What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help _ This Even Block "house Call" Virus Check

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I'm desparate for help to free myself from this coniving @**@-?? hijack.
It even stops me using the House Call online virus check.

Here is my log. I was looking for games for a church chrsitmas party. Google pulled up a promising find, only it was a sex site and my hard drive began spinning like mad. That's how I think I was infected.

Logfile of HijackThis v1.98.2
Scan saved at 20:33:12, on 21/12/2004
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\NMapWin\bin\nmapserv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\PROGRA~1\WINCLE~1\qhwscsvc.exe
C:\PROGRA~1\WINCLE~1\QHONSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\syswm32.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\WINCLE~1\MailSvr.exe
C:\PROGRA~1\WINCLE~1\UPSCHD.EXE
C:\PROGRA~1\WINCLE~1\QHM32.EXE
C:\PROGRA~1\WINCLE~1\QHONLINE.EXE
C:\Documents and Settings\Peter\Desktop\Peter\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\hrcal.dll/sp.html#10001
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {295C10DB-849D-8DF8-7934-BDA72C09FEFE} - C:\WINDOWS\ipju.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QH Reminder] C:\PROGRA~1\WINCLE~1\qhremind.exe
O4 - HKLM\..\Run: [Quick Heal e-mail Protection] C:\PROGRA~1\WINCLE~1\MailSvr.exe
O4 - HKLM\..\Run: [QH Live Update Scheduler] C:\PROGRA~1\WINCLE~1\UPSCHD.EXE /Check
O4 - HKLM\..\Run: [QH Office 2K Check] C:\PROGRA~1\WINCLE~1\O2KCHECK.EXE /CHECK
O4 - HKLM\..\Run: [Quick Heal On-Line Protection] C:\PROGRA~1\WINCLE~1\CATEYE.EXE
O4 - HKLM\..\Run: [Quick Heal Messenger] C:\PROGRA~1\WINCLE~1\QHM32.EXE
O4 - HKLM\..\Run: [Quick Heal Startup Scan] C:\PROGRA~1\WINCLE~1\QHSTRT32.EXE /LOADRUN
O4 - HKLM\..\RunOnce: [Quick Heal Startup Scan] C:\PROGRA~1\WINCLE~1\QHSTRT32.EXE /check
O15 - Trusted Zone: *.frame.crazywinnings.com
O15 - Trusted Zone: *.static.topconverting.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1103469489655
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
Post #3 last edited
Hi I will be helping you.

Quick Heal - I do not know anything about - but from my google seaches seems like a reasonably good company. It does have some anti-malware tools in it suite - they MAY give warnings while I have you use hijackthis. If it has a resistry checking program it will notice the deletions that Hijackthis - or the other tools are doing - and may try to stop those changes.

You do have some other smaller malware - I am leaving them until we have this big baddie out of the way.

My suggestion is so that you can follow all of this, to copy all the text to a wordpad file on your computer.

Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

How to see hidden files in Windows

Please download About:Buster from here: http://tools.zerosrealm.com/AboutBuster.zip. Once it is downloaded extract it to
c:\aboutbuster. We will use that program later in this process.

Download Service Filter from here:
http://home.comcast.net/~rand1038/vbscript/ServiceFilter.zip
Extract it to it's own folder. We will use this later in this process.

Keep a copy of that last hijackthis log that you posted - you will need to notice any NEW O4 and O2 lines that appear - they will ALL be malware (Unless you have installed anything in the meantime).

While doing this (after the download) you should disable your current Anti-Virus program - two of these running at the same time can give problems, although AVG is known to work well with others.


Get a copy of AVG7 antiVirus (free version) from here.

http://free.grisoft.com/freeweb.php/doc/2/

download it to a safe place such as c:\downloads.

when downloaded double click the file to run and install. It will ask questions on how to install - go with the defaults - allow it to update (until no updates are found) but otherwise just hit the next button till it finishes installing.

Ensure that ALL other windows are closed.

Then run AVG7 from the desktop icon - choose 'selective scanning'

Choose the c: drive.

when it finds an infected file it will ask what to do - choose 'delete' file when it asks for 'can it reboot to remove a file' say no. when it has finished do it a second time with the same responces to the infected files.

When that has finished open hijackthis and place a check against all of these lines.

All R0/R1/R3 lines Except
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

Plus
O2 - BHO: (no name) - {295C10DB-849D-8DF8-7934-BDA72C09FEFE} - C:\WINDOWS\ipju.dll
OR any other new O2 line that replaces it

Plus
any other new O4 line that gets added.

(some AVG lines will be added to the log and they should be left BUT ANY other new lines will be suspect.)

