Hello everyone,
I can usually remove spyware/adware myself without difficulty but this one particular trojan I have is a doozie. Can someone please help me??
I believe it is a Vundo stored in stubborn DLL files in the C:\WINDOWS\SYSTEM32 directory. Specifically, they appear in my hijackthis log (full log attached) as this line:
O20 - AppInit_DLLs: C:\WINDOWS\system32\wunufaku.dll C:\WINDOWS\system32\nizukipu.dll c:\windows\system32\hejivego.dll
For the life of me I cannot remove these three files! Here are the things I've attempted so far, and I've tried them in both regular and safe mode:
Initially I did the following scans:
- AVG Free Antivirus 8.0 full system scan
- Lavasoft Ad-aware
- Spyware Doctor
- CCleaner
- VundoFix.exe
- HijackThis (removing clearly bad entries)
Each found some infections and claimed to remove them.
Then I noticed that about 10 bad DLLs were in my System32 folder still not removed... So I used HijackThis's "delete file on reboot" utility to remove most of them... But the three listed above will not delete. Then I tried:
- FileAssassin - the program crashes (error message "needs to be shutdown") whenever I try either "FileAssassin's method" or "delete on reboot"
- KillBox - tried to delete on reboot but keeps giving me the "PendingFileRenameOperations Registry Data has been Removed by External Process" error; and when reboot is done manually, nothing happens. Here is log:
Pocket Killbox version 2.0.0.881
Running on Windows XP as Administrator
was started @ Sunday, January 04, 2009, 8:28 AM
# 1 [Delete on Reboot]
Path = c:\windows\system32\nizukipu.dll
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 8:29:16 AM
Killbox Closed(Exit) @ 8:29:23 AM
I feel like I tried everything and nothing works... the files are still there causing popups and slowing down my computer! PLEASE HELP ME! thanks!!!
I can usually remove spyware/adware myself without difficulty but this one particular trojan I have is a doozie. Can someone please help me??
I believe it is a Vundo stored in stubborn DLL files in the C:\WINDOWS\SYSTEM32 directory. Specifically, they appear in my hijackthis log (full log attached) as this line:
O20 - AppInit_DLLs: C:\WINDOWS\system32\wunufaku.dll C:\WINDOWS\system32\nizukipu.dll c:\windows\system32\hejivego.dll
For the life of me I cannot remove these three files! Here are the things I've attempted so far, and I've tried them in both regular and safe mode:
Initially I did the following scans:
- AVG Free Antivirus 8.0 full system scan
- Lavasoft Ad-aware
- Spyware Doctor
- CCleaner
- VundoFix.exe
- HijackThis (removing clearly bad entries)
Each found some infections and claimed to remove them.
Then I noticed that about 10 bad DLLs were in my System32 folder still not removed... So I used HijackThis's "delete file on reboot" utility to remove most of them... But the three listed above will not delete. Then I tried:
- FileAssassin - the program crashes (error message "needs to be shutdown") whenever I try either "FileAssassin's method" or "delete on reboot"
- KillBox - tried to delete on reboot but keeps giving me the "PendingFileRenameOperations Registry Data has been Removed by External Process" error; and when reboot is done manually, nothing happens. Here is log:
Pocket Killbox version 2.0.0.881
Running on Windows XP as Administrator
was started @ Sunday, January 04, 2009, 8:28 AM
# 1 [Delete on Reboot]
Path = c:\windows\system32\nizukipu.dll
PendingFileRenameOperations Registry Data has been Removed by External Process! @ 8:29:16 AM
Killbox Closed(Exit) @ 8:29:23 AM
I feel like I tried everything and nothing works... the files are still there causing popups and slowing down my computer! PLEASE HELP ME! thanks!!!