You have remnants of what looks like an old hackdefender infection so I would like to ensure that it has gone
Download
SDFix[/color] and save it to your Desktop.
Double click
SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in
Safe Mode by doing the following :
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
- Instead of Windows loading as normal, the Advanced Options Menu should appear;
- Select the first option, to run Windows in Safe Mode, then press Enter.
- Choose your usual account.
- Open the extracted SDFix folder and double click RunThis.bat to start the script.
- Type Y to begin the cleanup process.
- It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
- Press any Key and it will restart the PC.
- When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
- Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
- Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
THENPlease download the OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
D:\WINDOWS\system32\amvo1.dll
D:\WINDOWS\system32\mshost.dll
D:\WINDOWS\system32\SVKP.sysReturn to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
FINALLYDownload and run ERUNT
http://www.larshederer.homepage.t-online.de/erunt/Start ERUNT, confirm the Welcome message.
Type in the name of a restore folder where the backed up registry
files should be saved, or click "..." to browse your computer's drives
and select a folder. You can also simply leave the default, which is a
folder named ERDNT inside your Windows folder, the advantage being
that you have access to this folder from the Windows Recovery Console
in case Windows does not boot anymore.
Next, select the backup options:
-
System registry:-
Current user registy: .
-
Other open user registries: Click "OK" and wait until the backup process is complete. (Note that
depending on your system configuration this may take some time, and
that the first bar is NOT a progress bar, just an indicator that the
program is still running.) The ERDNT program for later restoration of
the registry is automatically copied to the restore folder.
WARNING these fixes are designed for this user only and may cause damage if run on an uninfected machineREGISTRY FIXREGEDIT4
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{500da6c4-1f26-11dc-9057-9e58c94adf39}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{52258050-f09e-11db-ba1e-a42cb8547228}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e429f94-9016-11dc-a76e-00195bfcf94e}]
Next you will need to create the repair registry fix to do that copy and paste
ALL of the above in the quote box to a notepad file. Ensure there is
no space above the REGEDIT4.
Then in notepad go to
FILE > SAVE AS and in the dropdown box select
SAVE AS TYPE to
ALL FILES Then in the
FILE NAME box type
fix.regThis will create a fix.reg file on your desktop
To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.
If I could have the SDFix report, OTMoveit report and a Hijackthis log
