Unknown process in processes list (dcf5678.exe)

I appear to have a file that is in my processes which I believe is spyware. The name of the file is dcf5678.exe. Spyware Doctor (when run) finds it as an infection, quarantines it but then when I reboot the same file appears again. Does anyone know how to get rid of this please?

Thanks.
David

 

You have not completed the online scans in the READ ME. Lets start by running these online scans.

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After you run these online scans, reboot and post a fresh HJT log from normal mode.

 

Ok will do. Thanks

 

Will be awaiting results!

 

As promised please find attached logfile after running the online virus scanners you suggested.

Regards
David

 

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

INSTANTACCESS.EXE

SYSUPUDT.EXE

DCF5678.EXE

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

O2 - BHO: CIEObject Object - {5D647E9C-6B37-4636-9A78-DADB1EB93BDF} - C:\WINDOWS\SYSTEM\CTXPOPUP.DLL

O4 - HKLM\..\Run: [NavRegReminder] "C:\WINDOWS\TEMP\NAVBROWSER.EXE" /r /i "C:\WINDOWS\TEMP\NavLoad.ini"
O4 - HKLM\..\Run: [AdUpdater] C:\WINDOWS\SYSUPUDT.EXE
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\DCF5678.EXE

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -%windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O15 - Trusted Zone: *.boxsearch.net
O15 - Trusted Zone: *.brdatahost.com

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\TEXTBRIDGE CLASSIC 20 ←–– Delete this whole folder if it exist!

C:\WINDOWS\web\related.htm

C:\WINDOWS\SYSUPUDT.EXE

C:\WINDOWS\DCF5678.EXE

C:\WINDOWS\SYSTEM\CTXPOPUP.DLL

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!