Another instance of atmclk.exe / dcomcfg.exe process.
 

These two processes snuck aboard my machine when I stupidly downloaded a Windows Media Player codex update (why I haven't removed that entire ap by this point is beyond me, frankly.)

As with all the other instances of these processes, I'm recieving popups in IE windows (I don't use IE) and a faux security alert in my toolbar every once in a while, warning me that I have spyware (no duh) spam or viruses. In fact, one opened right as I typed this sentence. The icon links to one of a few various advertisement sites, offering to sell me snti virus or spyware protection.

I've read advice on how to fix this problem several times, but I'm nto savvy enough to translate that to a tailored fix for my rig, so I'd love any help that could be offered.

I've already downloaded HijackThis and SmitfraudFix, as they seem to be elements of all the suggested fixes I've seen. I just need walking through how to use the tools.

Thanks in advance, this little bug is getting quite annoying.

Re: Another instance of atmclk.exe / dcomcfg.exe process.
 

Run HJT and post the log.

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

Post the rquested logs

Re: Another instance of atmclk.exe / dcomcfg.exe process.
 

Here you go:

Re: Another instance of atmclk.exe / dcomcfg.exe process.
 

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Next, please reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart it into Normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Post a new HJT log, and the new SFF log

Re: Another instance of atmclk.exe / dcomcfg.exe process.
 

Here you go again.