Recurring hijack problem

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I'm in a repeating cycle where the detail vary a bit from cycle to cycle.
The 1st time these processes started when I started IE
dt3d.exe (which tried to access the internet, but my firewall stopped)
appud32.exe
and when I used regedit, I saw dt3d.exe to run in "My
Computer\HKEY_LOCAL_MACHINE\SOFTWAREE\Microsoft\Windows\CurrentVersion\Run"

The 2nd time, these processes started
C:\WINDOWS\ipwq.exe
C:\WINDOWS\SYSTEM32\msuh.exe
and in regedit
ipwq.exe was to be started in
My
Computer\HKEY_LOCAL_MACHINE\SOFTWAREE\Microsoft\Windows\CurrentVersion\Run
and msuh in RunOnce

then d3ai32.exe started and tried to access the internet
and d3ai32.exe, d3wx.exe, ntwg32.exe, processes showed up

Generally, some combination of these problems keep showing up no matter what
I do - edit them out of the registry, delete those files in c:\windows and
c:\windows\system32 - they keep coming back.

I'd appreciate any help.

adTHANKSvance
 
Hi,
It's becoming common for malware to generate new, renamed, random-named
files. A combination of HijackThis and expert help should allow you to clean
this up.

Start with the message at
http://forum.aumha.org/viewtopic.php?t=4075 Then go to
http://www.aumha.org/a/quickfix.htm Work through the preliminary cleaning
steps then post a HijackThis log to the forum at
http://forum.aumha.org/viewforum.php?f=30

Be patient. It's a busy forum.

Hope this helps,
Don
[MS MVP- IE/OE]

"sifi976" wrote in message
news:[email protected]...
 
Back
Top