How to Remove Virtumuno / Geeby.dll / Winfixer

GeebyHater · 12-24-2005, 02:48 AM

Re: WINFIXER - VIRTUMUNDO - VUNDO - GEEBY.DLL

Succesfull Trojan Removal Program

I have spent MANY hours trying to get rid of this devil

. Have tried many methods found on web to remove it. Was getting ready to reformat my harddisk and start over when I found a small (94.7KB), privately written program on the McAfee Help forum that did the job in a quick, simple snap:

Removal Tool (VirtumundoBeGone.exe) at: http://forums.mcafeehelp.com/viewtopic.php?t=57049

Read the information - 45 seconds;
Downloaded VirtumundoBeGone.exe - 10 seconds;
Ran VirtumundoBeGone.exe - 2 minutes;
Computer rebooted - 2 minutes;
Read VGB.TXT report on my desktop - 30 seconds;
Deleated all remaining remnants of this freak - 60 seconds.
Now plan to party ALL NIGHT.
It worked, it was simple.
THANK YOU!!!!!

Additional information:

EWIDO <http://www.ewido.net/en> has been good at spoting GEEBY.DLL. EWIDO removed it from 14 locations on my computer plus fixxing a number of other problems that my other more well known, expensive programs did not remove. However, it could not get GEEBY.DLL in window/system32 that was called by winlogon.exe. It recognizes it there, and attempts to remove it, but with no luck. EWIDO is free to try, and free to use permanently except that the real time protection is disabled after two weeks. Still, not a bad manual scanner and remover to have as a backup if you don't want to pay for it.

If this does not work for you, I have posted at the bottom the thread that lead me to this program. Some of the other information in it may be helpfull.
_______________________

For those of you interested, I ran the program twice. The first time it found Virtumundo and removed it. The removal process involved rebooting the computer. The second time it did not find Virtumundo and there was no computer reboot.
Here are the removal reports that Virtumundobegone.exe put on my desktop:

[12/23/2005, 23:12:46] - VirtumundoBeGone v1.5 ( "c:\My Downloads\0-LoadFromHere\VirtumundoBeGone.exe" )
[12/23/2005, 23:13:08] - Detected System Information:
[12/23/2005, 23:13:08] - Windows Version: 5.1.2600, Service Pack 2
[12/23/2005, 23:13:08] - Current Username: XXXXX XXXXXXX (Admin)
[12/23/2005, 23:13:08] - Windows is in NORMAL mode.
[12/23/2005, 23:13:08] - Searching for Browser Helper Objects:
[12/23/2005, 23:13:08] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
[12/23/2005, 23:13:08] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar)
[12/23/2005, 23:13:08] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/23/2005, 23:13:08] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/23/2005, 23:13:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/23/2005, 23:13:08] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/23/2005, 23:13:08] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/23/2005, 23:13:08] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[12/23/2005, 23:13:08] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object)
[12/23/2005, 23:13:09] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/23/2005, 23:13:09] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[12/23/2005, 23:13:09] - BHO 9: {FC148228-87E1-4D00-AC06-58DCAA52A4D1} (MSEvents Object)
[12/23/2005, 23:13:09] - ALERT: Found MSEvents Object!
[12/23/2005, 23:13:09] - Finished Searching Browser Helper Objects
[12/23/2005, 23:13:09] - *** Detected MSEvents Object
[12/23/2005, 23:13:09] - Trying to remove MSEvents Object...
[12/23/2005, 23:13:10] - Terminating Process: IEXPLORE.EXE
[12/23/2005, 23:13:10] - Terminating Process: RUNDLL32.EXE
[12/23/2005, 23:13:10] - Disabling Automatic Shell Restart
[12/23/2005, 23:13:10] - Terminating Process: EXPLORER.EXE
[12/23/2005, 23:13:10] - Suspending the NT Session Manager System Service
[12/23/2005, 23:13:11] - Terminating Windows NT Logon/Logoff Manager
[12/23/2005, 23:13:12] - Re-enabling Automatic Shell Restart
[12/23/2005, 23:13:12] - File to disable: C:\WINDOWS\system32\geeby.dll
[12/23/2005, 23:13:12] - Renaming C:\WINDOWS\system32\geeby.dll -> C:\WINDOWS\system32\geeby.dll.vir
[12/23/2005, 23:13:12] - File successfully renamed!
[12/23/2005, 23:13:12] - Removing HKLM\...\Browser Helper Objects\{FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/23/2005, 23:13:12] - Removing HKCR\CLSID\{FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/23/2005, 23:13:12] - Adding Kill Bit for ActiveX for GUID: {FC148228-87E1-4D00-AC06-58DCAA52A4D1}
[12/23/2005, 23:13:12] - Deleting ATLEvents/MSEvents Registry entries
[12/23/2005, 23:13:12] - Removing HKLM\...\Winlogon\Notify\geeby
[12/23/2005, 23:13:12] - Searching for Browser Helper Objects:
[12/23/2005, 23:13:12] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
[12/23/2005, 23:13:12] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar)
[12/23/2005, 23:13:12] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/23/2005, 23:13:12] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/23/2005, 23:13:12] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/23/2005, 23:13:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/23/2005, 23:13:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/23/2005, 23:13:12] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[12/23/2005, 23:13:12] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object)
[12/23/2005, 23:13:13] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/23/2005, 23:13:13] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[12/23/2005, 23:13:13] - Finished Searching Browser Helper Objects
[12/23/2005, 23:13:13] - Finishing up...
[12/23/2005, 23:13:13] - A restart is needed.
[12/23/2005, 23:13:25] - Attempting to Restart via STOP error (Blue Screen!)

