Help HJT please

[jholland1964]

Ok vance,
Sorry this has taken so long but I wanted to consult with ~TL and see if he agreed with what I thought was the way to go.
Now you can see by reading the newest Kaspersky log listed are;
Number of viruses found: 4
Number of infected objects: 4

Which is certainly better than your first and second and third Kaspersky logs which showed;

#1.
Number of viruses found: 26
Number of infected objects: 137
Number of suspicious objects: 6
#2.
Number of viruses found: 11
Number of infected objects: 95
#3.
Number of viruses found: 11
Number of infected objects: 97

So obviously things are looking MUCH better. Now two of these entries are shown in your System Restore so you can get rid of those immediately by stopping your System Restore right now and also, until we are certain all is well, changing it's startup type to 'Disabled.
I want you to do this now and do it this way;
Go to Start, Control Panel, Administrative Tools, Services.
Scroll down through that list until you see System Restore. Right Click and choose Properties,
When that opens I want you to click the Stop button. Once it is Stopped then I want you to click the Start Up Type to Disabled. Click OK. Then exit out of there. Then go to My Computer. Right Click and choose Properties. When the System Properties box opens choose the System Restore Tab and be certain that it IS turned off. Once you are certain it is turned off...there should be a checkmark in Turn Off System Restore...then MANUALLY run Disk Cleanup Manager
Do it this way;
Click Start > Run > cleanmgr /d c: > OK > It will scan and then show you what can be cleaned up.... click on "More Options" tab > click "clean up.." button under System Restore section at the bottom
(note* be sure to put a space between cleanmgr and the / and also a space between the d and c:

Now earlier in this thread I had you run ~TL's CleanUpXP+
you are going to need to do this again. If you do not still have it on the computer then you will need to download it again by clicking the link above.
Once you are certain you have CleanUpXP+ on the computer then please REBOOT the computer in SAFE MODE.

Once in Safe Mode double click CleanXP+ to run the program.

It will run a standard cleanup first of all the temp, Temporary Internet Files, Cookies, History and Recent,
Prefetch and Recycle Bin files on the system. After the standard cleanup, the program will prompt the you to see if a specific file/folder is to be removed.

Please choose Option 1. Remove a File:

This is the file you need to have the program remove;

C:\WINDOWS\wjkxdrtA.exe

Run CleanXP+ and then reboot into normal mode

Once all steps are completed successfully, and you have rebooted in normal mode make sure System Restore is not yet enabled.

If for some reason you see that it IS turned back on.. TURN IT OFF.

I will tell you when it is safe to turn it back on.

Now run a new Kaspersky scan and save the log and post it back here.
Judy

[vancek]

I did everything that you told me to. I was getting ready to post my Kaspersky log and decided to look at it out of curiosity. I noticed that file that you had me remove was still showing up as a Trojan. Although I had double checked it when I did it the first time, I rebooted into Safe Mode in order to try to remove it again. This time I double, triple and quadrupled checked it. Then I ran Kaspersky again. I don't know what to tell you, but it is still on there.

[jholland1964]

Ok then we will try another program.
Download Killbox


Killbox – single file delete on reboot
Double-click Killbox.exe to run it.

Select "Delete on Reboot".
Place the following line in bold in the "Full Path of File to Delete" box in Killbox:
C:\WINDOWS\wjkxdrtA.exe
Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.

Try that one and then run a new Kaspersky scan and see what shows...this thing is a royal PAIN!!!

[vancek]

Normal or Safe Mode?