andypugh2000

Have this pesky file that keeps rearing its ugly head, Im sure its a trojan and everytime i delete it in safe mode it self replicates again The problem is that after half an hour of use the computer stops responding and hangs, also the internet connection stops working.

any ideas?? tried Microsoft but no joy

andy

lightning101

Download CWShredder, run it and let it fix everything it finds.

Now have HJT fix:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *hot-searches.com*;*lender-search.com*
F2 - REG:system.ini: Shell=
F2 - REG:system.ini: UserInit=
O2 - BHO: (no name) - {0000607D-D204-42C7-8E46-216055BF9918} - (no file)
O2 - BHO: (no name) - {5CC18184-534B-4858-9101-AE7945A54E33} - C:\WINNT\system32\iadmf.dll (file missing)
O2 - BHO: (no name) - {6FDA6178-B340-59C1-8251-62557E872A3F} - C:\WINNT\system32\nasaroto.dll
O2 - BHO: (no name) - {7A12A061-1396-4A68-8D0D-920618F280DA} - C:\WINNT\system32\7la.dll
O4 - HKLM\..\Run: [VVSN] C:\Program Files\VVSN\VVSN.exe
O4 - HKLM\..\Run: [gbekcdj] C:\WINNT\system32\ykabljx.exe
O4 - HKLM\..\RunOnce: [0m654d.exe] C:\WINNT\system32\0m654d.exe /k
O4 - HKCU\..\Run: [delmsbb] C:\WINNT\delmsbb.exe
O4 - HKCU\..\Run: [Tmnp] C:\Documents and Settings\Administrator.DANG1\Application Data\ersd.exe
O4 - HKCU\..\Run: [Ivgf] C:\WINNT\system32\?hkntfs.exe
O4 - HKCU\..\RunOnce: [0m654d.exe] C:\WINNT\system32\0m654d.exe /k
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O21 - SSODL: systemie - {673403C2-B93C-4187-B11B-54B32C31320A} - systemie.dll (file missing)

Reboot into safemode, tap F8 at boot, and delete:

C:\Documents and Settings\Administrator.DANG1\Application Data\ersd.exe <--file
C:\Program Files\VVSN\ <--folder
C:\WINNT\system32\0m654d.exe <--file
C:\WINNT\system32\ykabljx.exe <--file
C:\WINNT\delmsbb.exe <--file

andypugh2000

You done a google too eh!! tried it, doesnt find it, I think i have now sussed it out by typing in start, run, msconfig, startup and unchecking the box for msshed32 then rebooting in safe, delting the file and hey presto!!

andy

lightning101

Did you remember to switch off system restore ?

andypugh2000

bugger, forgot, how do you do that??

lightning101

right click on my computer - then sys restore tab and disable.