Hi my PC gave me a warning that it was filled with dangerous spyware/adware etc so i automatically download some unknown antispyware tools to fix this problem. At the end of this, I could not access the task manager or change the background. Im using XP. So here's the HJT and ewido logs.



I hope that i have covered everything but do let me know if i need to do other things or whatsoever. Thanks

Attached Files

	HJT Log.txt (8.4 KB, 1 views)
	Ewido Log.txt (2.1 KB, 0 views)

Hi maedlyn, and welcome to PCHF.

Please wait while I analyse your logs.

Please launch HijackThis and place a tick by the following entries:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [ClubBox] "E:\WINDOWS\system32\clubbox.exe" -l
O4 - HKLM\..\Run: [c4353d7d.exe] E:\WINDOWS\system32\c4353d7d.exe
O4 - HKCU\..\Run: [c4353d7d.exe] E:\Documents and Settings\Mong Tien\Local Settings\Application Data\c4353d7d.exe
O4 - HKCU\..\Run: [stup] E:\DOCUME~1\MONGTI~1\LOCALS~1\Temp\88.tmp
Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis and restart the computer.

Next download ATF Cleaner by Atribune.

• Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


Now rescan with HijackThis and post the new log in your next reply.

Thanks for analysing the logs. I have done what you asked for and heres the updated HJT log

Attached Files

hijackthis1.log (7.6 KB, 6 views)

Looking very good sofar. How is it going with the problems you had?

But to make sure, I have my doubts about this file:

E:\WINDOWS\system32\kr.dll

Please go to this site and upload the file to have it scanned:

http://www.virustotal.com/en/indexf.html

And post back with the scanning result please.

After resetting the PC I still cannot access to task manager or even change the background/desktop. So problem is still not resolved. As for the file you have doubt, I cant find the file at all.. Are u sure it is the right one?