--------------------------

Here is the second report when Virtumundo had already been removed. (No reboot because it had been cleaned):

[12/23/2005, 23:27:16] - VirtumundoBeGone v1.5 ( "c:\My Downloads\0-LoadFromHere\VirtumundoBeGone.exe" )
[12/23/2005, 23:27:20] - Detected System Information:
[12/23/2005, 23:27:20] - Windows Version: 5.1.2600, Service Pack 2
[12/23/2005, 23:27:20] - Current Username: XXXXXX XXXXXXXX (Admin)
[12/23/2005, 23:27:20] - Windows is in NORMAL mode.
[12/23/2005, 23:27:20] - Searching for Browser Helper Objects:
[12/23/2005, 23:27:20] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO)
[12/23/2005, 23:27:20] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar)
[12/23/2005, 23:27:20] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[12/23/2005, 23:27:20] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[12/23/2005, 23:27:21] - WARNING: BHO has no default name. Checking for Winlogon reference.
[12/23/2005, 23:27:21] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[12/23/2005, 23:27:21] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[12/23/2005, 23:27:21] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard)
[12/23/2005, 23:27:21] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object)
[12/23/2005, 23:27:21] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[12/23/2005, 23:27:21] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor)
[12/23/2005, 23:27:21] - Finished Searching Browser Helper Objects
[12/23/2005, 23:27:21] - Finishing up...
[12/23/2005, 23:27:21] - Nothing found! Exiting...

-------------------------------------------------------

Thread that led me to this program:

FROM: http://www.howtofixcomputers.com/bb/sutra731052.html

Hi Barryco - Five approaches to removing Winfixer (Vundo). Not all will
work on all variants. It's suggested that you try them in this order.

1 - Symantec has a new Vundo remover:
http://securityresponse.symantec.com...r/FixVundo.exe
http://securityresponse.symantec.com...oval.tool.html
http://securityresponse.symantec.com...alinstructions

2 - McAfee has a combined automated/manual removal procedure here:
http://vil.nai.com/vil/content/v_127690.htm

3 - It's been reported that the Removal Tool here is worthwhile:
http://forums.mcafeehelp.com/viewtopic.php?t=57049

4 - Then, courtesy of MVP Suzi Turner and Mosaic1:

"Atribune, a guy in the forums, has a Vundo fix tool as well:

Instructions for use by user as posted in the SpywareWarrior forum:

'Please download VundoFix.exe to your desktop. Here's a link:

http://www.atribune.org/downloads/VundoFix.exe

Double-click VundoFix.exe to extract the files
This will create a VundoFix folder on your desktop.
After the files are extracted, please restart your computer into Safe Mode.

Once in safe mode open the VundoFix folder and double-click on KillVundo.bat

A command window will open and it should look like this:

VundoFix V2.1 by Atri
By pressing enter you agree that you are using this at your own risk

At this point press enter one time.

