explorer keeps closing

ok what do i do next
is my computer almost clean?

 

Sorry for the delay, real life is keeping me packed.

I'll reply to you shortly.

Thanks.

~Ltangel~

 

Hey BALLATONY,

Yes, we are almost done. One last round of scanning and we can close this.

Please read the entire instructions before commencing, if you have anything you don't understand, feel free to ask. It's best that you print out the instructions for later reference, we may need to reboot in between the fixing.

Fix entries with HJT

Please reopen HijackThis and "Do a system scan only".

Put a check on the entries below:

O20 - Winlogon Notify: ddcbyvu - C:\WINDOWS\SYSTEM32\ddcbyvu.dll
O20 - Winlogon Notify: ljjggfc - ljjggfc.dll (file missing)
O20 - Winlogon Notify: mllmj - C:\WINDOWS\
O20 - Winlogon Notify: rqrsqom - rqrsqom.dll (file missing)
O20 - Winlogon Notify: vtutt - C:\WINDOWS\


Close all windows/browsers and then click "Fix checked". Close HJT.

Now please reboot into safe mode. Press the F8 key on restart before the Windows icon appear.

Go to Add/Remove Programs in control panel and remove the following programs (if present):

3gp Video converter
True Sword 4

Then go to Windows Explorer, search for the following folders/files and delete them (if present):

Folders
C:\Program Files\True Sword 4
C:\Program Files\Spyware Terminator\
C:\Program Files\Crawler\

Files

C:\Program Files\3gp_Video_converter.rar
C:\WINDOWS\SYSTEM32\ddcbyvu.dll
C:\WINDOWS\SYSTEM32\ljjggfc.dll
C:\WINDOWS\SYSTEM32\mllmj
C:\WINDOWS\SYSTEM32\rqrsqom
C:\WINDOWS\SYSTEM32\vtutt.dll

Reboot back into normal windows.

--------------------------------------------------------------------

Clean your temporary files

Download ATF Cleaner.

*Double-click ATF-Cleaner.exe.
* Under Main tab choose "Select All".
* Click the Empty Selected button.

If you use Firefox browser

Click Firefox and choose Select All
Click the Empty Selected button.

If you use Opera browser

Click Opera at the top and choose Select All
Click the Empty Selected button.

Click Exit to close the program.

--------------------------------------------------------------------

Scan with Dr Web CureIT

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe


* Doubleclick the drweb-cureit.exe file and Allow to run the express scan.
* This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
* Once the short scan has finished, mark the drives that you want to scan.
* Select all drives. A red dot shows which drives have been chosen.
* Click the green arrow at the right, and the scan will start.
* Click 'Yes to all' if it asks if you want to cure/move the file.
* When the scan has finished, look if you can click next icon next to the files found:
* If so, click it and then click the next icon right below and select Move incurable.

This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)

* After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list.
* Save the report to your desktop. The report will be called DrWeb.csv.
* Close Dr.Web Cureit.
* Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.


--------------------------------------------------------------------

In your next reply, please include:

Fresh HijackThis log
Dr web scan report
Description of how your PC is doing (any more problems?)

Go!

~Ltangel~

 

Do you still need help? If so, please do the instructions above and post a fresh HijackThis log. Thanks.

~Ltangel~

 

Due to the lack of response to the thread, I will stop assisting. If you still need help, please follow the latest instructions given and PM me.

Thanks.

~Ltangel~