Thank You, Thank You, Thank You:)

dvzon · Jul 11, 2006

I had a problem with spyware and because of your advice, it was solved. Great website, I've bookmarked it and will recommend it to anyone and everyone who has problems with their computers concerning spyware or hacks. Thank you so much! Log uploaded.

chaslang · Jul 12, 2006

Welcome to Majorgeeks!

I'm happy to hear that the procedure help you out, but you are not quite done yet. You have a newer component of these infections that we need to fix.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"fairydom"=-

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"fairydom"=-
[-HKEY_CLASSES_ROOT\CLSID\{5839511e-ec1b-4f91-ace3-fb88e52f5239}]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5839511e-ec1b-4f91-ace3-fb88e52f5239}]
Click to expand...

Now reboot your PC into safe mode and look for the below file (I'm assuming your Windows folder is C:\Windows ). SmitRem may have already removed it but we need to double check.

C:\windows\system32\jevtxpg.dll

Afterwards attach a new log from running SmitRem (the RunThis.bat file)

Is everything still working OK?

Log in or Sign up

Thank You, Thank You, Thank You:)

dvzon Private E-2

Attached Files:

smitfiles.txt

chaslang MajorGeeks Admin - Master Malware Expert Staff Member