[evilfantasy]

I figured as much from the way it is installed.

Let's do this first to see if it works.

Put this command into The Avenger.

Files to delete:
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

Post the log when it is complete.

[proyal03]

hi.. still installing kapersky... wont that clash with the mcafee

[proyal03]

the kapersky wont work.. saying it clashing with mcafee.. but nero log on way.

[proyal03]

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\jrfrjljb
*******************
Script file located at: \??\C:\WINDOWS\system32\giffhcay.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:

File C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe not found!
Deletion of file C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe failed!
Could not process line:
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
Status: 0xc0000034

Completed script processing.
*******************
Finished! Terminate.

[proyal03]

what do i do with all the downloads you gave me..

[evilfantasy]

OK use this input for Avenger.

Folders to delete:
C:\Documents and Settings\Compaq_Owner\Application Data\Nero
C:\Program Files\Common Files\Nero
C:\Documents and Settings\All Users\Application Data\Nero

Registry keys to delete:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NeroCheck
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NBKeyScan

[evilfantasy]

Originally Posted by proyal03

what do i do with all the downloads you gave me..

We will take care of them when the computer is clean.

Originally Posted by proyal03

the kapersky wont work.. saying it clashing with mcafee.. but nero log on way.

Can you disable it while the scan is running? The Kaspersky scan is important so we need to get it to run.

[proyal03]

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////
Syntax error in line --- does not appear to be a valid registry path. Line will be ignored.
Error code: 0
Line: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}

//////////////////////////////////////////

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\cijrpfuf
*******************
Script file located at: \??\C:\WINDOWS\swppaphb.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Folder C:\Documents and Settings\Compaq_Owner\Application Data\Nero deleted successfully.
Folder C:\Program Files\Common Files\Nero deleted successfully.
Folder C:\Documents and Settings\All Users\Application Data\Nero deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NeroCheck not found!
Deletion of registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NeroCheck failed!
Status: 0xc0000034

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NBKeyScan not found!
Deletion of registry key

gonna try kaspersky




HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NBKeyScan failed!
Status: 0xc0000034

Completed script processing.
*******************
Finished! Terminate.

[proyal03]

i will leave it here and carry on tommorrow

[evilfantasy]

We are getting closer, this should take care of it.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

After the Kaspersky completes then run a new Hijackthis scan and post the log also.