Recent content by weewun

Thanks, il give that a shot. One thing I forgot to mention was another reason I know there is still something on my machine is random google re-directs :( Im guessing still just follow the guide you linked. Cheers!

Hi there, in the last 3 months or so I have had the same virus (a fake win 7 antimalware thing) about 4 times( I now have rKill on my desktop permanantly, lol). Each time I manage to kill it with malwarebytes, and do scans with superanispyware, etc. to clean it up. I am starting to think I have...

Hi there, im currently working/living in a place that has 'free wifi'. Whenever i open a web browser for the 1st time I have to accept their terms and conditions to gain access ot the internet (fair enough) but after about 40 minutes this times out and I have to open another web browser to...

Ok, its looking good :D. I ran combo fix again and it 'detected rootkit activity' in the form of app_dll.dll - which it deleted :) I then ran the superantispyware which found a couple things which I then had it delete followed by malwarebytes which again, found a couple things to delete. Each...

Ok, I followed your steps and found the entries where you said they would be. I also did a search in the registry for any referance to 'wmpscfgs' them. After that I searched for ' .exe' and found that msn messenger had been altered as you described (with a new .exe and the origional renamed) and...

Ok, I just ran GMER rootkit finder thing. It looks like wmpscfgs.exe is something bad here? Here is the log: GMER 1.0.15.15281 - GMER - Rootkit Detector and Remover Rootkit scan 2010-02-09 22:59:57 Windows 6.0.6002 Service Pack 2 Running: xsmmlbyr.exe; Driver...

Ok, I ran combo fix again from within vista and it said that root kit activity has been detected, it is disabling it. c:\windows\system32\run_dll.dll It then started scanning and half way through I got a BSOD, when it re-booted I was back to the black screen and no desktop. Through task...

yes, but i couldnt see what was using it all. Im back in vista just now and firfox is currently at the top of the cpu column hopping about between 60-80 (assuming thats %). I am assuming this is because i set it's process's priority to high so i could actually use the internet :( the next item...

My problems are still not over :S I removed the items you said (in the other thread) to with HJT, but when im in vista something is causing my CPU to get used at 100% (according to task manager) so i can do very little (web pages wont load etc). I dont see any running processes taking up too...

Creating a new post for my HJT logs as previous one has been moved to the 'finished' thread. I have had some serious problems with vista to do with some form of virus. Main thread: http://www.techist.com/forums/f9/black-screen-instead-desktop-after-virus-vista-32-a-225130/ Now when in vista...

I managed to get back into my origonal vista profile after i ran combo fix through vista just by re-naming the user folder back to its proper name. I ran combo fix a couple more times from this account - and it BSOD'd the first time but ran fine the 2nd. Everything 'looks' fine so im optimistic...

Hijack-this logfile: -------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:17:59, on 08/02/2010 Platform: Windows Vista SP2 (WinNT 6.00.1906) MSIE: Internet Explorer v8.00 (8.00.6001.18882) Boot mode: Normal Running processes...

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache . Contents of the 'Scheduled Tasks' folder 2010-02-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe...

Ok, I managed to get back into my origional vista log on by renaming the folder back to it's correct name. It 'looks' fine... attaching new combo fix and HJT log files. Combo fix: ComboFix 10-02-07.06 - ian 08/02/2010 0:52.5.4 - x86 Microsoft® Windows Vista™ Home Premium...

yes, I have changed my back ground - I havent tried re-booting yet incase whatever was wrong comes back :S does it look relatively safe for now?