Unknown Infection: HijackThis! log included, please read.

Please read the announcement and sticky threads. HJT logs should only be posted when requested and then they must be attachments to your message. You do not even have the proper version of HJT. You also have traces of a SpySheriff infection so I'm going to refer you to that sticky thread which also contains our required standard cleanup process and also instructions on downloading, installing and using HijackThis.


So run ALL the steps in the order give in: SpySheriff (aka SpywareNo) Removal

 

OK! Let us know the results when you finish.

 

If you were not in safe mode, that is probably why you could not delete it. You need to make sure when we say boot in safe mode, that you are in safe mode.

You also must remember that no browsers are to be running when using HijackThis. You had:

C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

You still never ran all the steps in the READ ME FIRST. Please complete ALL of them.

 

At a minimum, you did not run the online scanners (RAVantivirus and BitDefender) step 1 of the cleaning phase. If you did, they would show in your log. If you cannot run them in safe mode, the read me tells you to run them in normal boot mode. You never said anything about not being able to run them.

I quote from the read me. Notice the large magenta print about not skipping these steps.

 

If you still run into any difficulties trying to get into safe mode when necessary, try using the msconfig method of booting in safe mode. The below link describes this:

http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam

If that does not work, just run ALL steps in normal boot mode.

 

Do you know if the below line is for something you added to AIM. It does not appear to be valid:
O21 - SSODL: AOL Instant Messenger - {5405C09A-42AC-5089-0C13-F2411B0346D5} - c:\program files\aim\wayuhyl32.dll


If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\System32\explorer6s4.exe
C:\WINDOWS\System32\vxh8jkdq2.exe

After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm
O2 - BHO: (no name) - {7A1693A1-AFAF-4F1E-9B05-EEC38A85FBF3} - C:\WINDOWS\system32\kai.dll
O4 - HKLM\..\Run: [Explorer32] C:\WINDOWS\System32\explorer6s4.exe
O4 - HKLM\..\RunOnce: [gpjkyq.exe] C:\WINDOWS\System32\gpjkyq.exe /k
O4 - HKCU\..\Run: [SNInstall] C:\WINDOWS\System32\vxh8jkdq2.exe
O4 - HKCU\..\RunOnce: [gpjkyq.exe] C:\WINDOWS\System32\gpjkyq.exe /k

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O15 - Trusted Zone: *.asdbiz.biz
O15 - Trusted Zone: *.asdbiz.biz (HKLM)
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.178.84
O15 - Trusted IP range: 67.19.178.84 (HKLM)


After clicking Fix, exit HJT.
Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\system32\kai.dll
C:\WINDOWS\System32\explorer6s4.exe
C:\WINDOWS\System32\gpjkyq.exe
C:\WINDOWS\System32\vxh8jkdq2.exe


If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST). Now if running Win XP goto c:\windows\Prefetch and delete all files in this folder.

Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

You're welcome! Have HJT fix the below line:

O21 - SSODL: AOL Instant Messenger - {5405C09A-42AC-5089-0C13-F2411B0346D5} - c:\program files\aim\wayuhyl32.dll (file missing)

After that you need to follow the steps in the below thread to help keep you clean:

How to Protect yourself from malware!