Trojan virus that I cannot remove

Hello,

My Norton internet security is reporting an infected file, vocnyg.dll, but cannot repair it. I have been through the 'read and run me first' procedures, finally running HijackThis and am attaching the log. Any help would be appreciated.

 

Hello, keithbold and welcome to Major Geeks.

Before we continue, I need you to install HijackThis to a safer location. Please install HijackThis to C:\HJT. The reason I ask this is so that the backup function in HijackThis will work correctly and create backups of the changes I will have you do using HijackThis. This way if something does not work properly after a change we can restore the line that was removed.

 

Thanks for your response Shadow.

I have installed it to c:\hjt and am attaching the new log file

Keithbold

 

Download
- Pocket Killbox

Scan with HijackThis and fix the following:

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note many of the file list below may not exist but we need to check for them anyway.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

Now run CCleaner. If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to Normal Mode.

Post a fresh HijackThis log.

 

Thanks again Shadow.

I have followed your procedure and things have improved. On startup the infected file has not been immediately highlighted by norton internet security but there is still a reference to the file in the HJT log. Do you think thats significant?

Thanks again for your help.

Keith Bold

 

Scan with HijackThis and fix the following lines:

 

Many thanks Shadow.

These items have now gone from the HJT log. I have attached it anyway for your information. I really appreciate your accurate and timely help.

Best Regards,....Keith Bold

 

Those lines are back.

Scan with HijackThis and fix the follwoing:

 

Hello again Shadow

Thanks again for your response. I must have uploaded a previous log file. I have scanned using Hijack This again and those lines are not there. I have uploaded the log file, which I have examined.

I would appreciate your advice if work is still required.


Many thanks,..Keith Bold

 

Your log is clean. How is your computer running?

 

Shadow,

Thanks for looking again at the log. My computer seems to be running fine. Norton internet security is no longer identifying any infected files.

Many thanks,....Keith Bold