hrmvvl.exe

[ido_]

hey,
I just swept clean my pc from lots of nasty spyware and adware after a major virus problem. I fixed most of the stuff but I still got a suspected file that stayed after everything I did (removing suspecious files from the reg, run superantispyware and run SDfix). the file name is HRMVVL.EXE, it sits in WINDOWS\SYSTEM32 dir.

I tried to move it to a different location but it was in use, tried to move it from safe mode.... the same unable to delete because file is in use (I already removed any entry from the registry with this filename).

when the computer starts I see it running in the background (black cmd window) and all sorts of wierd fonts like smily and hearts are apearing for 1 sec, than it closes and the computer starts.

any ideas ?

[Trogan]

Hi, ido_

1. Please post the report from SDFix, which can be found in the C:\SDFix folder.

2. Download HJTInstall.exe (http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe) to your Desktop.

Doubleclick HJTInstall.exe to install it.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Save the log to a convenient location as you'll need to post it soon.
Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Post the HijackThis log back here.

3. Please do not run any other scans unless I instruct you to.

[Katana]

Whilst we appreciate that you may be busy, it has been 7 days or more since we heard from you. This topic is now closed.

Infections can change and fresh instructions will now need to be given. If you wish to reopen your topic, please send a Private Message (PM) to Trogan (http://icrontic.com/forum/private.php?do=newpm&u=2703) with a link to your thread.

If you are not the user who started this thread, you must start your own Thread (http://icrontic.com/forum/newthread.php?do=newthread&f=57) instead :)