Idesk removal.

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

Please follow the steps below:

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

- Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.


After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis

.

 

You did not post the BitDefender log as required. And I really need the Panda log you said you could not find. Look for it! It is normally named Activescan.txt by default.

It would be better if I had the above logs first but give the below a try.

If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\system32\idemlog.exe

After killing all the above processes, click "Back".
Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone

After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\system32\idemlog.exe
C:\WINDOWS\system32\idesk.conf
C:\WINDOWS\system32\howiper.exe
C:\WINDOWS\system32\sphlp32.exe
C:\WINDOWS\system32\close.bmp
C:\WINDOWS\system32\favset.exe
C:\WINDOWS\system32\spyware.bmp
C:\WINDOWS\system32\insurance.bmp
C:\WINDOWS\system32\xxx.bmp
C:\WINDOWS\system32\dating.bmp
C:\WINDOWS\system32\pharmacy.bmp
C:\WINDOWS\system32\gambling.bmp
C:\WINDOWS\system32\hgqhp.exe
C:\WINDOWS\system32\pppcgm.exe
C:\WINDOWS\system32\fran-hot.exe
C:\WINDOWS\system32\qurrv.dll
C:\WINDOWS\system32\filesafer23.exe

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Those files just may not exist on your PC. As I said, I needed the other logs first so I was indicating some files that could be found with your problem but they do not necessarily always appear.

You have some addtional things to remove based on the Panda log. It still shows the C:\WINDOWS\system32\idemlog.exe file. Was the Panda log from before you deleted the file? At anyrate, I'm going to have you donwload a tool that is better at finding and deleting files than Windows Explorer.

Download and install: ExplorerXP

Then use ExplorerXP to delete all the below files if found:
C:\WINDOWS\SYSTEM32\cd_clint.dll
C:\WINDOWS\SYSTEM32\d2kpax.dll
C:\WINDOWS\DOWNLOADED PROGRAM FILES\WildApp.inf
C:\Program Files\Mozilla Firefox\extensions\{2bafa858-4ff3-4207-822e-ef46d1b431de}\chrome\isearch.jar[isearch.js]
C:\Program Files\RBO\Uninstal.exe
C:\WINDOWS\Downloaded Program Files\WildApp.inf
C:\WINDOWS\Downloaded Program Files\xxx_flat.exe
C:\WINDOWS\system32\idemlog.exe
C:\WINDOWS\system32\logo_big.exe

How is everything working now?

 

Well if everything is working okay now, you should proceed to the below link to help keep you clean:

How to Protect yourself from malware!