#1
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
Pls help with winantivirus.com and broadcaster.com virus pop-ups.. (hjt log included)
Hi there! Im new here and i really need help...ups of websites such as Broadcaster.com and Winantivirus(not really sure).com whenever i go on line.. Help with Broadcaster.com Virus Thing please ups too)SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
Didn't find the information you thought to find?Similar Threads
#2
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Hello and welcome to WindowsBBS Forums sorry for the delay in a replyVundoFix.exe Double-click *VundoFix.exe* to run it.
Click the *Scan for Vundo* button.
Once it's done scanning, click the *Remove Vundo* button.
You will receive a prompt asking if you want to remove the files, click *YES*
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click *OK*.
Please post the contents of C:\*vundofix.txt* and a new HiJackThis log.
here select Save. Save FindAWF to your desktop.awf.txt on your desktop when finished. awf.txt in notepad, select Edit > Select All > Edit > Copy > and Paste the contents.here[ select Save. Save FindAWF to your desktop.awf.txt on your desktop when finished. awf.txt in notepad, select Edit > Select All > Edit > Copy > and Paste the contents.Vundo log
HJT log, run after running Vundo tool
AWF log
#3
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
Hi.. thank yoy very much for the reply.. here are the logs::1. VundoFix log 2. New HJT log SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com3.FindAWF log
#4
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Ok, lets get what remains.here Double-click the KillBox icon on your desktop to open it
Select "Delete on Reboot "
Then select "All files ".
C:\WINDOWS\SYSTEM32\winmbj32.dll Go to the File menu, and choose "Paste from Clipboard ".
Click the red-and-white [Delete File ] button.
Click "Yes " at the Delete on Reboot prompt. Click "No " at the 'Pending Operations' prompt.
Do a system scan only ] button and look over the following entries I have listed, check the boxes [] next to them and press the [Fix Checked ] button. When you are doing this, make sure you have No IE windows, nor any other browsers open , including this one. Reboot if I have specified below, and post a fresh HijackThis log.F2 - REG:system.ini: Shell=Explorer.exe,C:\WINDOWS\system32\NETSVCS.EXE HJT
#5
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
here is the new hjt log..SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
#6
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Something seems to have respawned the Vundo again. ComboScan Alternate download link Double-click on comboscan.exe to run it, and follow the prompts.
When the scan is complete, a text file will open - ComboScan.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of ComboScan.txt in your thread back into this thread for me to view.
Note : Some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.HJT log file along with the other two logs requested, Vundo log too.
#7
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
here are the logs, Vundo was able to remove the files but one of the files removed caused an error during startup, as shown in the print screen:http://img.photobucket.com/albums/v6...ss05/error.jpg 1. VundoFix Log 2. ComboScan log SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)dss .exehttp://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
#8
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
3. Supplementary log CPU 0: Intel(R) Pentium(R) M processor 1.86GHzJS ;.JSE;.WSF;.WSH(admin) LAN Adapter --> C:\WINDOWS\system32\BCMWLU00.exe verbose /rootkey=Software\Broadcom\802.11\UninstallInfoPCI \VEN_8086&DEV_2792 PCI \VEN_8086&DEV_2592NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\setup.exe" -l0x9 REMOVE
#9
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
cont..4. new HJT log SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
#10
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Apologies for late reply.here Double-click the KillBox icon on your desktop to open it
Select "Delete on Reboot "
Then select "All files ".
C:\WINDOWS\system32\desfkjpc.dll Go to the File menu, and choose "Paste from Clipboard ".
Click the red-and-white [Delete File ] button.
Click "Yes " at the Delete on Reboot prompt. Click "No " at the 'Pending Operations' prompt.
Do a system scan only ] button and look over the following entries I have listed, check the boxes [] next to them and press the [Fix Checked ] button. When you are doing this, make sure you have No IE windows, nor any other browsers open , including this one. Reboot if I have specified below, and post a fresh HijackThis log.O2 - BHO: (no name) - {0E9A0B2C-CBF5-4969-B243-F5571EBDADD6} - C:\WINDOWS\system32\gebya.dll (file missing) HJT and post both logs back into this thread.
#11
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
sorry for the delayed reply as well... >.<1. ComboScan Log SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)dss .exehttp://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
#12
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
cont..2. HJT log SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)http://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
#13
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Looks like we have 2 more to nab, also using Killbox.C:\WINDOWS\system32\enlmcnbe.exe HJT for you. Post the entire log back here for me to see.
#14
Inactive
Profile: Join Date: Jun 2007
Posts: 42
Computer Experience:
okie doki!SP2 (WinNT 5.01.2600)SP2 (6.00.2900.2180)dss .exehttp://www.hp.com http://toolbar.google.com/tbredir?r=di&l=en&v=3.0 http ://www.hp.com
#15
SuperGeek
Profile: Join Date: May 2006
Location: PHX. AZ
Posts: 3,311
Computer Experience:
Ok, everything looks good how is the machine performing now??back up your registry
PHP Code:
REGEDIT4
[- HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2 { 314814e8 - 4224 - 11db - 81f5 - 0012f0dc2420 }]
Hit save as
All times are GMT +1. The time now is 20:14 .
