How to remove Worm virus in MSN?

• shade343

  31 Mar 07, 22:10

  My MSN got infected with a worm. I accidentally accepted a file from one of my friends titled "photo album". It was an MS DOS script file. How do I get rid of the worm in my com?
  
  I deleted teh received file, but I believe the source file is still hiding somewhere. Can anybody help?
• allentyb

  31 Mar 07, 22:13

  mayi will be able to help you on this
• ndmmxiaomayi

  31 Mar 07, 22:13

  First live sample!
  
  OK. Download HijackThis and save it somewhere.
  
  Double click to run it. Click on Run a system scan and save a log file.
  
  Post that log file here.
• allentyb

  31 Mar 07, 22:16

  i take your edit of my post, as a NO
  
  
• ndmmxiaomayi

  31 Mar 07, 22:17

  Very obvious right?
• shade343

  31 Mar 07, 22:21

  Originally posted by ndmmxiaomayi:

  First live sample!
  
  OK. Download HijackThis and save it somewhere.
  
  Double click to run it. Click on Run a system scan and save a log file.
  
  Post that log file here.

  how come the dl so long?
• ndmmxiaomayi

  31 Mar 07, 22:21

  Originally posted by shade343:

  how come the dl so long?

  How can it be? It's a very small file.
• manyu882

  31 Mar 07, 22:22

  everytime sure post something around this line "your com hates you"
• allentyb

  31 Mar 07, 22:23

  Originally posted by manyu882:

  everytime sure post something around this line "your com hates you"

  noooo
  
  this time, is different
  
  mayi rejected me
  
  
  
  i am trying to be nice, this time round
  
• ndmmxiaomayi

  31 Mar 07, 22:24

  Originally posted by allentyb:

  noooo
  
  this time, is different
  
  mayi rejected me
  
  
  
  i am trying to be nice, this time round
  

  You don't make me type out 4 letters and probably ask Jason to ban you.
• shade343

  31 Mar 07, 22:25

  Logfile of HijackThis v1.99.1
  Scan saved at 10:24:31 PM, on 3/31/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16414)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\csrss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
  C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  C:\Acer\Empowering Technology\admServ.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
  C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
  C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Acer\Acer Arcade\PCMService.exe
  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
  C:\WINDOWS\system32\rundll32.exe
  C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  C:\acer\Empowering Technology\ePower\epm-dm.exe
  C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  C:\Acer\Empowering Technology\admtray.exe
  C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
  C:\Program Files\Spyware Doctor\sdhelp.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\WinPoET Broadband Connection\winpppoverethernet.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\wdfmgr.exe
  C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
  C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\System32\alg.exe
  C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  C:\Program Files\Abyss Web Server\abyssws.exe
  C:\Program Files\Abyss Web Server\abyssws.exe
  c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  C:\Program Files\Ares\Ares.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\msiexec.exe
  C:\Program Files\MSN Messenger\msnmsgr.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Documents and Settings\acer\My Documents\HijackThis.exe
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=proxy.sp.edu.sg:8080
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O4 - HKLM\..\Run: [LaunchApp] Alaunch
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
  O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
  O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
  O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
  O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
  O4 - HKLM\..\Run: [EPM-DM] c:\acer\Empowering Technology\ePower\epm-dm.exe
  O4 - HKLM\..\Run: [Acer ePower Management] C:\Acer\Empowering Technology\ePower\Acer ePower Management.exe boot
  O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
  O4 - HKLM\..\Run: [ADMTray.exe] "C:\Acer\Empowering Technology\admtray.exe"
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [a-winpoet-service] "C:\Program Files\WinPoET Broadband Connection\winpppoverethernet.exe"
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
  O4 - Startup: Neverwinter Nights Registration.lnk = C:\NeverwinterNights\NWN\ereg\ATR1.EXE
  O4 - Global Startup: Bluetooth.lnk = ?
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O8 - Extra context menu item: &Sample Toolband Serach - res://C:\WINDOWS\system32\ToolBand.dll/MENUSEARCH.HTM
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
  O8 - Extra context menu item: Send To &Bluetooth - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
  O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
  O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O11 - Options group: [INTERNATIONAL] International*
  O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
  O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O21 - SSODL: rdihost - {63A0CC20-FE17-4219-A7D0-34C6F21F671B} - rdihost.dll (file missing)
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
  O23 - Service: AdminWorks Agent X6 (AWService) - Avocent Inc. - C:\Acer\Empowering Technology\admServ.exe
  O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
  O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
  O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
  O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
  O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
  O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
  O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
  O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
  O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
  O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
  O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
  O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
  
  
• shade343

  31 Mar 07, 22:26

  Okie done. I clicked on system scan and save a logfile
• allentyb

  31 Mar 07, 22:27

  Originally posted by ndmmxiaomayi:

  You don't make me type out 4 letters and probably ask Jason to ban you.

  
  
  i feel like crying
• ndmmxiaomayi

  31 Mar 07, 22:34

  Show hidden files and folders
  

  [*]Open My Computer.
  [*]Go to Tools > Folder Options.
  [*]Select the View tab.
  [*]Scroll down to Hidden files and folders.
  [*]Select Show hidden files and folders.
  [*]Untick Hide extensions of known file types.
  [*]Untick Hide protected operating system files (Recommended).
  [*]Click Yes when prompted.
  [*]Click OK.
  [*]Close My Computer.