Next you will see:

Type in the filepath as instructed by the forum staff
Then Press Enter, to continue with the fix.

At this point please type the following file path (make sure to enter it
exactly as below!):
C:\WINDOWS\system32\geeby.dll

Press Enter.

Next you will see:

Please type in the second filepath as instructed by the forum staff

At this point please type the following file path (make sure to enter it
exactly as below!):
C:\WINDOWS\system32\ybeeg.*

Press Enter to continue.

The fix will run then HijackThis will open.
In HijackThis, please place a check next to the following items and click
FIX CHECKED:

O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} -
C:\WINDOWS\system32\geeby.dll
O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll

After you have fixed these items, close Hijackthis.

The fix will tell you to shutdown using the Power button. Hold in your power
button until the computer shuts down. Wait about 15 seconds and then restart
the computer into regular windows.

Chkdsk will run. This is normal. It will take a few minutes and is checking
your file system because of the Bad Shutdown we caused.

Go for free online Virus scans here:

http://housecall.trendmicro.com/hous...start_corp.asp
http://www.pandasoftware.com/activescan/

Allow them to clean

Panda will have the option to create a log after the scan has finished.
Click
the See Report button. Then click the save Report button. It will be saved
under the name activescan.txt Do that and post that log into your next reply
here.

Run hijackthis and post the new log and the vundofix.txt file from the
vundofix folder into as well.'
----------------------------------------------------------------------------
--

The forum helpers have reported this fix from Atribune works. I don't know
about the Symantec tool.

If you'd like to join Spyware Warrior, you could see the thread where the
helpers are discussing this.

Suzi"

