Member Panel

Mike Szoke · 06:24 AM

I have a download.trojan infection in the awtqp.dll and can't get rid of it Her's a copy of the log:

joe5

Hya Mike , welcome to PCHF.

Lets clean that right up.

Please download VundoFix.exe from here , and save it to your desktop.

Double-click VundoFix.exe to run it.
Put a check next to Run VundoFix as a task.
You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
When VundoFix re-opens, click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.

Then boot in safemode (hit f8 when booting up) and fix these with hjt:
(if still present)

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://resultsmaster.com/SmartOffers...sMasterHomeLef tPane.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = localhost
R3 - URLSearchHook: (no name) - - (no file)
O2 - BHO: (no name) - SOFTWARE - (no file)
O2 - BHO: (no name) - {20D57A66-F7DF-467d-907B-9B7F4A118AB7} - C:\WINNT\system32\awtqp.dll
O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINNT\system32\ddcyy.dll
O4 - HKLM\..\Run: [NI.UWFX6_0001_N57M0912] "C:\Documents and Settings\Michael Szoke\Local Settings\Temporary Internet Files\Content.IE5\WL2R4DMJ\WinFixer2006FreeInstall[1].exe" -nag
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\backWeb-7288971.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS
O9 - Extra button: ShopperReports - Compare product prices - {946B3E9E-E21A-49c8-9F63-900533FAFE15} - C:\WINNT\System32\shdocvw.dll
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - hcp://system/RunExeActiveX.CAB
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {C8BAC37C-A8D2-425E-B7FC-80B9537FB14A} - http://www.spyblast.com/download/SBFS.cab
O20 - Winlogon Notify: awtqp - C:\WINNT\SYSTEM32\awtqp.dll
O20 - Winlogon Notify: ddcyy - C:\WINNT\system32\ddcyy.dll

And delete the files marked in bold if still present.

When done , please post the contents of C:\vundofix.txt and a new HiJackThis log.