I am having problems with WinFix2005 trying to install each time I log onto my computer...and it seems to be slowing the computer down as well.? I followed the instructions for retrieving the HJT and Ewido Logs and here they are.? Thank you so much for your help.? Jsurf

Attached Files

hijackthis.txt (12.2 KB, 2 views)

Hi there Jsurf.

Can you copy that ewido log to a post , somehow they get messed up when atached as a txt file.



Please download Process Explorer by Systernals from HERE

Also download KillBox by Option^Explicit from HERE


Then boot up in SAFE MODE and stay in safe mode untill the entire fix is done.(hit f8 when booting up)



Unzip Process Explorer and double click on procexp.exe

In the top section of the Process Exlporer screen double click on winlogon.exe to bring up the winlogon.exe properties screen. Click on the Threads tab at the top.

Once you see this screen click on each instance of wvutq.dll once and then click the kill button.

After you have killed all of the wvutq.dll's under winlogon click OK.

Next In the top section of the Process Exlporer screen again , double click on explorer.exe and again click once on each instance of wvutq.dll then click the kill button.

Once you have done that click OK again.

Next run HijackThis and place a check beside each of the following.



Now click fix checked and close HijackThis.Then delete the files in bold.

Please copy the text in the quote below, and paste it into a blank notepad window.
Save it as vundo.reg and in the save as type box choose all files.

Once you have saved it double click it and allow it to merge with the registry.







Double click on Killbox.exe and then check the delete on reboot button.

Enter the following filepath and filename into the Full path of file to delete box


C:\WINDOWS\system32\wvutq.dll


Click the red circle with the white x and allow your computer to reboot.



After your computer has rebooted please run Hijackthis again and post a new HijackThis log.

PS; it looks like you made that hjt log in safemode , can you post the new log out of normal mode?

Joe,

Here is the Ewido Report. Hope this is what I was supposed to paste in. Thanks again. I will follow the latest instructions.
Jsurf


---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on: 12:42:52 PM, 9/25/2005
+ Report-Checksum: 9B5E200D

+ Scan result:

HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
C:\WINDOWS\Downloaded Program Files\UWFX5RS_0001_0808NetInstaller.exe -> Not-A-Virus.Downloader.Agent.c : Cleaned with backup
C:\WINDOWS\system32\wvutq.dll -> Trojan.Crypt.o : Cleaned with backup


::Report End

Yup , thats what i ment.

Let me know if you have any problems with the instructions