Help Please..

[jholland1964]

Open notepad and copy/paste the text in the quote box below into it:

File::
C:\Documents and Settings\All Users\Application Data\WildTangent
C:\Documents and Settings\All Users\Application Data\kgvsrrma
C:\Documents and Settings\All Users\Application Data\uzkiodzh
C:\Documents and Settings\All Users\Application Data\odavibsv
C:\WINDOWS\system32\geBrsrRh.dll
C:\WINDOWS\wxdbpfvo.dll
C:\WINDOWS\system32\alabqbkn.exe
C:\WINDOWS\system32\imtdamet.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BE78B4A0-9873-4C13-ACC2-D898536C9798}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{C3169036-557E-45E1-840F-C845DC406C55}"=-

[-HKEY_CLASSES_ROOT\clsid\{c3169036-557e-45e1-840f-c845dc406c55}]

[-HKEY_CLASSES_ROOT\wxdbpfvo.1]

[-HKEY_CLASSES_ROOT\TypeLib\{D95C697F-D985-4AB1-92B5-40DF04BBE322}]

[-HKEY_CLASSES_ROOT\wxdbpfvo]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"sqrjigmy"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"ece3c94e"=-

Save this as CFScript on your desktop.



Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a fresh copy of HijackThis.

[ou8it]

[ou8it]

I'm at a loss as to why my post are not showing up. Any Ideas JH?

[ou8it]

[cauzomb]

wow strange! try posting with firefox or opera

[ou8it]

[cauzomb]

strange; try clearing all cookies/temp files, restart then repost

[ou8it]

not working, shall I restore? I get same dll error on restart. Combo fix did not reboot after your last script. I gave it plenty of time.

[ou8it]

Please go here and read the logs and what I did. This is my website and I can post the logs there.

http://forums.planetthinktanks2.com/...hp?f=18&t=3838

[jholland1964]

I see your attached logs just fine. Don't know why you are not. I do not however see anything on your posted link. Please give me some time to digest these and see what I can make of all of this.
The imt.damit.dll error is the result of this file being removed. It is or was listed as a start in the registry and therefore the computer is still looking for it. Just ignore it for now, we will get rid of that once I get through this log. Please have patience, I have to go through the logs line by line and investigate each item shown.