Please run HijackThis and place a checkmark by the following entries:
O2 - BHO: (no name) - {6F481F80-D133-AA9D-4F60-FC8DCC2783E8} - (no file)
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xmlhelper2.dll
O2 - BHO: (no name) - {95D9B540-90F9-413B-85D5-646824820D33} - (no file)
O4 - HKLM\..\Run: [SecureWeb] C:\WINDOWS\system32\v2q44o0O.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
If you don't use a proxy, please tick:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyServer = 168.94.74.68:8080
Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis and restart the computer.
Next clear your recycle Bin.
Then download
SmitfraudFix (by
S!Ri)
Extract the content (a folder named
SmitfraudFix) to your Desktop.
Open the
SmitfraudFix folder and double-click
smitfraudfix.cmd
Select option #1 -
Search by typing
1 and press "
Enter"; a text file will appear, which lists infected files (if present).
Please attach the content of that report into your next reply, along with a new HijackThis log.
Note :
process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm