Member Panel

Alright, here is the new log. But one thing I wanted to ask is, that firewall keeps poping up saying "such and such is trying to access the internet." and then asks me if I want to allow it. I have no idea whether or not to allow this thing or that thing to access it. I mean I know to allow my internet browser and stuff like that but some programs I have no clue.

Almost clean , just one virus left.


Download Pocket Killbox:
http://www.atribune.org/downloads/KillBox.exe

Boot in safemode again and fix this one with hjt:

O4 - Global Startup: winlogin.exe

Start Killbox and place a tick next to [x]delete on reboot.
Copy this list into the windows clipboard:


C:\WINNT\System32\win32sockdrv.dll
C:\WINNT\System32\yuetyutr.dll
C:\WINNT\System32\winlogin.exe


Back in Killbox go > file > paste from clipboard,
Click the red highlighted X button and say yes to the prompt, then click OK.

Exit Killbox and restart your PC.

And for the firewall most of the time you can permit internet access , but you should almost always block server access.
You can allow all the apps you know and trust internet access , and putt a tick in "always perform this action" then for that app you never get asked again.

When you start an app for the first time it will probebly ask for internet access to check for updates or something , if you don't know what it is , try blocking (without placing a tick in "always perform this action") and see if youre app still works ok , then you can keep it blocked.

I tried to get rid of that one in HJT but it wont let me, it says to go into task manager to turn it off and it says that its a critical operation and wont let me turn it off.

oh, I dont know if this is because of that virus or not but whenever I try to copy something from wordperfect to my xanga (havent tested it other places) it freezes and I have to end the process. . . its not cool.

Did you boot in safemode? And in the taskmanager , there are two almost identical services winlogin.exe and winlogon.exe (in youre case atm) , you would want to kill the first.

I only see one, and its not the one you said I should kill.

I just found some info wich seems to indicate that Trend micro's online scan can remove this virus , try that first:

http://housecall.trendmicro.com/