sUBs

Please download these additional files/programs. Do not run them untill instructed to do so.
Unless otherwise stated, they should be stored in same directory as the HiJackThis program.

CleanUp!.exe - Install.

KillBox v2.0.0.175.zip

WinPfind.zip

TrackQoo.zip

L2m9Xfix.exe

DSRFIX


'UNPLUG'/DISCONNECT YOUR COMPUTER FROM THE INTERNET WHEN YOU HAVE FINISHED DOWNLOADING


This webpage would not be available when you're carrying out the fix. Please save the following instructions in Notepad. I have customed my instructions on the assumption that you are using Notepad. It may lead to some confusion should you choose to do otherwise.

If there's anything that you don't understand, kindly ask your questions before proceeding with the fixes. There should not be any opened browsers when you are carrying out the procedures below.


IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


Launch KillBox.exe & select the following options:

• delete on Reboot
• end Explorer shell while killing file
• unregister dlll before deleting * if it's not grayed out

Select all the filenames below & then click on Notepad's 'Edit' menu & select Copy

• C:\WINDOWS\SYSTEM\WGDAP32.DLL
  C:\WINDOWS\SYSTEM\SRGE.DLL
  C:\WINDOWS\DOWNLOADED PROGRAM FILES\MediaGatewayX.dll
  C:\WINDOWS\dinst.exe
  C:\WINDOWS\SYSTEM\DRRAW.DLL
  C:\WINDOWS\SYSTEM\DJRAW16.DLL
  C:\WINDOWS\SYSTEM\DWGSIG.DLL
  C:\WINDOWS\SYSTEM\WG2_32.DLL
  C:\WINDOWS\SYSTEM\RKCLTC1.DLL
  C:\WINDOWS\SYSTEM\UpdInst.exe
  C:\WINDOWS\SYSTEM\n9058rq5.exe
  C:\WINDOWS\SYSTEM\MRVIDC32.DLL
  C:\WINDOWS\SYSTEM\GSOUPPOL.DLL
  C:\WINDOWS\SYSTEM\sRge.dll
  C:\WINDOWS\SYSTEM\Imv16.dll
  C:\WINDOWS\SYSTEM\lskrn13n.dll
  C:\WINDOWS\SYSTEM\SYDOC401.DLL
  C:\WINDOWS\SYSTEM\RLGWIZC.DLL
  C:\WINDOWS\SYSTEM\CPASPI.DLL
  C:\WINDOWS\SYSTEM\mvtext40.dll
  C:\WINDOWS\SYSTEM\mvwmdm.dll
  C:\WINDOWS\SYSTEM\RFAPH.DLL
  C:\WINDOWS\SYSTEM\FCAMEBUF.DLL
  C:\WINDOWS\SYSTEM\SGDOC401.DLL
  C:\WINDOWS\SYSTEM\WGDAP32.DLL
  C:\WINDOWS\SYSTEM\DPCPCSVC.DLL
  C:\WINDOWS\SYSTEM\CAGMGR32.DLL
  C:\WINDOWS\SYSTEM\mjltus40.dll
  C:\WINDOWS\SYSTEM\MTRECR40.DLL
  C:\WINDOWS\SYSTEM\MUSHRUI.DLL
  C:\WINDOWS\SYSTEM\MPCMS.DLL
  C:\WINDOWS\SYSTEM\mxpmsp.dll
  C:\WINDOWS\SYSTEM\JMVAEE.DLL
  C:\WINDOWS\SYSTEM\KZRNEL32.DLL
  C:\WINDOWS\SYSTEM\demasf.dll
  C:\WINDOWS\SYSTEM\WZTSECUR.DLL
  C:\WINDOWS\Start Menu\Programs\Disabled Startup Items\utrt.exe
  C:\WINDOWS\Downloaded Program Files\CONFLICT.1\installer_MARKETING32.exe
  C:\WINDOWS\Downloaded Program Files\installer_MARKETING32.exe
  C:\WINDOWS\Downloaded Program Files\MediaGatewayX.dll
  C:\WINDOWS\gvwvv.dat
  C:\WINDOWS\fgfggsk.dll
  C:\WINDOWS\setup_silent_26223.exe
  C:\WINDOWS\ru.exe
  C:\WINDOWS\xodooar.exe
  C:\WINDOWS\banner.dll
  C:\WINDOWS\dinst.exe
  C:\WINDOWS\xdsddp.exe
  C:\Program Files\Common Files\SYSTEM\Mapi\1033\95\MTE2NzY6ODoxNg.exe
  C:\Program Files\WAV to MP3 Encoder\mm332.exe
  C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7395.TMP\ProxyStub .dll
  C:\Program Files\Yahoo!\YPSR\Quarantine\20050819175611.zip

* Go to the File menu, and choose Paste from Clipboard
* Click the RED X button.
* Click Yes at the Delete on Reboot prompt.
* Click Yes at the 'Pending Operations prompt'.

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Next, please reboot your computer in SafeMode by doing the following:

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Double click on dsrfix.zip & extract the contents to a new folder
Open the folder & double-click on dsrfix.bat
Once dsrfix has completed, it will close on its own


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

If you have not done so already, please enable the viewing of Hidden files
From Windows Explorer, go to Tools>Folder Options> View tab.

• Enable - Show hidden files and folder

Click Yes to confirm & then click OK

Locate and delete the following folders, if present:

• C:\WINDOWS\ALL USERS\APPLICATION DATA\nsv
  C:\WINDOWS\ALL USERS\APPLICATION DATA\vidctrl
  C:\WINDOWS\Downloaded Program Files\CONFLICT.1\

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


Run Cleanup! using the following configuration:

1. Click Options...
2. Set the slider to Standard CleanUp!
3. Uncheck the following:

• Delete Newsgroup cache
• Delete Newsgroup Subscriptions

4. Click OK
5. Press the CleanUp! button to start the program. Reboot/logoff when prompted.
* CleanUp! will not create any backups!!


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


Double-click WinPFind.zip & extract the contents to a new folder at Drive C.

1. From within that folder, double click WinPFind.exe
2. Click Start Scan
3. Once the Scan is complete, it will create a report in a text file
4. Go to the WinPFind folder & locate WinPFind.txt
5. Post the results in your next reply!

** This program will scan large amounts of files on your computer for known patterns so please be patient while it works as it can take a while, upwards to 30 minutes or more.


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


Double-click L2m9Xfix.exe & extract the files, and then open the l2m9xfix folder you just created and run RunThis.bat.

A window will open, and your desktop will disappear, then reappear. Please be patient until the batch says it is completed.

When it finishes, it will create a log - log.txt file which should be in the same folder as RunThis.bat.


= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =


REBOOT TO NORMAL MODE


Perform another online scan with Internet Explorer with Panda ActiveScan


REBOOT AGAIN & Extract the contents of TrackQoo.zip & double-click on TrackQoo1.vbs. Wait a few seconds and a notepad page will pop up, Copy & Paste those results in your next reply.
* If your Antivirus has Script Blocking, you will get a Pop Up Windows asking you what to do. Allow this Entire Script to Run, its harmless!

In your next post, please include fresh logs from:

• HiJackThis log
• Online Scan
• L2m9Xfix's log
• WinPfind
• TrackQoo1.vbs

Please provide details of any problems you encountered whilst performing the above steps & update us on how the computer behaves now