Tech Support Forum - View Single Post

sUBs · 10-15-2005, 05:46 PM

Please ensure that the 'word wrap' feature is disabled the next time you have to post a HJT log. It's kinda difficult to read through that spaghetti jungle.

Get HijackThis to fix these:

O2 - BHO: Bho - {BFFA51A0-0B64-4aa3-AAC4-325F9338D0BE} -C:\WINDOWS\system32\kgwiyorj.dll (file missing)
O20 - Winlogon Notify: geeba - C:\WINDOWS\system32\geeba.dll (file missing)

Then locate & delete these files/folders:

C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho
C:\WINDOWS\NDNuninstall6_22.exe
C:\Documents and Settings\Owner\Favorites\health

Start HiJackThis & go to Config>Misc.Tools> Delete a file on reboot...

In the popup box that appears, type in C:\WINDOWS\system32\awtsp.dll
Click the Open button.
Click YES when prompted to restart your computer.

After you have rebooted, download & extract this file to it's own folder - Registry Search

Launch Registry Search
In the search box, enter coupons & click "Ok".
Notepad will open with some text in it (the file will also be saved in the program's folder as well).
Post this text in your next reply

10-15-2005, 05:46 PM	#6 (permalink)
sUBs Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy Join Date: May 2005 Posts: 24,494 OS: N/A	Please ensure that the 'word wrap' feature is disabled the next time you have to post a HJT log. It's kinda difficult to read through that spaghetti jungle. Get HijackThis to fix these: O2 - BHO: Bho - {BFFA51A0-0B64-4aa3-AAC4-325F9338D0BE} -C:\WINDOWS\system32\kgwiyorj.dll (file missing) O20 - Winlogon Notify: geeba - C:\WINDOWS\system32\geeba.dll (file missing) Then locate & delete these files/folders: C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bho C:\WINDOWS\NDNuninstall6_22.exe C:\Documents and Settings\Owner\Favorites\health Start HiJackThis & go to Config>Misc.Tools> Delete a file on reboot... In the popup box that appears, type in C:\WINDOWS\system32\awtsp.dll Click the Open button. Click YES when prompted to restart your computer. After you have rebooted, download & extract this file to it's own folder - Registry Search Launch Registry Search In the search box, enter coupons & click "Ok". Notepad will open with some text in it (the file will also be saved in the program's folder as well). Post this text in your next reply __________________ Question - what have you done for the community today?