Originally posted by ndmmxiaomayi:
[b]Step 1
Re-download and save HijackThis to your desktop. Don't run it
directly via a browser as it makes backups. All these backups will
be lost when your temporary files are cleared.
Step 2
Please print out or save this
set of instructions as you will be rebooting the
PC.
Please download FixWareout from Subratam or Bleeping Computer.
Save it to your desktop and double click to run it.
Click Next, then Install, then make sure Run fixit
is checked (ticked) and click Finish. The fix will
begin; follow the prompts. You will be asked to reboot your
computer; please do so. Your system may take longer than usual to
load; this is normal.
At the end of the fix, you may need to restart your computer
again.
Go to Start > Control
Panel.
Double click on Network Connections.
Right click on your default connection and select
Properties.
Select the General tab. Double click on the
Internet Protocol (TCP/IP) item and select the
radio button that says Obtain DNS servers
automatically.
Press OK twice to save the settings and reboot if
it asks.
Next go to Start > Run type in
cmd. Press Enter.
Type in ipconfig /flushdns then hit Enter, type
exit hit enter
(that space between g and / is needed)
Step 3
Please post the contents of:
1. C:\Fixwareout\report.txt
2. A new HijackThis log[/b]
Fixwareout Last edited 5/15/2007
Post this report in the forums please
...
»»»»»Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdiua.exe"
»»»»»
»»»»» Postrun check
HKLM\SOFTWARE\~\Winlogon\ "system"=""
....
....
»»»»» Misc files.
....
»»»»» Checking for older varients.
....
Search five digit cs, dm, kd, jb, other, files.
The following files NEED TO BE SUBMITTED to one of the following
URL'S for further inspection.
Click browse, find the file then click submit.
http://www.virustotal.com/flash/index_en.html
Or http://virusscan.jotti.org/
»»»»» Other
C:\WINDOWS\Temp\kdiua.ren 63453 04-Aug-04
»»»»» Current runs
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil
/RemAdvDef /Migration32"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE
/SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE
/IMEName"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"AGRSMMSG"="AGRSMMSG.exe"
"fscp"="C:\\Program Files\\AVC Finger-sensing Pad
Driver\\fscp.exe"
"SunJavaUpdateSched"="\"C:\\Program
Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec
Shared\\ccApp.exe\""
"vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\"
-atboottime"
"HP Software Update"="C:\\Program Files\\HP\\HP Software
Update\\HPWuSchd2.exe"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\"
/background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"updateMgr"="C:\\Program Files\\Adobe\\Acrobat
7.0\\Reader\\AdobeUpdateManager.exe AcRdB7_0_9"
....
Hosts file was reset, If you use a custom hosts file please replace
it
C:\WINDOWS\repair\autoexec.nt missing
C:\WINDOWS\repair\Config.nt missing
»»»»» End report »»»»»