Then click 'fix chacked' - close hijackthis.
================
Then reboot - run AVG twice more. with the same responces to found malware.

The last time it should come clean.

Reboot

This is the step where we will use About:Buster that you had downloaded previously.

Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe When the tool is open press the OK button, then the Start button, then the OK button, and then finally the Yes button. It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.

Copy and paste this text into a text editor such as Notepad.

Save this text as RemoveDomains.reg. Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.

Double-click on RemoveDomains.reg. When it asks you to merge the information to the registry click Yes

REGEDIT4
 
; Filename: RemoveDomains.reg
;
; Provider: LineOFire
; 
; Purpose: Removes all sites from the Internet Explorer Trusted/Restricted Zones.
; 
; Installation: Copy and paste this text into a text editor such as Notepad.
; 
; Save this text as RemoveDomains.reg. Make sure the "Save as type:" is "All Files (*.*)" and save it to your desktop.
; 
; Double-click on RemoveDomains.reg. When it asks you to merge the information to the registry click Yes.
 
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains]
 
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\63.219.181.7]
"http"=dword:00000004
Note that since the Domains are deleted SpywareBlaster protection must be re-enabled. Spybot's Immunize feature must be used again. They will also have to re-install IE-SpyAd.

157871


Reboot to normal mode

Find ServiceFilter that you downloaded earlier
Click on ServiceFilter.vbs
A text file called POST_THIS will be in the same folder
Please use Edit>Select all then Edit>Copy to obtain the contents
Save it in notepar or wordpad for posting laster.

