comptuer problem. need help please

i have a problem with some files that keep running and cant seem to find them or get rid of them.

i ran hijackthis and the problems are these two lines:

O4 - HKLM\..\Run: [fyyrndi] C:\Program Files\Common Files\System\grwwxgp.exe
O4 - HKLM\..\Run: [yvtcxhx] C:\Program Files\Common Files\Microsoft Shared\vnwbekj.exe

spybot dont work, and hijackthis said it fixed it but it didnt. it stays gone until i run any install exe of any kind.

any ideas? i find nothing about this except a ton of people are having the same problem. i have even put in new hard drives in both computers, and it came back on both. when it starts to run you cant run any kind of virus, spyware program. nor can you do the task manager to stop it.

[Praxeas]

Originally Posted by SisBeezer

i have a problem with some files that keep running and cant seem to find them or get rid of them.

i ran hijackthis and the problems are these two lines:

O4 - HKLM\..\Run: [fyyrndi] C:\Program Files\Common Files\System\grwwxgp.exe
O4 - HKLM\..\Run: [yvtcxhx] C:\Program Files\Common Files\Microsoft Shared\vnwbekj.exe

spybot dont work, and hijackthis said it fixed it but it didnt. it stays gone until i run any install exe of any kind.

any ideas? i find nothing about this except a ton of people are having the same problem. i have even put in new hard drives in both computers, and it came back on both. when it starts to run you cant run any kind of virus, spyware program. nor can you do the task manager to stop it.

First of all let me say this: Anytime you go online and you see a popup that says "Your computer may be infected, click here to do a scan" do NOT click ok. Click the X and close it. That is an attempt to install spyware or a virus on your computer.

You should also download and install the newest Spybot S&D. They have a total new program and adaware.

Does spybot report any spyware at all? Do you have the latest sig files?

i say this because I think I know what it is, but Spybot SHOULD report it, say it removed it, but it will be back.

Also you don't want to install any "tool bars"...

Also post the whole Hijackthis log

You should have at least two spyware scanners, and they should always be up to date.

Then you need a virus scanner too that is up to date. Do you have one? Virus scanners and even spyware scanners should get updates 2-3 times a week. You should do a manual update just to make sure you are getting them.

I need to know what they are reporting.

Also, try running spybot in safe mode. Also try hijackthis in safe mode

Originally Posted by Praxeas

First of all let me say this: Anytime you go online and you see a popup that says "Your computer may be infected, click here to do a scan" do NOT click ok. Click the X and close it. That is an attempt to install spyware or a virus on your computer.

i never do

You should also download and install the newest Spybot S&D. They have a total new program and adaware.

thats what i used the new spybot

Does spybot report any spyware at all?

nothing

Do you have the latest sig files?

yes

i say this because I think I know what it is, but Spybot SHOULD report it, say it removed it, but it will be back.

this is whats stumping me, spybot has never picked it up

Also you don't want to install any "tool bars"...

no i dont use any of those, not on purpose, i have had in the past one or two install itself but right now i dont have any installed

Also post the whole Hijackthis log

i will post it in following post

You should have at least two spyware scanners, and they should always be up to date.

Then you need a virus scanner too that is up to date. Do you have one? Virus scanners and even spyware scanners should get updates 2-3 times a week. You should do a manual update just to make sure you are getting them.

I need to know what they are reporting.

yes and yes on all that. i have TheCleaner for my virus program and update it about everyother day or three

Also, try running spybot in safe mode. Also try hijackthis in safe mode

not that one i didnt think to try. will try it next.

