hjt help needed!!

Browntoa

so you did Vundofix in safe mode earlier??

and spybot ??

symy@nufc

yes. did every thing it said!

Browntoa

check a setting in Ewido for me

In the main Ewido window, look for the Resident Shield option and make sure that it is set to Inactive. If it is active, click on Change State and set it to Inactive.

Browntoa

then run through the whole Vundofix/spybot thing again I'm afraid

symy@nufc

when hjt pops up should i tick all ones in above posts or just 02,and 20?

symy@nufc

Browntoa just had a thougth should i turn system restore off??

symy@nufc

no change in the logs ?did the ewido shield aswell .i think i'll just give her it back lol

Browntoa

lets try a diffrent way


fix these

O20 - Winlogon Notify: pmkjk - C:\WINDOWS\System32\pmkjk.dll

O20 - Winlogon Notify: twpkad - C:\WINDOWS\SYSTEM32\twpkad.dll

O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\WINDOWS\.exe (file missing)

O23 - Service: Service Hosts (ServiceHost) - Unknown owner - C:\WINDOWS\shost.exe (file missing)

then see if you can find and manualy delete the files at the locations shown after de-registering the DLL files as shown below

click "Start" and then "Run" and type the following command which unregisters the software:

regsvr32 /u c:\windows\system32\twpkad.dll

and again for the other

regsvr32 /u c:\windows\system32\pmkjk.dll

did ewido find anything this time ?? did Vundofix ??

symy@nufc

vundo didnt fix try runregsvr 32 \u c:windows......twpkad.dll said cant find it
try it this way c:windows......twpkad.dll popup says being used by a programme open with

---

ewido anti-spyware - Scan Report

---

+ Created at: 09:54:29 02/08/2006

+ Scan result:



HKLM\SOFTWARE\Classes\CLSID\!!6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\!!6001CDF7-6F45-471b-A203-0225615E35A7} -> Adware.Generic : No action taken.
C:\WINDOWS\DH.dll -> Hijacker.Small.jf : No action taken.


::Report end

VundoFix V2.15 by Atri

---

Listing files contained in the vundofix folder.

---

killvundo.bat
process.exe
ReadMe.txt
vundo.reg
vundofix.txt

---

Filepaths entered

---

The filepath entered was C:\WINDOWS\system32\pmkjk.dll

The second filepath entered was C:\WINDOWS\system32\kjkmp.*

---

Log from Process

---

Killing PID 572 'smss.exe'
Error 0x6 : The handle is invalid.

Error, Cannot find a process with an image name of explorer.exe


Error, Cannot find a process with an image name of winlogon.exe

---

Could not delete C:\WINDOWS\system32\pmkjk.dll.
C:\WINDOWS\system32\kjkmp.* Deleted sucessfully.

Fixing Registry

---

Browntoa

found this on a German site so bad translation in parts

Download haxfix.exe.

Store it on your Desktop.

And close all open windows close all other programs.

Doubleclick on the haxfix.exe, in order to start the installation.

Set a checkmark with “Create A desktop icon”.

Click after “NEXT one” and follow the instructions on the screen.

Click on “finish”.

Now a red DOS window with the following selection menu opens:

1. Make log file
2. Run Auto fixed
3. Run manual fixed
E. exit Haxfix

Option 1: Make log file.
Select the option 1: Provide a log file through on the 1 to press.
That can take one moment. If HaxFix thereby is finished, it opens a text file (haxlog.txt)

Option 2: Let the automatic fixed run.
Closes all other applications and window, which will again start computers during the use of the HaxFix.

Enter the 2 and press on ENTER, in order to start the option 2 “run Auto fixed”.
Follow the instructions on the screen.

The computer will now again start.

If the Haxfix is finished, it opens a text existence (c:\haxfix.txt)

This option continues to work with the found visible keys.

It implements control for the presence of a service or a Safebootservice for each found key.
(Altogether for 6 different registration keys one examines)
If one of the services or Safebootservices is found, the fixed starts.
If no agreeing service/Safebootservice is found, there are no fixed for the visible key, it is negated.

that last bit is gobbledegook but hopefully it will seem obvious when you run it