Member Panel

Welcome back Macreal.

Lets clean that right up.

To begin with please download and run Smitrem:

Download Smitrem to your desktop:
http://noahdfear.geekstogo.com/click...click.php?id=1

Run the installer and then press Start to Extract the
files to the desktop, Do not run it yet.

Reboot into safe mode (Reboot and keep tapping F8 , then
choose safe mode from the list)

Run SmitRem:

Open the SmitRem folder and double click the "RunThis.bat" file to start the tool. Follow the prompts on screen , wait for the tool to complete , and disk cleanup to finish.

The tool will create a log named smitfiles.txt on the drive that you ran Smitrem on, eg; "C:smitfiles.txt" , or the partition where your operating system is installed on.
Please attach this log to your next reply.



You will need to reload your wallpaper as the SmitRem
tool will reset it, you can do this by right clicking
desktop and choosing properties, First check Theme and
set it to Windows XP then click the Desktop tab and
choose the one you want to use and press apply.


Then please run Ewido again and let it fix all that it finds.
(except this one , if you want to keep it)

12-21-03\Installs\vnc-3.3.3r9_x86_win32.zip/vnc_x86_win32/vncviewer/vncviewer.exe -> Not-A-Virus.RemoteAdmin.Win32.WinVNC.333 : Ignored


When done , please post the Smitrem log and a new hjt log , then we'll get any leftovers.

i have completed the downloads and run the programs i still have the warning your computer is infected. antimalware poped up and said daware.spyfalcon infection and ask to block and clean should i do this?

Oops , sorry about that. I forgot to add an file...

Please follow the Smitrem instructions again , but in safemode , before running smitrem use this reg file:

http://www.bleepingcomputer.com/files/reg/FixSF.reg

Just double click on it and allow it to merge with the registry.

When done , please post the new smitrem log , and a new hjt log. (out of regular mode)

i am not sure if i did that file correct the time is wrong for when i did it

Im not sure i understand what you mean with that? Is your desktop still hijacked?


download KillBox by Option^Explicit from HERE.

Double click on Killbox.exe and then check the delete on reboot button.

Enter the following filepath and filename into the Full path of file to delete box:

C:\WINDOWS\system32\ginuerep.dll

Click the red circle with the white x and allow your computer to reboot.
(if killbox doesn't reboot on its own then please reboot manually)

thank you it seems to be up and no more un solicited lock ups or advertising
mark

Thats always good news.

You know where to find us if you run into a prob again , marked as Fixed , and see you around.