Now do a new Hijackthis log and post that with the about:buster log and the service filter log for me to see.
Post #4
Thanks pals, sounds like a complicated proceedure but I'm going to have to get on with it. I'll post back asap. You guys are great! Peter
Post #6
Hi Chris I've run AVG a few times but I have a few files that it will not remove. What do I do now? Do I have to remove these embedded files before I proceed? Here is the AVG report. It has also delelted a few hundred other things marked as trojans etc. Thanks Peter C:\Documents and Settings\Peter\Desktop\Peter\My downLoads\nortonantivirus2004professionalv10.0.0.109keygentmg.zip:\keygen.exe:\p51.exe:\setup.exe Trojan horse Clicker.B Infected, Embedded object C:\Documents and Settings\Peter\Application Data\Business Logic\UWC\Backup\J38339.6588429398.WCU:\C:\Documents and Settings\Peter\Local Settings\Temp\conscorr.cab:\conscorr.exe Trojan horse Downloader.Stubby.C Infected, Embedded object C:\Documents and Settings\Peter\Application Data\Business Logic\UWC\Backup\J38339.6588429398.WCU:\C:\Documents and Settings\Peter\Local Settings\Temp\conscorr.exe Trojan horse Downloader.Stubby.C Infected, Embedded object C:\Documents and Settings\Peter\Application Data\Business Logic\UWC\Backup\J38339.6588429398.WCU:\C:\Documents and Settings\Peter\Local Settings\Temp\localNrd.cab:\polall1l.exe Trojan horse Downloader.Agent.AS Infected, Embedded object C:\Documents and Settings\Peter\Application Data\Business Logic\UWC\Backup\J38339.6588429398.WCU:\C:\Documents and Settings\Peter\Local Settings\Temp\polall1l.exe Trojan horse Downloader.Agent.AS Infected, Embedded object C:\Documents and Settings\BenRandell\Local Settings\Temp\conscorr.cab:\conscorr.exe Trojan horse Downloader.Stubby.C Infected, Embedded object C:\Documents and Settings\mike.PETER-UPYGUZWV7\Local Settings\Temp\conscorr.cab:\conscorr.exe Trojan horse Downloader.Stubby.C Infected, Embedded object C:\Documents and Settings\dianewellington\Local Settings\Temp\conscorr.cab:\conscorr.exe Trojan horse Downloader.Stubby.C Infected, Embedded object C:\Documents and Settings\mike.PETER-UPYGUZWV7\Local Settings\Temp\iinstall.exe Deleted
Post #8
Hi Chris I've gone through your instructions and here are my logs for the 3 applications: HJT Logfile of HijackThis v1.98.2 Scan saved at 12:57:46, on 29/12/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\NMapWin\bin\nmapserv.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\WINCLE~1\qhwscsvc.exe C:\PROGRA~1\WINCLE~1\QHONSVC.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Trojan Guarder Gold Version\Trojan Guarder.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Windows NT\Accessories\WORDPAD.EXE C:\WINDOWS\Notepad.exe C:\Documents and Settings\Peter\Desktop\Peter\hijack\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe About; Scanned at: 12:43:54 on: 29/12/2004 – Scan 1 ————————— About:Buster Version 4.0 Reference List : 21 ADS not scanned System(FAT) Removed 4 Random Key Entries Attempted Clean Of Temp folder. Removed Uninstall Key (HSA) Removed Uninstall Key (SE) Removed Uninstall Key (SW) Pages Reset… Done! – Scan 2 ————————— About:Buster Version 4.0 Reference List : 21 ADS not scanned System(FAT) Attempted Clean Of Temp folder. Pages Reset… Done! now the service filter thing! The script did not recognize the services listed below. This does not mean that they are a problem. To copy the entire contents of this document for posting: At the top of this window click "Edit" then "Select All" Next click "Edit" again then "Copy" Now right click in the forum post box then click "Paste" ######################################## ServiceFilter 1.1 by rand1038 Microsoft Windows XP Professional Version: 5.1.2600 Dec 29, 2004 12:55:10 —> Begin Service Listing <— Unknown Service # 1 Service Name: Adobe LM Service Display Name: Adobe LM Service Start Mode: Manual Start Name: LocalSystem Description: Adobe LM … Service Type: Own Process Path: "c:\program files\common files\adobe systems shared\service\adobelmsvc.exe" State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False Unknown Service # 2 Service Name: Cimkidruwd Display Name: Cimkidruwd Start Mode: Manual Start Name: Description: … Service Type: Share Process Path: State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False Unknown Service # 3 Service Name: NMap Display Name: NMap Start Mode: Auto Start Name: LocalSystem Description: Scans your network for open ports in regular … Service Type: Own Process Path: c:\program files\nmapwin\bin\nmapserv.exe State: Running Process ID: 1736 Started: True Exit Code: 0 Accept Pause: False Accept Stop: True Unknown Service # 4 Service Name: qhwscsvc Display Name: Quick Heal Helper Service WSC Start Mode: Auto Start Name: LocalSystem Description: … Service Type: Own Process Path: c:\progra~1\wincle~1\qhwscsvc.exe State: Running Process ID: 1820 Started: True Exit Code: 0 Accept Pause: False Accept Stop: True Unknown Service # 5 Service Name: Quick Heal Online Protection Display Name: Quick Heal Online Protection Start Mode: Auto Start Name: LocalSystem Description: … Service Type: Own Process Path: c:\progra~1\wincle~1\qhonsvc.exe State: Running Process ID: 1868 Started: True Exit Code: 0 Accept Pause: True Accept Stop: True Unknown Service #6 Service Name: SwPrv Display Name: MS Software Shadow Copy Provider Start Mode: Manual Start Name: LocalSystem Description: Manages software-based volume shadow copies taken by the Volume Shadow Copy service. If this … Service Type: Own Process Path: c:\windows\system32\dllhost.exe /processid:{fab3b35e-aadc-4a16-a19c-098e3d8649ce} State: Stopped Process ID: 0 Started: False Exit Code: 1077 Accept Pause: False Accept Stop: False Unknown Service # 7 Service Name: %AF夶À¨ Display Name: Network Security Service (NSS) Start Mode: Auto Start Name: LocalSystem Description: … Service Type: Share Process Path: c:\windows\system32\syswm32.exe /s State: Stopped Process ID: 0 Started: False Exit Code: 0 Accept Pause: False Accept Stop: False —> End Service Listing <— There are 91 Win32 services on this machine. 7 were unrecognized. Script Execution Time: 3.199219 seconds. Thanks for all your help so far. I'm thinking that there is more to do because I keep getting items on AVG and SpyBot.
Post #9 last edited
The biggest problem I have in giving more advice (yes you do have some more malware on your machine) is the lack of data in the hijackthis log. You have running processes that do not show in that log, which should. If they are missing what else is.

So please delete ALL copies of hijackthis from your system - including all zipped copies.

Get a new version from www.tomcoyote.org/hjt/ (version 1.99.0 please)

Then unzip and install.

Then REBOOT and run the hijackthis without running anything else before.

