Daemon
It's morphed again. You need to ensure that the processes are stopped with Task Manager before proceeding with the fix. Let's concentrate on this part of the fix as it is the most important:
Press Ctrl>Alt>Delete to bring up Task Manager. Click the Processes tab and double-click the Image Name column header to alphabetically sort the processes. Scroll through the list and look for the following entries, end the process on each if found:
crfb32.exe
d3mj32.exe
ipzl32.exe
Next, click Start>Run and type Services.msc, hit OK. Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then change the Startup Type to Disabled. Now hit Apply and then OK and close any open windows.
Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cayre.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://cayre.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://cayre.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cayre.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://cayre.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cayre.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: (no name) - {983F54F7-9CFC-69CC-4991-DEFEE8A65CCE} - C:\WINDOWS\addcp.dll
O4 - HKLM\..\Run: [crfb32.exe] C:\WINDOWS\crfb32.exe
O4 - HKLM\..\RunOnce: [d3mj32.exe] C:\WINDOWS\system32\d3mj32.exe
O4 - HKLM\..\RunOnce: [ipzl32.exe] C:\WINDOWS\ipzl32.exe
Reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:
C:\WINDOWS\crfb32.exe
C:\WINDOWS\system32\d3mj32.exe
C:\WINDOWS\ipzl32.exe
Boot back into normal mode. Click here to download cwsuninst.zip. Extract cwsuninst.reg from the zip file and save it to the desktop. When done, double-click the cwsuninst.reg and when asked to merge say yes.
Press Ctrl>Alt>Delete to bring up Task Manager. Click the Processes tab and double-click the Image Name column header to alphabetically sort the processes. Scroll through the list and look for the following entries, end the process on each if found:
crfb32.exe
d3mj32.exe
ipzl32.exe
Next, click Start>Run and type Services.msc, hit OK. Scroll down and find the service called "Network Security Service". When you find it, double-click on it. In the next window that opens, click the Stop button, then change the Startup Type to Disabled. Now hit Apply and then OK and close any open windows.
Open HijackThis, scan and when complete, remove the following entries by checking the box to the left and clicking 'fixed checked':
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cayre.dll/sp.html#96676
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://cayre.dll/index.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://cayre.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\cayre.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://cayre.dll/index.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\cayre.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
O2 - BHO: (no name) - {983F54F7-9CFC-69CC-4991-DEFEE8A65CCE} - C:\WINDOWS\addcp.dll
O4 - HKLM\..\Run: [crfb32.exe] C:\WINDOWS\crfb32.exe
O4 - HKLM\..\RunOnce: [d3mj32.exe] C:\WINDOWS\system32\d3mj32.exe
O4 - HKLM\..\RunOnce: [ipzl32.exe] C:\WINDOWS\ipzl32.exe
Reboot into safe mode by tapping F8 after the BIOS has loaded, find and delete the following:
C:\WINDOWS\crfb32.exe
C:\WINDOWS\system32\d3mj32.exe
C:\WINDOWS\ipzl32.exe
Boot back into normal mode. Click here to download cwsuninst.zip. Extract cwsuninst.reg from the zip file and save it to the desktop. When done, double-click the cwsuninst.reg and when asked to merge say yes.
That's a clean log - reinstall those three files again. Also, do this:
1. Right-click My Computer>Click Properties>Click the System Restore tab>Check the box next to 'Turn off System Restore on all drives'>Click Apply>Click OK.
2. Reboot.
3. Repeat the process but this time remove the check from the box.