I downloaded Flashget download manager ( recommended by softpedia ) and this thing is a Chinese nightmare. There are characters in Chinese in various places.
I have carefully followed all of your requests and run all the programs. I've tried getting rid of this with Advanced Uninstaller Pro before I followed your instructions. This thing is really starting to worry me.
See attachments for further information.
The KWMUSIC is empty but the Leeboo App is nothing but not so nice Chinese photos.
Also the desktop running circle never stops Application is a not so nice group of photos with Chinese language.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:15 PM, on 5/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Sorry for the slow reply but we are short on help.
Lets start out with doing some maintenance with HJT, then we will try to rid the offending program.
Open Hijackthis and select Do a system scan only.
Place a check mark next to the following entries: (if there)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O4 - HKLM\..\Run: [leeboo.exe] C:\Program Files\Leeboo\leeboo.exe Auto
Important: Close all windows except for Hijackthis and then click Fix checked.
Exit Hijackthis.
----------
Now download The Avenger by Swandog46 and save it to your Desktop.
Extract avenger.exe from the Zip file and save it to your desktop
Run avenger.exe by double-clicking on it.
Do not change any check box options!!
Copy everything in the Code box below, and paste it into the Input script here window:
Code:
Comment:
Files to delete:
C:\Program Files\Leeboo\leeboo.exe
Note: the above instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system
Now click the Execute button.
Click Yes to the prompt to confirm you want to execute.
Click Yes to the Reboot now? question that will appear when Avenger finishes running.
Your PC should reboot, if not, reboot it yourself.
A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
Please add the Avenger log in your next post.
----------
There is also a questionable entry in the HJT log so we need to scan it and see what is revealed.
Scan Suspicious File(s)
Please visit [B]Virustotal[/B]
(If more than one file needs scanned they must be done separately and logs posted for each one)
Copy the file path in the below Code box:
Code:
%WINDIR%\SMINST\launcher.exe
At the upload site, click once inside the window next to Browse.
Press Ctrl+V on the keyboard (both at the same time) to paste the file path in the window.
Next click Send File
Your file will possibly be entered into a queue which normally takes less than a minute to clear.
This will perform a scan across multiple different virus scanning engines.
Important: Wait for all of the scanning engines to complete.
Copy and then Paste the link from your address bar from the results page in the next reply.
----------
Next post please add
Avenger log
VirusTotal results
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
