View Single Post
Old 07-15-2005, 04:09 PM   #11 (permalink)
sUBs
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 24,353
OS: N/A


It certainly looks cleaner than before.
Please include Kaspersky's log in your next post as an attchment.

= = = = = = = = = = =

Run a HiJackThis scan. Select the following entries & click Fix checked :

O4 - HKLM\..\Run: [appac.exe] C:\WINDOWS\system32\appac.exe
O4 - HKLM\..\Run: [sysok.exe] C:\WINDOWS\sysok.exe
O4 - HKLM\..\Run: [apprt.exe] C:\WINDOWS\apprt.exe



= = = = = = = = = = =

Copy to clipboard, all the items below by highlighting them & pressing [CTRL]+[C] on your keyboard.
  • C:\WINDOWS\system32\appac.exe
    C:\WINDOWS\sysok.exe
    C:\WINDOWS\apprt.exe
Start KillBox.
Go to the File menu, and choose Paste from Clipboard * this feature does not work on older versons of Killbox
Click the dropdown-arrow next to the "Full Path of File to Delete" field.
Verify that the filenames you pasted are found in there.
Select/tick the following:
* Replace on Reboot
* Use Dummy
* End Explorer Shell While Killing File
* "Unregister.dll Before Deleting" * if it's not grayed out
Click the RED X button.
Click "Yes" at the 'Delete on Reboot' prompt.
Click "Yes" at the 'Pending Operations' prompt.

* If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try Killbox again.


= = = = = = = = = = =

Then download SilentRunners.vbs - Right click & choose Save As... Save it as SilentRunners.vbs to Desktop.

Before proceeding, disable any anti-virus or anti-spyware programs that may block/disable scripts
Double-click SilentRunners.vbs to run it. This will take a few minutes.
When it's done, you'll receive the prompt "All Done!". It will create a file called "Startup Programs". Post ALL its contents here in your next reply.

Also include a fresh copy of HJT log
__________________

Question - what have you done for the community today?
sUBs is offline