Post back with the new hijackthis log, and another servicefilter log please.
Post #10
Here is my new HJT log after downloading the new version. It does show more than the last one. What do you make of it? Logfile of HijackThis v1.99.0 Scan saved at 10:01:27, on 30/12/2004 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\Program Files\NMapWin\bin\nmapserv.exe C:\WINDOWS\System32\nvsvc32.exe C:\PROGRA~1\WINCLE~1\qhwscsvc.exe C:\PROGRA~1\WINCLE~1\QHONSVC.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\System32\wuauclt.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Documents and Settings\Peter\Desktop\HijackThis.exe O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O15 - Trusted IP range: 206.161.125.149 O15 - Trusted IP range: 206.161.125.149 (HKLM) O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: LexBce Server - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: Macromedia Licensing Service - Unknown - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: NMap - Unknown - C:\Program Files\NMapWin\bin\nmapserv.exe O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Quick Heal Helper Service WSC - Unknown - C:\PROGRA~1\WINCLE~1\qhwscsvc.exe O23 - Service: Quick Heal Online Protection - Unknown - C:\PROGRA~1\WINCLE~1\QHONSVC.EXE O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZONELABS\vsmon.exe O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\system32\syswm32.exe (file missing)
Post #11
You have NMap on your system - If it was placed on it on purposed DO NOT DO THE FOLLOWING THAT ARE IN BLUE. Here is a link to pestpatrols info on this program.
http://www.pestpatrol.com/PestInfo/n/nmap_win_1_2_12.asp

Please do all the downloading etc first - then disconnect from the internet while you do the following (except onlne scans etc). It will be better to copy this to wordpad so you can do copy and pastes without using internet explorer.

Use 'ctrl' + 'alt' + 'del' (Three keys together) to get taskmanager. Find these processes and 'end task' them.
OR
Use the process viewer in Hijackthis, Config, Misc Tools, Process Viewer, to unload the following running processes.

nmap.exe
nmapserv.exe

Check these in hijackthis, AND WITH ALL OTHER WINDOWS CLOSED, fix checked.

O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: 206.161.125.149 (HKLM)
O23 - Service: Network Security Service (NSS) - Unknown - C:\WINDOWS\system32\syswm32.exe (file missing)
O23 - Service: NMap - Unknown - C:\Program Files\NMapWin\bin\nmapserv.exe

Click the Start button, and select Run
Enter this command line:-

regsvr32 /u C:\WINDOWS\system32\ccgnu32.dll

Then this one:-

regsvr32 /u C:\WINDOWS\system32\wpcap.dll

Then Reboot to safe mode (F8 on boot) and delete the following files/folders:-
NOTE: To avoid the risk of any of the above not being found due to them having the 'Hidden' attribute, first make sure that in Folder Options > View hidden and operating system files are set to show:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Or items 8 & 9 from this link :
http://www.russelltexas.com/malware/faqhijackthis.htm )

These should be in c:\windows\system32
or in C:\Program Files\NMapWin\bin\ (with or without the \bin\ part)
ccgnu32.dll
helpshortcut.chm
nmap.exe
nmap-os-fingerprints
nmap-protocols
nmapserv.exe
nmapwin.chm
nmapwin.msi
readme.txt
wpcap.dll

Reboot

Please download Reg Lite from here:
http://www.resplendence.com/download/reglite.exe
Once it is downloaded double click to install.

start reglite.

Navigate to: (You can use copy and paste from this into the address bar).

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\%AF夶À¨

If %AF夶À¨ exists , right click on it and choose delete from the menu.


Click here if picture is required - Using Reg Lite - pic 1

Now navigate to:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_%AF夶À¨

If LEGACY_%AF夶À¨ exists then right click on it and choose delete from the menu.

If you have trouble deleting a key. Then click once on the key name to highlight it and click on the Permission menu option under Security or Edit. Then Uncheck "Allow inheritible permissions" and press copy. Then click on everyone and put a checkmark in "full control". Then press apply and ok and attempt to delete the key again.

If it does not find that second key - it will drop you one stage below - and you should be able to see something similar to the next two pictures.

A funny named key :-

Click here if picture is required - Using Reg Lite - pic 2

With a sub key with our bad service name in - so deleted that key and sub key.

Click here if picture is required - Using Reg Lite - pic 3

==========================

Copy the contents of the Quote Box below to Notepad.
Name the file as fix.reg
Change the Save as Type to All Files
Save this file on the desktop

REGEDIT4


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]


Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

Next Step
Reboot your computer back to normal mode so that we can restore see if we need to restore some deleted files:
  • This infection delete the windows file, shell.dll.

    If you are using XP,2000, or NT please download shell.dll from here: shell-dll.zip. Once the file is downloaded uncompress the zip file and copy shell.dll to the following locations ((%windir% being thelocation you installed windows):

    %windir%\system32
    %windir%\system

    If you are using Windows 98/ME please download shell.dll from here: shell98-dll.zip. Once the file is downloaded uncompress the zip file and copy shell.dll to the following locations (%windir% being thelocation you installed windows):

    %windir%\system
  • Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
  • If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button
  • If you are using Windows 95, 98, or ME it is possible that the malware deleted your control.exe. Please check for the existence of this file by going to to Merijn Files control.exe and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to this information.
Last Step

Run an online antivirus scan at:

http://housecall.antivirus.com/

Then Reboot and post a fresh log for me to check.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI