Hello,

Ok, I've done all the above.

SmitFraudFix v2.53

Scan done at 16:26:57.83, 02/06/2006
Run from C:\Documents and Settings\Kris\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version...

Oh dear, looks like I've come under attack from a process called atmclk.exe. My anti virus software keeps on telling me about this and other trojans. I'm getting lots of pop ups too and fake MS...

Hi, sorry that I've not gotten back to you sooner but my pc had a very major crash before I could carry out the above. Something killed most of my services and I couldn't do anything. I ended up...

PC froze again earlier. Upon restarting it wouldn't get any further than the "windows is starting up" light blue screen.
So I rebooted, pressed F8, selected "Last known good configuration" or...

Oh my! Where do you want me to start, it's packed with errors and warnings. I'm just trying to think of the exact time it crashed. Doesn't help that I can't copy and paste what it says. I've gone to...

I wish I could say it was but I keep crashing. Or rather the screen freezes and nothing will make it unfreeze so I end up having to switch off and restart. And when I restart I notice the quick...

WTF?! How did I do that! :p
Oh and now I've lost that log too, right I'll run hijackthis again...
Logfile of HijackThis v1.99.1
Scan saved at 19:57:32, on 04/12/2005
Platform: Windows XP SP2...

Ok, I've now done all that.
I made the mistake of running ewido while not in safe mode so I saved the scan log and then ran ewido in safe mode and saved the log... Unfortunately the first log has...

I don't know if it's related to the above but I've just noticed both Windows media player and movie maker don't work.

Hi

I hope this call for help is in the correct section.

Last night I noticed my CPU was continuously working at 100%. One of the svchost.exe processes seem to be the main cause of this. So I...

Think I did all that ok lol

Logfile of HijackThis v1.99.1
Scan saved at 22:25:24, on 17/05/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
...

Didn't have my disc with my while I was over there but I did the rk files thingy again and all that was left in the log was those C:\WINDOWS\system32\dfrg.msc and C:\WINDOWS\system32\oembios.bin...

Just discovered what I foolishly accidentally deleted was "C:\WINDOWS\system32\oembios.bin: peC2"y)Q" and now it's in a folder named "!Submit" - :mad: shall i move it back to system 32?

Gawd what a pain in the rear end this is.
When I deleted one of those files and restarted the computer it asked me to activate windows!! I ended up having to type the CD key whatsit thingy back in....

Ok, thanks, will do.

Below are the results from what you asked me to do earlier.
Unfortunately I could find half those files on her computer and I've marked those with an asterix.
...

I'm in a rush, I've copied those files to disc and i'll scan them on that site later and report back here but can I just add that I ran Adaware on her pc earlier and something nasty popped up and...

Oh. Ok. What do you mean by "upload"? Do you mean literally copy these nasties onto disc from her pc and them attach them to this thread? :eek:

I uploaded the file to that virus checker site and it found nothing.

Here's the log:
C:\Documents and Settings\Vickie\Desktop\New Folder

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE...

Yes her computer is becoming infested with all sorts of crap from the internet, particularly stubborn are "Derbiz" and "ebates money maker" who both seem to reappear after being deleted either on...

Sorry, the above "not" was a typing error lol. So yes I've increased the security in the Internet Options box.

Can I now delete that "notify.reg" back up I've made?

Thank you for your help. I've not increased my security settings by reading that link in your signature.

Crikey, this'll take some reading :o

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you are infected!...

Ok, here's the Findit log:

Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.

Find.bat is running...

P.S I just ran Ad-aware and VX2 is no longer on my system! :D
Does anyone know what causes it?

Ok I've done the above and here's the latest dll.compare log:

* DLLCompare Log version(1.0.0.127)
Files Found that Windows does not See or cannot Access
*Not everything listed here means you...

Yup, sorry I did switch off my computer.

Here's the VX2finder log:
Log for VX2.BetterInternet File Finder (ALL)

Files Found---

Additional Files---

Keys Under Notify---

Ok, This is my hijackthis log:


Logfile of HijackThis v1.99.0
Scan saved at 01:18:50, on 12/20/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
...

It simply asks if I would like it to remove VX2 next time windows starts. Trouble is this nasty has embedded itself in the "system32" folder and i've tried removing in safe mode and everything.
...

Great. So some twit puts pirated software on my computer without my knowledge and now I can't get help.

I know I'm sorry about that but I'm not sure really what to do about that in the short term. I had a friend install windows and never realised it was pirated.

Some of you may remember when I had to create a new Windows account to get round some major problems I had a while back.
Well I've just had to do the same again because I couldn't open webpages...

:sad: Can no-one help?

It occured to me to log in on SAFE mode and delete it, which I did, but now it's still here!

here's my hijackthis log:
Logfile of HijackThis v1.98.0
Scan saved at 16:02:33, on 8/11/2004...

Hi,
I have a trojan on my computer at: C:\DOCUMENTS AND SETTINGS\LOCALSERVICE\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\6JYZY5CX\DLL2_0001[1].BIN

It's called: The Trojan horse...

Tried to do a Windows update but was told my serial number is invalid so I can only assume this installation is pirated :(

Logfile of HijackThis v1.97.7
Scan saved at 18:38:56, on 09/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:...

Here's my latest log:

Logfile of HijackThis v1.97.7
Scan saved at 14:58:39, on 09/06/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running...

This is my processes:

Ok but how do I install it manually & not install the 3rd party sponsor?

By the way, any thoughs on what I said about "SVCHOST"? Could this be infected with something? It says it's a NETWORK...

Logfile of HijackThis v1.97.7
Scan saved at 18:02:08, on 18/05/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:...