Member Panel

Chiawaikian-
I apologize for the delay getting back to you. Followed your recommendations, but still experiencing the slow opening of programs and slow-scrolling browser. Ran a Panda scan & am posting the results. Will also include an HJT log.

Sorry for the trouble!
Jdub

1) Please download the Killbox.
Save it to the desktop and run it.

2) Select "Delete on Reboot", and then select "All files".

3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

C:\program files\common files\svchost.exe
c:\windows\downloaded program files\eied.inf


4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

5) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.


Next download VundoFix.exe
to your desktop.

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.

Chiawaikian-
Ran Killbox and it seemed to work. Accidently overwrote the first Vundofix log- program didn't come up on reboot so I ran it again, which overwrote the first report. Second time was the same as the first, with two files (khfec.dll and ilfxunqa.dll) reappearing during the second run. First run showed 5 or 6 cefhk.ini-related files that were taken care of and didn't appear during the second run. Just to be on the safe side, I booted into safe mode and ran Vundofix again, and sure enough khfec.dll and ilfxunqa.dll were present once again. Hopefully these files were deleted in safe mode (attached log is from this run and is identical to run #2). I am also including another HJT log.

A quick question- while getting the Vundofix log from C:\, ran across a number of application files that I didn't recognize (I think they're .exe files, but not sure- extension not visible):
baiod.*
kptss.*
ownwlpm.*
qawl.*
ryembqbd.*
vico.*
vimsflwp.*
xklxhlc.*

Some quick investigation on Google seems to suggest that these are malware-related files, but they didn't show up on any scans thus far. Any ideas?

Thanks once again
Jdub

Hey Jdub,

Let's make sure we know what we're dealing with here. Can you please right click on My Computer, and choose Explore. Click on Tools, Folder Options, and make sure that you have a check next to Display contents of system folders. Show hidden files and folders is selected, and remove the check next to Hide extensions for known files types. Then click on the Apply to All Folders button. Can you also please ensure that your System Restore is disabled?

Now take a look at those files again, and verify that they are all .exe file types.

Assuming that they are, are they all showing up in your System32 folder?

Try this for the Vundofix issue.

Download CCleaner from my signature. Run it in regular mode with all options selected, including Advanced, answer OK or Yes to all warnings. Click on Analyze, then Run Cleaner. Run it again, until there are either no entries to clean, or the same ones keep coming back.

Boot into Safe Mode. Make sure that no programs are running during this process. Run CCleaner again, if there are files that will not clean, identify the file locations. Go into Explorer, (right-click on My Computer, choose Explore), and navigate to the file locations, right click on the files, click on Properties, if the file is listed as Read Only, untick the box, and attempt to delete the files manually.

Now click on Issues, Scan for Issues, once it has finished, click on Fix Selected Issues, and allow it to fix everything that it finds. You can name the backup todays date. Repeat this proceedure until there are no further issues detected. Now repeat the Vundo Fix instructions. Reboot in Regular Mode, and post back with any of those suspicious files that are still there, or have appeared.

Looking forward to your reply,

TTFN

LGW

LGW-
I am at work right now, so I won't be able to perform your recommended actions for another sevral hours. Will get back to you as soon as possible after that.

Thanks
Jdub

No worries Jdub, we'll keep an eye out for you.

Looking forward to your reply,

TTFN

LGW

LGW-
Followed your instructions to the letter, and everything went well. No Vundo found.

The files I mentioned before are indeed all .exe files. They are not in the system32 folder; only in the root directory (C).

PC seems to be clean for the most part, but still experiencing slow scrolling, sluggishness when dragging windows and slow opening of programs.

Thanks for all your help, it's definitely appreciated. Let me know if you need me to post any other logs.

Jdub