12-24-2005, 02:48 AM	#1 (permalink)
GeebyHater Registered User Join Date: Dec 2005 Posts: 2 OS: xp	How to Remove Virtumuno / Geeby.dll / Winfixer Re: WINFIXER - VIRTUMUNDO - VUNDO - GEEBY.DLL Succesfull Trojan Removal Program I have spent MANY hours trying to get rid of this devil . Have tried many methods found on web to remove it. Was getting ready to reformat my harddisk and start over when I found a small (94.7KB), privately written program on the McAfee Help forum that did the job in a quick, simple snap: Removal Tool (VirtumundoBeGone.exe) at: http://forums.mcafeehelp.com/viewtopic.php?t=57049 Read the information - 45 seconds; Downloaded VirtumundoBeGone.exe - 10 seconds; Ran VirtumundoBeGone.exe - 2 minutes; Computer rebooted - 2 minutes; Read VGB.TXT report on my desktop - 30 seconds; Deleated all remaining remnants of this freak - 60 seconds. Now plan to party ALL NIGHT. It worked, it was simple. THANK YOU!!!!! Additional information: EWIDO <http://www.ewido.net/en> has been good at spoting GEEBY.DLL. EWIDO removed it from 14 locations on my computer plus fixxing a number of other problems that my other more well known, expensive programs did not remove. However, it could not get GEEBY.DLL in window/system32 that was called by winlogon.exe. It recognizes it there, and attempts to remove it, but with no luck. EWIDO is free to try, and free to use permanently except that the real time protection is disabled after two weeks. Still, not a bad manual scanner and remover to have as a backup if you don't want to pay for it. If this does not work for you, I have posted at the bottom the thread that lead me to this program. Some of the other information in it may be helpfull. _______________________ For those of you interested, I ran the program twice. The first time it found Virtumundo and removed it. The removal process involved rebooting the computer. The second time it did not find Virtumundo and there was no computer reboot. Here are the removal reports that Virtumundobegone.exe put on my desktop: [12/23/2005, 23:12:46] - VirtumundoBeGone v1.5 ( "c:\My Downloads\0-LoadFromHere\VirtumundoBeGone.exe" ) [12/23/2005, 23:13:08] - Detected System Information: [12/23/2005, 23:13:08] - Windows Version: 5.1.2600, Service Pack 2 [12/23/2005, 23:13:08] - Current Username: XXXXX XXXXXXX (Admin) [12/23/2005, 23:13:08] - Windows is in NORMAL mode. [12/23/2005, 23:13:08] - Searching for Browser Helper Objects: [12/23/2005, 23:13:08] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO) [12/23/2005, 23:13:08] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar) [12/23/2005, 23:13:08] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [12/23/2005, 23:13:08] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} () [12/23/2005, 23:13:08] - WARNING: BHO has no default name. Checking for Winlogon reference. [12/23/2005, 23:13:08] - Checking for HKLM\...\Winlogon\Notify\SDHelper [12/23/2005, 23:13:08] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing. [12/23/2005, 23:13:08] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard) [12/23/2005, 23:13:08] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object) [12/23/2005, 23:13:09] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper) [12/23/2005, 23:13:09] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor) [12/23/2005, 23:13:09] - BHO 9: {FC148228-87E1-4D00-AC06-58DCAA52A4D1} (MSEvents Object) [12/23/2005, 23:13:09] - ALERT: Found MSEvents Object! [12/23/2005, 23:13:09] - Finished Searching Browser Helper Objects [12/23/2005, 23:13:09] - *** Detected MSEvents Object [12/23/2005, 23:13:09] - Trying to remove MSEvents Object... [12/23/2005, 23:13:10] - Terminating Process: IEXPLORE.EXE [12/23/2005, 23:13:10] - Terminating Process: RUNDLL32.EXE [12/23/2005, 23:13:10] - Disabling Automatic Shell Restart [12/23/2005, 23:13:10] - Terminating Process: EXPLORER.EXE [12/23/2005, 23:13:10] - Suspending the NT Session Manager System Service [12/23/2005, 23:13:11] - Terminating Windows NT Logon/Logoff Manager [12/23/2005, 23:13:12] - Re-enabling Automatic Shell Restart [12/23/2005, 23:13:12] - File to disable: C:\WINDOWS\system32\geeby.dll [12/23/2005, 23:13:12] - Renaming C:\WINDOWS\system32\geeby.dll -> C:\WINDOWS\system32\geeby.dll.vir [12/23/2005, 23:13:12] - File successfully renamed! [12/23/2005, 23:13:12] - Removing HKLM\...\Browser Helper Objects\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} [12/23/2005, 23:13:12] - Removing HKCR\CLSID\{FC148228-87E1-4D00-AC06-58DCAA52A4D1} [12/23/2005, 23:13:12] - Adding Kill Bit for ActiveX for GUID: {FC148228-87E1-4D00-AC06-58DCAA52A4D1} [12/23/2005, 23:13:12] - Deleting ATLEvents/MSEvents Registry entries [12/23/2005, 23:13:12] - Removing HKLM\...\Winlogon\Notify\geeby [12/23/2005, 23:13:12] - Searching for Browser Helper Objects: [12/23/2005, 23:13:12] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO) [12/23/2005, 23:13:12] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar) [12/23/2005, 23:13:12] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [12/23/2005, 23:13:12] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} () [12/23/2005, 23:13:12] - WARNING: BHO has no default name. Checking for Winlogon reference. [12/23/2005, 23:13:12] - Checking for HKLM\...