gone.

So all I need now is for you generous people to check my logs and give me the thumbs up or down...

I would be very grateful if this could be done.

Thanks in advance Jason

Edit.....I am still getting the following warning in a info bar where direct x dowload info usually pops up

"Warning: Possible spyware or adware infection! click here to scan your computer for spyware adware

Is this yet another problem

 

[momok]

Hi,

You may wish to copy and paste these instructions on notepad for easier reference later.

1. Boot into safe mode under your normal user name. See how HERE
   
2. Next turn on "Show all files and folders, including hidden and system". See how HERE
   
   
3. Go to start > Control Panel > Add and Remove Programs.
   Remove anything related to the following:
   
   MyWay
   
   
4. After that, run HijackThis and fix the following entries, if found (do this by placing a tick in the check boxes beside these entries and clicking "Fix checked"):
   
   R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
   R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
   O2 - BHO: BDEX System - {059947A2-838E-4773-9EE2-8AB8F53C2EDE} - C:\WINDOWS\dxpvqlmgtv.dll
   O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
   O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
   O21 - SSODL: ampkfst - {B7E322DA-A378-4C4C-9DFD-7AA8B41267D2} - C:\WINDOWS\ampkfst.dll (file missing)
   O21 - SSODL: bklgvsf - {77395246-D475-45DD-B68B-129F3BEF1CE3} - C:\WINDOWS\bklgvsf.dll (file missing)
   
   Close HJT.
   
   
5. Open notepad and copy/paste the text in the quote box below into it (all except the word QUOTE):
   
   

   File::
   C:\WINDOWS\dxpvqlmgtv.dll
   C:\WINDOWS\bklgvsf.dll
   C:\WINDOWS\ampkfst.dll
   Folder::
   C:\Program Files\MyWaySA
   C:\Program Files\MediaStarCodec
   C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}

6. Save this as CFScript on the desktop.
7. Referring to the image below, drag CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe.
   
   
   
   
8. ComboFix will begin to execute, just follow the prompts. After reboot (in case it asks to reboot), it shall produce a log for you. Post that log (Combofix.txt) in your next reply.
   
   Note: Do not mouseclick combofix's window while it is running. That may cause your system to hang
   
   
9. Reboot into normal mode and rehide your protected OS files.

Thereafter, please post fresh HJT and AVG Antispyware logs and the resultant ComboFix log from the above instructions as attachments into this thread.


Regards,
momok =)

This thread is for the use of JasonCO only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[JasonCO]

Hiya momok

Thanks again for doing this for me. Please find attached three logs as requested.

 

[momok]

Hi,

Your logs look clean now.

1. Please download and run CCleaner via step 9 of the instructions HERE.
   
   
2. Delete all files in AVG Antispyware Quarantine folder. (located in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Quarantine)
   
   
3. Turn off system restore (XP/ME only). Learn how to do that HERE.
   This will remove all the remaining nasties from your old restore points.
   
   
4. After that turn system restore back on.
   This would have created a new safe and clean restore point for your system.
   
   
5. Often times, an infection can occur again not due to the incompetence of programs, but because of user habits.
   May I recommend you to read this article.
   This can help to prevent future infections.

Should you have any further problems, please post in this thread.


Regards,
momok =)

This thread is for the use of JasonCO only. Please don't post your own virus/spyware problems in this thread. Instead, open a new thread in our security and the web forum.

 

[momok]

Thread closed. Should the original starter require it to be reopened, please PM a mod.