| John_McKenna |
| (HijackThis Helper) |
| Mon Sep 05 2005 10:53 PM |
|
Re: Please check this log.
|
Hi blessa and welcome to Webuser.
You have two problems here. The Kelvir worm which probably arrived via MSN Messenger and a Lop adware/hijacker which is commonly bundled with a program called Messenger Plus (which I'm presuming you've since removed).
We'll deal with the Kelvir worm first.
Download the KELVIR REMOVAL TOOL.
Close all the running programs and disconnect the computer from the internet.
- Double-click the FxKelvir.exe file to start the removal tool.
- Click Start to begin the process, and then allow the tool to run.
- Restart the computer.
- Run the removal tool again to ensure that the system is clean.
- Reboot and post a fresh HJT log in this thread please.
** Please also confirm whether you've uninstalled Messenger Plus recently and also how many user accounts this machine has please.
** I'd also like you run the below file through Jotti's Malware Scan. Just paste the entire filepath into the Submit box at the top and paste the results back here please.
C:\WINDOWS\system32\Config2500.exe