Help

i get
'PendingFileRenameOperation Registry Data has been Removed by External Process!'
upon finishing countdown

"SnoopDogg" wrote:i get
'PendingFileRenameOperation Registry Data has been Removed by External Process!'
upon finishing countdown

Is that for killbox or OTMoveit?

that was from killbox

Please follow the directions I posted for OTMoveit and continue with the rest of the fix from after the killbox instructions

everything wasnt found

File/Folder C:\WINDOWS\System32\telecomes.exe not found.
File/Folder C:\WINDOWS\System32\agjler.exe not found.
File/Folder C:\WINDOWS\System32\iwuokc.exe not found.
File/Folder C:\WINDOWS\System32\osootzlh.exe not found.
File/Folder C:\WINDOWS\System32\uammjcp.exe not found.
File/Folder C:\WINDOWS\System32\gebrv.exe not found.
File/Folder C:\WINDOWS\System32\kcnpm.exe not found.
File/Folder C:\WINDOWS\System32\fjsrsyiq.exe not found.
File/Folder C:\WINDOWS\System32\lrpag.exe not found.
File/Folder C:\WINDOWS\System32\gbeu.exe not found.
File/Folder C:\WINDOWS\System32\padhz.exe not found.
File/Folder C:\WINDOWS\System32\cygs.exe not found.
File/Folder C:\WINDOWS\System32\fmokyhcm.exe not found.
File/Folder C:\WINDOWS\System32\spad.exe not found.
File/Folder C:\WINDOWS\System32\ubrrv.exe not found.
File/Folder C:\WINDOWS\System32\pmydsq.exe not found.
File/Folder C:\WINDOWS\System32\loqzfovh.exe not found.
File/Folder C:\WINDOWS\System32\loqzfovh.exe not found.
File/Folder C:\WINDOWS\System32\pqseui.exe not found.
File/Folder C:\WINDOWS\System32\ejnxksm.exe not found.
File/Folder C:\WINDOWS\System32\fibfo.exe not found.
File/Folder C:\WINDOWS\System32\qktuyc.exe not found.
File/Folder C:\WINDOWS\System32\mgykl.exe not found.
File/Folder C:\WINDOWS\System32\oyfkfck.exe not found.
File/Folder C:\WINDOWS\System32\fodvue.exe not found.
File/Folder C:\WINDOWS\System32\nffvkdkx.exe not found.
File/Folder C:\WINDOWS\System32\zudptx.exe not found.
File/Folder C:\WINDOWS\System32\zbhg.exe not found.
File/Folder C:\WINDOWS\System32\cxwtgoy.exe not found.
File/Folder C:\WINDOWS\System32\hjrcwnqh.exe not found.
File/Folder C:\WINDOWS\System32\ilfhc.exe not found.
File/Folder C:\WINDOWS\System32\spoolvc.exe not found.
File/Folder C:\WINDOWS\System32\lrpag.exe not found.
File/Folder C:\WINDOWS\System32\explorer.exe not found.
File/Folder C:\WINDOWS\system32\spoolvc.exe not found.
File/Folder C:\WINDOWS\system32\ilfhc.exe not found.
File/Folder C:\WINDOWS\system32\csrs.exe not found.
File/Folder C:\WINDOWS\System32\wnwavm.exe not found.
File/Folder C:\Documents and Settings\Swee Pei\Local Settings\Temp\wz1b45\KeySet.exe not found.
File/Folder C:\WINDOWS\System32\winupd32.exe not found.

Created on 04/06/2007 00:15:10

how about another HJT and WindPFind log ?

Please carry on with the rest of the instructions

Thanks for the help, but i guess i'll hav to let it go and reinstall everything (when the time comes)

It's getting more and more serious and i dont think i'll proceed any further. Please do whatever u should, such as locking this thread or something...

Thanks again for the help, i really appreciate it.

Apologies for the delayed reply

A format is the best choice and it needs to be done as soon as possible

Below are my normal recommendations to keep a machine clean

You now appear to be clean. Congratulations!

1. Use an antivirus program
   Two good free programs are
   AVG
   Avast<I use this one
   
   Two good paid-for programs are
   NOD32
   Bitdefender
   
   Whichever antivirus you choose, it is essential that you keep it up to date
2. Use a firewall
   While the firewall built into windows XP will protect you from incoming attacks, it will not monitor outgoing connections
   It is therefore recommended that you install one of the following firewalls
   Sunbelt kerio personal firewall
   Zonealarm
   
3. Keep windows up to date with the latest patches
   
   
   IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.
   
   If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.
   
4. Install spywareblaster
   Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes
   kill bits
   in the registry, so that certain activex controls can't install.
   If you don't know what activex controls are, see here
   You can download SpywareBlaster here here
   Make sure to update it on a regular basis
5. Install IE-SPYAD
   Dowload and instructions located here
   Make sure to update it on a regular basis
6. Use a HOSTS file
   
   • Every version of windows has a hosts file as part of them.
   • In a very basic sense, they are used to locate webpages.
   • We can customize a hosts file so that it blocks certain webpages.
   • However, it can slow down certain computers.
   • This is why using a hosts file is optional!!
   
   Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
   If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
   
   Click the start button (at the lower left hand corner of your screen) Click run In the dialog box, type services.msc hit enter, then locate dns client Highlight it, then double-click it. On the dropdown box, change the setting from automatic to manual. Click ok
7. Install and use Ad-aware & Spybot search & destroy
   Instructions are located here
   Make sure to update them on a regular basis
8. Most exploits are aimed at internet explorer, so I recommend you switch to an altenative browser
   Two good alternative browsers are
   Firefox
   Opera
   It is essential to update to the latest version of your browser, as the updates fix known security holes
9. Even if you do decide to switch to another browser, it is still a good idea to lock down Internet explorer
   This can be done by following these simple instructions:
   From within Internet Explorer click on the Tools menu and then click on Options.
   Click once on the Security tab
   Click once on the Internet icon so it becomes highlighted.
   Click once on the Custom Level button.
   Change the Download signed ActiveX controls to Prompt
   Change the Download unsigned ActiveX controls to Disable
   Change the Initialize and script ActiveX controls not marked as safe to Disable
   Change the Installation of desktop items to Prompt
   Change the Launching programs and files in an IFRAME to Prompt
   Change the Navigate sub-frames across different domains to Prompt
   Change the allow paste operations via script to Disable
   When all these settings have been made, click on the OK button.
   If it prompts you as to whether or not you want to save the settings, press the Yes button.
   Next press the Apply button and then the OK to exit the Internet Properties page.
10. Clean out you temp file on a regular basis
    I use and recommend ATF Cleaner by Attribune
    To use it, follow these instructions
    
    • Double-click ATF-Cleaner.exe to run the program.
    • Click Main at the top and choose Select All from the list.
    • Click the Empty Selected button.
    If you use Firefox browser:
    
    • Click Firefox at the top and choose Select All from the list.
    • Click the Empty Selected button.
    • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser:
    
    • Click Opera at the top and choose Select All from the list.
    • Click the Empty Selected button.
    • NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.
11. Finally I am trying to make one point very clear. It is absolutely essential to keep all of your security programs up to date

thanks on the reply and plenty of useful advises and tips. well i hope this thread will be here til next time i relog after reformatting.

Glad we could be of assistance.

This topic is now closed. If you wish it
reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid,
working link to the closed topic is required along with the user name used.
If the user name does not match the one in the thread linked, the email will be deleted.