2 Intern

 • 

5.9K Posts

February 6th, 2006 22:00

These two lines are causing the error:

 

O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe

But they are just part of a major infection.

 

Download the Hoster from:


http://www.funkytoad.com/

Unpack to your desktop and run it.  If you have green print at the top then just press Restore Original Hosts then OK. 
IF you have red print then press make Hosts Writeable first.
 

 

Get DelDomain.inf from:
 
http://www.mvps.org/winhelp2002/DelDomains.inf  and then right click on it and Install. 

 


Download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet. 

Get smitrem.exe from

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

Download smitRem.exe, saving the file to your desktop.

Double click it to extract the contents to a folder of its own.

Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option. Log in as your usual login or you won't find the programs you put on the desktop
and some of the entries may not appear we want to remove will not appear in HijackTHis.

Run HijackThis and just do a Scan only. Check  then Fix Checked the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O4 - HKLM\..\Run: [winsysupd] C:\windows\winsysupd4.exe
O4 - HKLM\..\Run: [0o8w0lk0.dll] RUNDLL32.EXE 0o8w0lk0.dll,b 80702765
O4 - HKCU\..\Run: [Shell] "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [zifi] C:\stub_113_4_0_4_0.exe
O4 - HKCU\..\Run: [CU1] C:\Program Files\Common Files\VCClient\VCClient.exe
O4 - HKCU\..\Run: [CU2] C:\Program Files\Common Files\VCClient\VCMain.exe
O15 - Trusted Zone: http://*.billingnow.com
O15 - Trusted Zone: http://*.reliablestats.com
O15 - Trusted Zone: http://*.winantispyware.com
O15 - Trusted Zone: http://*.winantivirus.com
O15 - Trusted Zone: http://*.winantiviruspro.com
O15 - Trusted Zone: http://*.winfixer.com
O15 - Trusted Zone: http://*.winnanny.com
O15 - Trusted Zone: http://*.winsoftware.com
O20 - Winlogon Notify: tcpwrk - C:\WINDOWS\SYSTEM32\tcpwrk.dll
O20 - Winlogon Notify: Telephony - C:\WINDOWS\system32\d60mlgd1160.dll (file missing

open the smitRem folder and double click the RunThis.bat file to start the tool.
Follow the prompts on screen
Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.
Reboot into regular mode.  Run a new log and post it as a reply.
 
Ron
 
 

3 Apprentice

 • 

15.6K Posts

February 7th, 2006 14:00

Ron,
 
it appears she has posted a "follow-up" [or a seemingly "new" problem] here:

2 Intern

 • 

5.9K Posts

February 7th, 2006 14:00

I'm not going to chase after her.
 
Ron
No Events found!

Top