Logfile of HijackThis v1.99.1
Scan saved at 11:30:22 AM, on 6/23/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Hi Darkriku7:
I responded in the other message,guess you didn't get. Lets get you fixed.
Please download to your desktop Smitfraudfix from: http://siri.urz.free.fr/Fix/SmitfraudFix.zip . Unzip and install.
Run athe program and select option one. It will save a file named Rapport.tx on the C: Rapport.tx
1. Install ewido security suite
2. When installing, under "Additional Options" uncheck..
* Install background guard
* Install scan via context menu
3. Launch ewido, there should be an icon on your desktop, double-click it.
4. The program will now open to the main screen.
5. When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
6. You will need to update ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed.
(the status bar at the bottom will display ("Update successful")
Reboot your computer in SafeMode by doing the following:
1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.
Launch ewido:
* Click on scanner
* Click on Complete System Scan and the scan will begin.
* You will be prompted to clean the first infection.
* Select "Perform action on all infections", then proceed.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop or a location where you can find it easily.
While still in safe mode do a search for C:\WINDOWS\system32\767f9a23.exe . If found delet
Boot to normal mode
Run A HjT sacn only and place a check mark by each of the following:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchURL = prosearching.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = prosearching.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page_bak = prosearching.com
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {5102256E-CAA6-9853-A562-941C84EBE4C5} - C:\WINDOWS\system32\ukgo.dll
O2 - BHO: (no name) - {5102256E-CAA6-9853-A562-941C84EBE4C5} - C:\WINDOWS\system32\ukgo.dll
O2 - BHO: Nothing - {5f4c3d09-b3b9-4f88-aa82-31332fee1c08} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: Nothing - {686a161d-5bd1-4999-8832-6393f41e564c} - C:\WINDOWS\system32\hp100.tmp
O2 - BHO: (no name) - {B97D16D6-517F-4053-B382-03C0F4C4FFDE} - C:\WINDOWS\system32\mljjk.dll (file missing)
O4 - HKLM\..\Run: [767f9a23.exe] C:\WINDOWS\system32\767f9a23.exe
O4 - Startup: .protected
O4 - HKCU\..\Run: [767f9a23.exe] C:\Documents and Settings\Chad\Local Settings\Application Data\767f9a23.exe
O4 - Global Startup: .protected
O20 - Winlogon Notify: mljjk - C:\WINDOWS\system32\mljjk.dll (file missing)
O20 - Winlogon Notify: winghy32 - winghy32.dll (file missing)
Post back here with Ewido log. Rapport.txt log and HjT log
