POS Malware trouble...

I've done the steps in the "Read Me First" thread, and it hasn't fixed the problem.

What seems to be happening is a program trying to create popups, then IE telling me that what I'm trying to open presents a security risk, resulting in endless IE popups. I located a bogus process running, and went into safe mode to delete it from system32, which I figured would solve it, but it looks like it just went ahead and made a new .exe to run the same thing, with a different name.

The processes that run are "tmp3a.tmp" "logonui.exe" and "avifcint.exe".

Attached are a HijackThis and BitDefender scan.

 

Windows Defender and HijackThis are both installed incorrectly. Uninstall both applications and reinstall to their proper locations.

Whatever you are disableing with MSConfig, don't. We need to see everything that could be effecting your system. Re-enable all process and startup items in MSConfig.

Reboot.

Post a fresh HijackThis log after HJT has been properly installed.

 

Alright, I think I have it right this time...

 

Download
- Pocket Killbox

Using Add or Remove Programs in the Control Panel. Uninstall the following:
WildTangent
Zango Toolbar

Now Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click the RED X.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

 

Wow, looks like it's all gone. Thank you!

 

Windows Messeger is running in the background, and represents a security risk. Disable Windows Messenger by running Shoot The Messenger. If you are using this as your IM client then replace it with MSN Messenger.

Your HijackThis log is clean.

 

Done and done.

Thank you very much.

 

Lets flush all your restore points and create a new clean one for your system.

Disable And Enable System Restore
How to Protect yourself from malware!

Safe surfing.