hjt log...please help!

[pwig]

Attached is my hjt log after following all forum instructions. Please help!

Thanks in advance!

 

[howard_hopkinso]

Hello and welcome to Techspot.

Go HERE and follow the instructions.

Then, go HERE and do likewise.

Post a fresh HJT log as a .txt attachment into this thread, only after doing the above.

Regards Howard :wave: :wave:

 

[pwig]

fresh hjt log

after following your directions, here is a fresh log.

again, thanks for helping.

 

[howard_hopkinso]

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.


Boot into safe mode. See how HERE. http://www.bleepingcomputer.com/forums/tutorial61.html

Turn off system restore.(XP/ME only) See how HERE. http://www.bleepingcomputer.com/forums/tutorial56.html

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE. http://www.bleepingcomputer.com/forums/tutorial62.html


Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

cc3bf148.exe
rdgUS2404.exe

Close task manager.

Run HJT with no other programmes open(except notepad). Have HJT fix the following, by placing a tick in the little box next to(if there).

O4 - HKLM\..\Run: [cc3bf148.exe] C:\WINDOWS\system32\cc3bf148.exe

O4 - HKCU\..\Run: [cc3bf148.exe] C:\Documents and Settings\Ralph Bryant\Local Settings\Application Data\cc3bf148.exe

O16 - DPF: {97B79133-88F0-45F0-8D57-0F2EF27D9C66} - http://85.255.114.166/1/rdgUS2404.exe

O20 - Winlogon Notify: winrvc32 - C:\WINDOWS\SYSTEM32\winrvc32.dll

Click on the fix checked button.

Close HJT.

Locate and delete the following bold files and/or directories(if there).

C:\Documents and Settings\Ralph Bryant\Local Settings\Application Data\cc3bf148.exe
C:\WINDOWS\system32\cc3bf148.exe

Run HJT again and click on the cofig button, then the misc tools button. Click the delete file on reboot button and browse to C:\WINDOWS\SYSTEM32\winrvc32.dll
Click on the winrvc32.dll file and click open. You wil be prompted to reboot your computer, click yes.

Once your computer has rebooted, turn system restore back on and post a fresh HJT log.

Regards Howard

 

[pwig]

ok, i have followed the directions and attached a new hjt file.

i should mention that all usually appears ok for a while after following the directions, then my avg software pops up and tells me that i have a trojan horse generic.wue or .bzb. i have also had a box pop up that says i have bgates.exe.

i hope that is enough information...thanks again.

 

[howard_hopkinso]

Have HJT fix this entry.

O20 - Winlogon Notify: winrvc32 - winrvc32.dll (file missing)

Other than that, your HJT log is clean.

Regards Howard

 

[pwig]

attached is the last hjt log. i think we are getting close to being healed. i will keep monitoring the situation and will post if there are more issues.

THANK YOU FOR YOUR HELP!

 

[howard_hopkinso]

Well done. Your HJT log is now clean.

Regards Howard