Awsome, ya found it :)
Alrite, we need to have a HijackThis log to diagnose the problem.
Download HijackThis (current verison is v1.99.1)
or here (Alternate 1, a self-extracting zip file)
or here (Alternate 2, an *.exe file)
Make a new folder to put your HijackThis.exe into.
(Anywhere on your hard drive is fine other than your Desktop or the Temp folder. Suitable examples are:C:\HijackThis\
C:\Programs\hijackthis\
C:\Windows\My Documents\HJT\
but feel free to use any name.)
Extract and save the HijackThis download to the new folder you made. Then navigate to it and run HijackThis from there. (This is to ensure it makes the necessary backups for recovery if fixes are made) Then, doubleclick HijackThis.exe, and click Scan.
When the scan is finished, the "Scan" button will change into a "Save Log" button. Press that and copy & paste its contents in your reply. Most of what it lists will be harmless or even essential, don't try to fix anything yourself.
Thanks.
'Stein
Lapsed Skeptic
1,941 posts since Jan 2006
Reputation Points: 222
Solved Threads: 106
'Stein
Lapsed Skeptic
1,941 posts since Jan 2006
Reputation Points: 222
Solved Threads: 106
Please run HJT again, select Do system scan only. And check these items.
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=
O2 - BHO: WTLHelper Object - {6D33B121-5C4C-4450-9D1F-7B67085CC199} - C:\WINDOWS\system32\mljjh.dll
O2 - BHO: (no name) - {ADCD30FF-0119-4906-8A8B-D52D1EED044B} - C:\WINDOWS\system32\ssqrp.dll
O16 - DPF: {E7D2588A-7FB5-47DC-8830-832605661009} (Live Collaboration) - http://liveca12.custhelp.com/7530-b3.../java/RntX.cab
O20 - Winlogon Notify: mljjh - C:\WINDOWS\system32\mljjh.dll
O20 - Winlogon Notify: ssqrp - C:\WINDOWS\SYSTEM32\ssqrp.dll
Click Fix Checked.
_______________________________________________
Please download VundoFix.exe to your desktop.Double-click VundoFix.exe to run it.
Put a check next to Run VundoFix as a task.
You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
When VundoFix re-opens, click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
_______________________________________________________
Please download ewido anti-malware it is a free version of the program.Install ewido anti-malware
When installing, under "Additional Options" uncheck..Install background guard
Install scan via context menu
Launch ewido, there should be an icon on your desktop, double-click it.
The program will now open to the main screen.
When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
You will need to update ewido to the latest definition files.On the left hand side of the main screen click update.
Then click on Start Update.
The update will start and a progress bar will show the updates being installed.
(the status bar at the bottom will display ("Update successful" )
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates
Once the updates are installed do the following:Open up Ewido
Click on scanner
Click on Complete System Scan and the scan will begin.
You will be prompted to clean the first infection.
Select "Perform action on all infections", then proceed.
Once the scan has completed, there will be a button located on the bottom of the screen named Save report
Click Save report.
Save the report .txt file to your desktop or a location where you can find it easily.
Close ewido anti-malware.
Reboot.
______________________________________________________
Please post the contents of C:\vundofix.txt and a new HiJackThis log, and the ewido log. - We will continue you with the fix, as you show signs of other infections
tayspen
<Insert title here>
1,622 posts since Jul 2005
Reputation Points: 84
Solved Threads: 99
Nope, that log look clean.
tayspen
<Insert title here>
1,622 posts since Jul 2005
Reputation Points: 84
Solved Threads: 99