\Winlogon\Notify\SDHelper [12/23/2005, 23:13:12] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing. [12/23/2005, 23:13:12] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard) [12/23/2005, 23:13:12] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object) [12/23/2005, 23:13:13] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper) [12/23/2005, 23:13:13] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor) [12/23/2005, 23:13:13] - Finished Searching Browser Helper Objects [12/23/2005, 23:13:13] - Finishing up... [12/23/2005, 23:13:13] - A restart is needed. [12/23/2005, 23:13:25] - Attempting to Restart via STOP error (Blue Screen!) -------------------------- Here is the second report when Virtumundo had already been removed. (No reboot because it had been cleaned): [12/23/2005, 23:27:16] - VirtumundoBeGone v1.5 ( "c:\My Downloads\0-LoadFromHere\VirtumundoBeGone.exe" ) [12/23/2005, 23:27:20] - Detected System Information: [12/23/2005, 23:27:20] - Windows Version: 5.1.2600, Service Pack 2 [12/23/2005, 23:27:20] - Current Username: XXXXXX XXXXXXXX (Admin) [12/23/2005, 23:27:20] - Windows is in NORMAL mode. [12/23/2005, 23:27:20] - Searching for Browser Helper Objects: [12/23/2005, 23:27:20] - BHO 1: {02478D38-C3F9-4efb-9B51-7695ECA05670} (Yahoo! Companion BHO) [12/23/2005, 23:27:20] - BHO 2: {06647158-359E-4D10-A8DE-E6145DA90BE9} (Trend Micro Antifraud Toolbar) [12/23/2005, 23:27:20] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [12/23/2005, 23:27:20] - BHO 4: {53707962-6F74-2D53-2644-206D7942484F} () [12/23/2005, 23:27:21] - WARNING: BHO has no default name. Checking for Winlogon reference. [12/23/2005, 23:27:21] - Checking for HKLM\...\Winlogon\Notify\SDHelper [12/23/2005, 23:27:21] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing. [12/23/2005, 23:27:21] - BHO 5: {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} (PCTools Site Guard) [12/23/2005, 23:27:21] - BHO 6: {7c1ce531-09e9-4fc5-9803-1c2956615786} (IeCaptureBho Object) [12/23/2005, 23:27:21] - BHO 7: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper) [12/23/2005, 23:27:21] - BHO 8: {B56A7D7D-6927-48C8-A975-17DF180C71AC} (PCTools Browser Monitor) [12/23/2005, 23:27:21] - Finished Searching Browser Helper Objects [12/23/2005, 23:27:21] - Finishing up... [12/23/2005, 23:27:21] - Nothing found! Exiting... ------------------------------------------------------- Thread that led me to this program: FROM: http://www.howtofixcomputers.com/bb/sutra731052.html Hi Barryco - Five approaches to removing Winfixer (Vundo). Not all will work on all variants. It's suggested that you try them in this order. 1 - Symantec has a new Vundo remover: http://securityresponse.symantec.com...r/FixVundo.exe http://securityresponse.symantec.com...oval.tool.html http://securityresponse.symantec.com...alinstructions 2 - McAfee has a combined automated/manual removal procedure here: http://vil.nai.com/vil/content/v_127690.htm 3 - It's been reported that the Removal Tool here is worthwhile: http://forums.mcafeehelp.com/viewtopic.php?t=57049 4 - Then, courtesy of MVP Suzi Turner and Mosaic1: "Atribune, a guy in the forums, has a Vundo fix tool as well: Instructions for use by user as posted in the SpywareWarrior forum: 'Please download VundoFix.exe to your desktop. Here's a link: http://www.atribune.org/downloads/VundoFix.exe Double-click VundoFix.exe to extract the files This will create a VundoFix folder on your desktop. After the files are extracted, please restart your computer into Safe Mode. Once in safe mode open the VundoFix folder and double-click on KillVundo.bat A command window will open and it should look like this: VundoFix V2.1 by Atri By pressing enter you agree that you are using this at your own risk At this point press enter one time. Next you will see: Type in the filepath as instructed by the forum staff Then Press Enter, to continue with the fix. At this point please type the following file path (make sure to enter it exactly as below!): C:\WINDOWS\system32\geeby.dll Press Enter. Next you will see: Please type in the second filepath as instructed by the forum staff At this point please type the following file path (make sure to enter it exactly as below!): C:\WINDOWS\system32\ybeeg.* Press Enter to continue. The fix will run then HijackThis will open. In HijackThis, please place a check next to the following items and click FIX CHECKED: O2 - BHO: MSEvents Object - {52B1DFC7-AAFC-4362-B103-868B0683C697} - C:\WINDOWS\system32\geeby.dll O20 - Winlogon Notify: geeby - C:\WINDOWS\system32\geeby.dll After you have fixed these items, close Hijackthis. The fix will tell you to shutdown using the Power button. Hold in your power button until the computer shuts down. Wait about 15 seconds and then restart the computer into regular windows. Chkdsk will run. This is normal. It will take a few minutes and is checking your file system because of the Bad Shutdown we caused. Go for free online Virus scans here: http://housecall.trendmicro.com/hous...start_corp.asp http://www.pandasoftware.com/activescan/ Allow them to clean Panda will have the option to create a log after the scan has finished. Click the See Report button. Then click the save Report button. It will be saved under the name activescan.txt Do that and post that log into your next reply here. Run hijackthis and post the new log and the vundofix.txt file from the vundofix folder into as well.' ---------------------------------------------------------------------------- -- The forum helpers have reported this fix from Atribune works. I don't know about the Symantec tool. If you'd like to join Spyware Warrior, you could see the thread where the helpers are discussing this. Suzi"