Reply to thread

Message

<blockquote data-quote="arnoldbowman@aol.com" data-source="post: 145195" data-attributes="member: 15081">Here is the FRST fix logFix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-11-2013 01Ran by abowman at 2013-11-22 17:34:33 Run:1Running from G:\Boot Mode: Normal==============================================Content of fixlist:*****************HKCU\...\Run: [AS2014] - D:\Documents and Settings\All Users\Application Data\ngXgVar3\ngXgVar3.exeHKCU\...\Run: [gfkjhxxd] - &quot;D:\Documents and Settings\ABowman\Local Settings\Application Data\njdprbwt.exe&quot;HKCU\...\Winlogon: [Shell] Explorer.exe &lt;==== ATTENTIOND:\Documents and Settings\All Users\Application Data\ngXgVar3D:\Documents and Settings\ABowman\Local Settings\Application Data\njdprbwt.exeHKU\abowman.STATION3\...\Winlogon: [Shell] Explorer.exe &lt;==== ATTENTION HKU\Administrator\...\Winlogon: [Shell] Explorer.exe &lt;==== ATTENTION HKU\administrator.RIOGRANDESALES\...\Run: [AS2014] - D:\Documents and Settings\All Users\Application Data\ngXgVar3\ngXgVar3.exeHKU\administrator.RIOGRANDESALES\...\Winlogon: [Shell] Explorer.exe &lt;==== ATTENTIOND:\Documents and Settings\ABowman\Local Settings\Temp*****************HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\AS2014 =&gt; Value deleted successfully.HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\gfkjhxxd =&gt; Value deleted successfully.HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell =&gt; Value deleted successfully.D:\Documents and Settings\All Users\Application Data\ngXgVar3 =&gt; Moved successfully.&quot;D:\Documents and Settings\ABowman\Local Settings\Application Data\njdprbwt.exe&quot; =&gt; File/Directory not found.HKU\abowman.STATION3\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell =&gt; Value deleted successfully.HKU\Administrator\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell =&gt; Value deleted successfully.HKU\administrator.RIOGRANDESALES\Software\Microsoft\Windows\CurrentVersion\Run\\AS2014 =&gt; Value deleted successfully.HKU\administrator.RIOGRANDESALES\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell =&gt; Value deleted successfully.D:\Documents and Settings\ABowman\Local Settings\Temp =&gt; Moved successfully.==== End of Fixlog ====</blockquote>

[QUOTE="arnoldbowman@aol.com, post: 145195, member: 15081"] Here is the FRST fix log Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 22-11-2013 01 Ran by abowman at 2013-11-22 17:34:33 Run:1 Running from G:\ Boot Mode: Normal ============================================== Content of fixlist: ***************** HKCU\...\Run: [AS2014] - D:\Documents and Settings\All Users\Application Data\ngXgVar3\ngXgVar3.exe HKCU\...\Run: [gfkjhxxd] - "D:\Documents and Settings\ABowman\Local Settings\Application Data\njdprbwt.exe" HKCU\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION D:\Documents and Settings\All Users\Application Data\ngXgVar3 D:\Documents and Settings\ABowman\Local Settings\Application Data\njdprbwt.exe HKU\abowman.STATION3\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION HKU\Administrator\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION HKU\administrator.RIOGRANDESALES\...\Run: [AS2014] - D:\Documents and Settings\All Users\Application Data\ngXgVar3\ngXgVar3.exe HKU\administrator.RIOGRANDESALES\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION D:\Documents and Settings\ABowman\Local Settings\Temp ***************** HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\AS2014 => Value deleted successfully. HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\gfkjhxxd => Value deleted successfully. HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. D:\Documents and Settings\All Users\Application Data\ngXgVar3 => Moved successfully. "D:\Documents and Settings\ABowman\Local Settings\Application Data\njdprbwt.exe" => File/Directory not found. HKU\abowman.STATION3\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKU\Administrator\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. HKU\administrator.RIOGRANDESALES\Software\Microsoft\Windows\CurrentVersion\Run\\AS2014 => Value deleted successfully. HKU\administrator.RIOGRANDESALES\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. D:\Documents and Settings\ABowman\Local Settings\Temp => Moved successfully. ==== End of Fixlog ==== [/QUOTE]

Verification