  
  
  Search for this file: rdihost.dll
  
  

  [*]Go to Start > Search.
  [*]When the dog asks What do you want to search for?, click All files and folders.
  [*]In All or part of the file name, copy and paste this file name in.
  [*]Click More advanced options. Check (tick) these boxes:
  
  [*]Search system folders
  [*]Search hidden files and folders
  [*]Search subfolders
  
  [*]Click Search.

  
  
  When the search is done, upload this file to Jotti or Virus Total
  
  Post back Jotti or Virus Total scan results.
• shade343

  31 Mar 07, 22:41

  AntiVir Found nothing
  ArcaVir Found nothing
  Avast Found nothing
  AVG Antivirus Found nothing
  BitDefender Found Generic.Malware.IYddld.86CB5848
  ClamAV Found nothing
  Dr.Web Found BackDoor.IRC.Shadowbot
  F-Prot Antivirus Found nothing
  F-Secure Anti-Virus Found nothing
  Fortinet Found nothing
  Kaspersky Anti-Virus Found nothing
  NOD32 Found a variant of Win32/IRCBot.WO
  Norman Virus Control Found nothing
  Panda Antivirus Found nothing
  Rising Antivirus Found nothing
  VirusBuster Found nothing
  VBA32 Found nothing
  
• shade343

  31 Mar 07, 22:42

  File: rdihost.dll
  Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
  MD5 a1d74a9027b8e81b6f2296112144517c
  Packers detected: -
  
• shade343

  31 Mar 07, 22:50

  do I delete that file?
• ndmmxiaomayi

  31 Mar 07, 22:54

  OK, results as expected.
  
  Read this post.
  
  As per post, recommended solution is reformat and reinstall because it can steal information. If there's anything sensitive such as banking passwords or other passwords, it could have stolen.
  
  Your virus is a Vanebot.
  
  Download SDFix and save it to somewhere convenient.
  
  Double click to install it. Once it's installed, read the Notepad file that opens. It will tell you where SDFix is being installed. Take note of it.
  
  Reboot into Safe Mode. Locate SDFix and double click on RunThis.bat to start the removal process.
  
  Type Y to begin the cleanup process. It will find and remove the infected files and clean up your registry. When done, it will prompt you to reboot.
  
  Press any key to restart. After it restarts, the tool will run again. Once it's done, it will show Finished. Press any key to exit.
  
  Notepad (report.txt) will then open.
  
  Post the contents of report.txt and a new HijackThis log.
• ndmmxiaomayi

  31 Mar 07, 22:55

  Originally posted by shade343:

  File: rdihost.dll
  Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
  MD5 a1d74a9027b8e81b6f2296112144517c
  Packers detected: -
  

  Nope, not yet. See my instructions below.
• blackchickenahkai

  31 Mar 07, 23:04

  Originally posted by ndmmxiaomayi:

  You don't make me type out 4 letters and probably ask Jason to ban you.

  wah..since when ah yi so scary de......
• ndmmxiaomayi

  31 Mar 07, 23:06

  Originally posted by blackchickenahkai:

  wah..since when ah yi so scary de......

  ah kai!!!!
  
  Long time no see. How are you?
• blackchickenahkai

  31 Mar 07, 23:15

  Originally posted by ndmmxiaomayi:

  ah kai!!!!
  
  Long time no see. How are you?

  fine fine...but u r quite a bit scary d..last time like a small ant..now like.......... T-rex
  
  hehe//i;m fine.just drop in to ease my boredome.
  
  how bout u?
  
• ndmmxiaomayi

  31 Mar 07, 23:17

  Originally posted by blackchickenahkai:

  fine fine...but u r quite a bit scary d..last time like a small ant..now like.......... T-rex
  
  hehe//i;m fine.just drop in to ease my boredome.
  
  how bout u?
  

  You long time no come here... never see the havoc created... that's why now very fierce...
  
  Ease boredom go Shoutbox, don't disturb people thread. Can chat there.
• shade343

  31 Mar 07, 23:53

  Originally posted by ndmmxiaomayi:
  OK, results as expected.
  
  Read this post.
  
  As per post, recommended solution is reformat and reinstall because it can steal information. If there's anything sensitive such as banking passwords or other passwords, it could have stolen.
  
  Your virus is a Vanebot.
  
  Download SDFix and save it to somewhere convenient.
  
  Double click to install it. Once it's installed, read the Notepad file that opens. It will tell you where SDFix is being installed. Take note of it.
  
  Reboot into Safe Mode. Locate SDFix and double click on [b]RunThis.bat to start the removal process.
  
  Type Y to begin the cleanup process. It will find and remove the infected files and clean up your registry. When done, it will prompt you to reboot.
  
  Press any key to restart. After it restarts, the tool will run again. Once it's done, it will show Finished. Press any key to exit.
  
  Notepad (report.txt) will then open.
  
  Post the contents of report.txt and a new HijackThis log.[/b]

  The notpad file nvr pop up. So where is SDfix installed?
• gigabyte14

  31 Mar 07, 23:57

  c drive