Celldorado.com

Hello shaunhale,

Can you please check the following locations:

Click on start,my computer,double click on the icon of your hard disc ,documents and settings now go to the tools menu,folder options,press on the display/view tab check the option show hidden files/folders press on apply,open now the folder of your user account,you will see now a folder called local settings open it,application data open it also and see if you can find files inside with these names:

uielagc.dat

uielagc.exe

uielagc_nav.dat

uielagc_navps.dat

Now check these locations: go to start,my computer,double click on the icon of your hard disc, windows,system 32 folder,cache and add the content also to an archive. Look also for nvs2.inf

entries.

Please archive these an upload them on the forum.

After you done that please read this and follow these instructions.Post the output of that scan together with a hijack this log.

Best regards

Niels

Niels,

Thanks for getting back to me. I have to apologise myself for taking so long to action the above - I haven't had much time to get on a computer.

Please find attached the ComboFix Log and the HijackThis Log.

I followed your instructions regarding going into the Application Data folder and Cache folder, but they didn't quite follow (maybe because I use Windows Vista?) Anyway, I did find a Application Data folder, but it says "Access Denied" even if I run Explorer as an Administrator. There was no "Cache" folder that I could see under the "System 32" folder. I did reveal all the hidden folders.

Can you help using the two logs above?

/applications/core/interface/file/attachment.php?id=2079" data-fileid="2079" rel="">ComboFix.txt

/applications/core/interface/file/attachment.php?id=2080" data-fileid="2080" rel="">hijackthis.log

Please pack this file in a zip or rar archive with the password infected and attach it here !

Upload the file on http://www.virustotal.com/ and paste here the link analysis

crysty2k5,

I have found the folder C:\Users\Shaun\AppData\Local\Microsoft but it only contains 24 other folders and no files. I certainly cannot see a file called sgbvea.exe

How do I find it?

If I do find it, how do I put it into a zip or rar archive and how do I password protect it?

Can anyone help me with my query please?

crysty2k5's EDIT: posts merged

Hello shaunhale,

Please download vundofix from here. Double click on it and press on scan for vundo. Wait till the scan is finished. Press remove vundo. If infected files are found confirm the deletion by pressing on yes. If something found please post the the output of vundofix.txt which you will find in the root of your hard disk. (start,my computer,double click on the partition where windows is installed on). Make a new hijackthis log.

Best regards

Niels

Vundofix didn't find anything.

Here is my new hijackthis log.

/applications/core/interface/file/attachment.php?id=2113" data-fileid="2113" rel="">hijackthis_02.06.08.txt

There is another suspicious file in the log:

Download SUPERAntiSpyware && Malwarebytes' Anti-Malware and run a complete scan !

SuperAntiSpyware did not find anything.

Malwarebytes' Anti-Malware found 11 items, which I have now removed.

Attached is the log file.

Is there any more I need to do?

/applications/core/interface/file/attachment.php?id=2117" data-fileid="2117" rel="">mbam_log_6_2_2008__19_40_25_.txt

Good, clean all the ad-aware !

I pressed the "Remove" button when the scan had finished, if that's what you mean?

Attached is my latest hijackthis log.

Does everything look okay now?

/applications/core/interface/file/attachment.php?id=2118" data-fileid="2118" rel="">hijackthis_02.06.08__ii_.txt

Check and press Fix checked for:

Run a system scan cu Bitdefender !

Sorry, I don't understand?

I've just had another pop-up come up.

I went back into Malwarebytes' Anti-Malware and found the 11 items in the Quarantine section. I then pressed "Delete All"

What are the items you have listed? How do I "fix check" them? What sort of system scan do you want me to do?

Sorry this is taking so long! My computer skills are somewhat limited and I'm not quite following everything you're saying. Please bear with me!

Not in Malwarebytes' Anti-Malware, in HijackThis

Thanks!

I've removed everything apart from:

O4 - HKCU\..\Run: [dgvgfulclf] c:\users\shaun\appdata\local\microsoft\dgvgfulclf.exe dgvgfulclf

(It was no longer there)

Attached is a new hijackthis log

/applications/core/interface/file/attachment.php?id=2137" data-fileid="2137" rel="">hijackthis_04.06.08.txt

The log is now clean !

Thank you, but I have just had another pop-up appear. The site is www.yesloansuk.com.

I blocked the cookie associated with it and closed the window, but a couple of minutes later the same website popped up again.

Help!

Download: http://download.bleepingcomputer.com/andymanchesta/SDFix.exe

Instructions: http://www.bleepingcomputer.com/forums/topic131299.html

Attach here the SDFix log

Sorry I've taken so long to reply.

I installed the software you suggested and tried to run it. A black window opened for just a brief second and then disappeared. I found the file location and it is definitely there, but every time I try to run it, I get the same black screen appear and disappear in a flash.

VundoFix V7.0.6

Scan started at 11:05:23 23/06/2008

Listing files found while scanning....

C:\Windows\System32\rQHbyaaX.dll

Beginning removal...

Attempting to delete C:\Windows\System32\rQHbyaaX.dll

C:\Windows\System32\rQHbyaaX.dll Has been deleted!

Performing Repairs to the registry.

Done!

after this nothing has changed and a critical windows error appaered telling me the comp will be restarted in 1 min

at the moment I'm trying Malwarebyte's Anti-Malware

I think this trojan is called Virtumonde

Can anyone see anything dodgy in my hijack this log?

/applications/core/interface/file/attachment.php?id=2313" data-fileid="2313" rel="">hijackthis_24.06.08.txt

Please, please, please can someone help with this?????????? " />

Hello.

Make an archive with the following file (with the password "infected") and attach it in a post.

C:\Users\Shaun\AppData\Local\Microsoft\kmygwkkey.exe

Have a nice day!

Please excuse my ignorance, but how do I do that?

I am getting no assistance with this problem and everyone seems to have stopped replying.

The pop-ups now are appearing very regularly and seem to be getting worse.

PLEASE HELP !!!!!!!!!!!!!!!!!!!!!!

" />