I downloaded Hijackthis and using the online tutorial, I can pretty much identify everything. However, there is one program that is not identified on the tutorial, nor does google return a respone for it, and I haven’t had any luck figuring out what it is. The entry reads:
O4 - HKLM…\Run: [293KJBP3SBFDKL] C:\WINDOWS\SYSTEM\GfbV7t.exe
Any body got any good ideas?
Good bet it’s malware of some kind.
Many of the more clever trojans / worms / etc. give themselves a random name on each machine they infect for just the reason you are experiencing. Many folks are reluctant to kill it if they don’t know what it is, and it’s harder for antivirus programmers to hit a moving target.
Since it definitely isn’t part of Windows, or else we’d find it on Google, I’d suggest you rename it to something else (gfbV7t.exe.junk) and reboot. The rename will prevent the program from starting.
Use your various programs for a week or so and if everything seems A-OK, then you’re almost certainly safe to delete the file and the registry entry.
Peper.A trojan. I had “fixed” the GfbV7t a couple of times w/ Hijackthis. Then another one appeared, which I had also seen before, Yfk8.exe. So I googled for that instead and got this thread in the tech support guy forums.
Big, big help.
But I think I’m clean now. Yah!