dgosling
Hello Hanabee,
Looks like we are getting somewhere though the hijack is still there. It appears that the infected added service has not been removed so I will have to ask you to repeat some of the steps I gave you previously. I have listed the steps to follow here:
Step#1:
Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer closed throughout as opening it will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.
You have SpywareGuard installed and running. It will prevent the fix from working. Any protective programs such as WinPatrol, Ad-Watch, Spyware Guard, and several others need to be disabled for any fix to work. Please disable SpywareGuard before starting the steps. You may have to uninstall it to disable it. Antivirus software and a Firewall are all that should be running for protection. Once your computer is clean you can re-install and activate this.
Step#2:
Please disconnect from the Internet and unplug your modem for the duration of this fix
Then close all programs and windows and run the new version(if possible) of Hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R3 - Default URLSearchHook is missing
Step#3:
In the next step we are going to remove the service that is still installed on your computer.
1. Open Registrar Lite and run it.
2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):
1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)
3. Copy and paste the bold text below into the address bar of Reglite:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
3. Click Go
4. Highlight the folder(key) in the left hand pane named Services
5. Look at each entry in the right hand pane and locate the one named O? ’ŽrtñåȲ$Ó
6. Highlight O? ’ŽrtñåȲ$Ó in the right hand pane , right click on it and choose delete from the menu.
5. Copy and Paste the bold text below into the address bar of Registrar Lite:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\
6. Click Go
4. Highlight the folder(key) in the left hand pane named Root
5. Look at each entry in the right hand pane and locate the one named
LEGACY_O? ’ŽrtñåȲ$Ó
6. Highlight LEGACY_O? ’ŽrtñåȲ$Ó in the right hand pane , right click on it and choose delete from the menu.
7. If you have trouble deleting a key. Then click once on the key name to highlight it and on the top menu choose Security, then Edit Permissions. Then make sure you are an Administrator and give yourself Full Control of that key. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.
8. If you have had to change the permissions on the keys in Registrar Lite then they will have to be returned to the way they were . To do this please navigate to C:\ProgramFiles\Registrar Lite (Reglite) and double-click on Winkey.reg. It will ask if you want to merge this file with the registry, say Yes. Then double-click on Winkey.hiv and merge this file with the Registry. You have now returned the permissions to the way they were.
** if you needed to use #8 above last time, please let me know as this may be the reason the service is still showing in the log file and it is an orphan entry because there is no file now**
Step#4:
Copy the contents of the Quote Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
and Save it on the desktop
Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.
Step#5:
1.Reboot your computer back to normal mode and Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.
2. Post your log from HijackThis here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.
Good Luck!
Looks like we are getting somewhere though the hijack is still there. It appears that the infected added service has not been removed so I will have to ask you to repeat some of the steps I gave you previously. I have listed the steps to follow here:
Step#1:
Please save these instructions to WordPad so that you have them accessible while following the steps. You also may want to print out these directions as the Internet will not be available. You must disconnect from the internet totally, as staying connected while fixing will prevent the fix from working. Also please keep Internet Explorer closed throughout as opening it will reinstall the infection. Read through all the instructions so that you can ask any questions now, before you disconnect from the Internet.
You have SpywareGuard installed and running. It will prevent the fix from working. Any protective programs such as WinPatrol, Ad-Watch, Spyware Guard, and several others need to be disabled for any fix to work. Please disable SpywareGuard before starting the steps. You may have to uninstall it to disable it. Antivirus software and a Firewall are all that should be running for protection. Once your computer is clean you can re-install and activate this.
Step#2:
Please disconnect from the Internet and unplug your modem for the duration of this fix
Then close all programs and windows and run the new version(if possible) of Hijackthis. Put a checkmark next to each of these entries and click 'fix checked' button when ready (some may be gone after uninstalling some programs):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tkkww.dll/sp.html#28129
R3 - Default URLSearchHook is missing
Step#3:
In the next step we are going to remove the service that is still installed on your computer.
1. Open Registrar Lite and run it.
2. Copy and paste the bold text below into the address bar of Registrar Lite:(this is making a Registry backup for safety in case of error)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Go to File> Export and and save as (in the C:\Program Files\Registrar Lite (Reglite) folder):
1.) Winkey.reg (Save as type: regedit4 .reg type)
2.) Winkey.hiv (Save as type: Scroll to select-regetd32/WinAPI *hiv *dat files)
3. Copy and paste the bold text below into the address bar of Reglite:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
3. Click Go
4. Highlight the folder(key) in the left hand pane named Services
5. Look at each entry in the right hand pane and locate the one named O? ’ŽrtñåȲ$Ó
6. Highlight O? ’ŽrtñåȲ$Ó in the right hand pane , right click on it and choose delete from the menu.
5. Copy and Paste the bold text below into the address bar of Registrar Lite:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\
6. Click Go
4. Highlight the folder(key) in the left hand pane named Root
5. Look at each entry in the right hand pane and locate the one named
LEGACY_O? ’ŽrtñåȲ$Ó
6. Highlight LEGACY_O? ’ŽrtñåȲ$Ó in the right hand pane , right click on it and choose delete from the menu.
7. If you have trouble deleting a key. Then click once on the key name to highlight it and on the top menu choose Security, then Edit Permissions. Then make sure you are an Administrator and give yourself Full Control of that key. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.
8. If you have had to change the permissions on the keys in Registrar Lite then they will have to be returned to the way they were . To do this please navigate to C:\ProgramFiles\Registrar Lite (Reglite) and double-click on Winkey.reg. It will ask if you want to merge this file with the registry, say Yes. Then double-click on Winkey.hiv and merge this file with the Registry. You have now returned the permissions to the way they were.
** if you needed to use #8 above last time, please let me know as this may be the reason the service is still showing in the log file and it is an orphan entry because there is no file now**
Step#4:
Copy the contents of the Quote Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
and Save it on the desktop
REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]
Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.
Step#5:
1.Reboot your computer back to normal mode and Scan again with HijackThis. We still have a few steps to complete but a log file at this time would be helpful.
2. Post your log from HijackThis here in this thread with any questions or problems that you have run into. There are still some steps that are necessary to clear out all of the malware. There will be necessary files that it has deleted that will need to be replaced.
Good Luck!