Webuser Forums: Hijack this log info

Download Killbox from here.

Double-click killbox.exe on your desktop.
Select the option "Delete on reboot".
Now highlight and 'copy' the entire list of filepaths below:

C:\PROGRAM FILES\COMMON FILES\svchost.exe
C:\GatorPatch.log
C:\WINDOWS\Downloaded Program Files\em-meuk.exe
C:\WINDOWS\Downloaded Program Files\btwebcontrol.dll
C:\WINDOWS\Downloaded Program Files\btwebcontrol.inf
C:\WINDOWS\Downloaded Program Files\axfreeaccess.dll
C:\WINDOWS\stisvsq.exe
C:\WINDOWS\csrss.dll
C:\WINDOWS\winlogon.dll
C:\WINDOWS\smssa.dll
C:\WINDOWS\uvchost.dll
C:\WINDOWS\taskmgr.dll
C:\WINDOWS\svshost.exe
C:\WINDOWS\msqdevl.exe
C:\WINDOWS\lssas.exe
C:\WINDOWS\mservice.exe
C:\Program Files\Internet Explorer\ybgdisuh.exe
C:\Program Files\Internet Explorer\ofyglegc.exe
C:\Program Files\Internet Explorer\txyomrdd.exe
C:\info6_s.cab

Open 'file' in the killbox menu at the top and choose 'Paste from clipboard'

Now you will see, this is pasted in the "Full Path of File to Delete"-field.
There's a little arrow (dropdown-arrow) next to that field.
If you expand it, these lines should be there together!

Then press the red button with a white X in it.
Killbox will tell you that all listed files will be deleted on next reboot.
Click YES

When it asks if you would like to Reboot now, click YES
If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

can you please go to WINDOWS UPDATE
and installALL critical updates. and click
HERE to get the latest IE.

then rerun the panda scan and post the log back here along with a fresh HJT log.

P.S just leave any programs i have asked you to download until we get your computer sorted it, there is still a lot of different infections there.

--------------------
IF I HAVE SAVED YOU MONEY, PLEASE CONSIDER GIVING A DONATION TO HELP IN MY FIGHT AGAINST MALWARE.

When the only tool you own is a hammer, every problem begins to look like a nail.

Post Extras

Navigation

Webuser.co.uk

Web User Alerts

Web User Network

Site Policies

Magazine Subscription

Contacts

Search