ok this is the hijackthis file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:28:34 PM, on 11/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Ad Muncher\AdMunch.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\vnwbekj.exe
C:\Program Files\Common Files\System\grwwxgp.exe
C:\Program Files\Trend Micro\HijackThis\Hijack.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: NetXfer - {83B80A9C-D91A-4F22-8DCF-EA7204039F79} - C:\Program Files\Xi\NetXfer\NXIEHelper.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [fyyrndi] C:\Program Files\Common Files\System\grwwxgp.exe
O4 - HKLM\..\Run: [yvtcxhx] C:\Program Files\Common Files\Microsoft Shared\vnwbekj.exe
O4 - Startup: AdMunch.lnk = C:\Program Files\Ad Muncher\AdMunch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Block frame with Ad Muncher - http://www.admuncher.com/request_wil...=menu_ie_frame
O8 - Extra context menu item: Block image with Ad Muncher - http://www.admuncher.com/request_wil...=menu_ie_image
O8 - Extra context menu item: Block link with Ad Muncher - http://www.admuncher.com/request_wil...d=menu_ie_link
O8 - Extra context menu item: Don't filter page with Ad Muncher - http://www.admuncher.com/request_wil...enu_ie_exclude
O8 - Extra context menu item: Download all by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddList.html
O8 - Extra context menu item: Download by Net Transport - C:\Program Files\Xi\NetTransport 2\NTAddLink.html
O8 - Extra context menu item: Report page to the Ad Muncher developers - http://www.admuncher.com/request_wil...menu_ie_report
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll


and thanks for your help.

[BoredOutOfMyMind]

Originally Posted by SisBeezer

i have a problem with some files that keep running and cant seem to find them or get rid of them.

i ran hijackthis and the problems are these two lines:

O4 - HKLM\..\Run: [fyyrndi] C:\Program Files\Common Files\System\grwwxgp.exe
O4 - HKLM\..\Run: [yvtcxhx] C:\Program Files\Common Files\Microsoft Shared\vnwbekj.exe

spybot dont work, and hijackthis said it fixed it but it didnt. it stays gone until i run any install exe of any kind.

any ideas? i find nothing about this except a ton of people are having the same problem. i have even put in new hard drives in both computers, and it came back on both. when it starts to run you cant run any kind of virus, spyware program. nor can you do the task manager to stop it.

Wow!

nothing shows in Google for those files. Heh heh heh, you already posted where I would send you for help!

any ideas? i find nothing about this except a ton of people are having the same problem. i have even put in new hard drives in both computers, and it came back on both. when it starts to run you cant run any kind of virus, spyware program. nor can you do the task manager to stop it. and msconfig closes out if you try to run it, as well as most any other type of program that would/could fix it.

If you open File Explorer, and right click on the files, does it give any more information? They are apparently virus or other malware files. Don't delete them just yet until you determine if they have hooks in other files or programs.

Originally Posted by BoredOutOfMyMind

If you open File Explorer, and right click on the files, does it give any more information? They are apparently virus or other malware files. Don't delete them just yet until you determine if they have hooks in other files or programs.

thats just it, the files are nowhere to be found.

i build and repair computers, but have never run into this kind of problem, sigh

[BoredOutOfMyMind]

Originally Posted by SisBeezer

thats just it, the files are nowhere to be found.

i build and repair computers, but have never run into this kind of problem, sigh

You have me stumped, so again Majorgeeks is my advice. I have not looked in malware section for a while, but those who help out are excellent.

Originally Posted by BoredOutOfMyMind

You have me stumped, so again Majorgeeks is my advice. I have not looked in malware section for a while, but those who help out are excellent.

yeah i have my question posted there too but so far no one seems to know. so i guess i will wait lol

[BoredOutOfMyMind]

SisBeezer, download a Linux Live disk like gnoppix and see if you can see the files with a linux file viewer. You may be able to delete them from the Linux side.

Nose around on MG and see what flavors are recommended.

Originally Posted by BoredOutOfMyMind

SisBeezer, download a Linux Live disk like gnoppix and see if you can see the files with a linux file viewer. You may be able to delete them from the Linux side.

Nose around on MG and see what flavors are recommended.

i'm running windows XP, dont really want to do the linux thing yet. although i am considering just going linux on all my computers.

i have Ubuntu already and am about ready to just forget windows