bloody annoying!

• Please make sure you can view all Hidden Files by choosing the instructions for your Windows OS.

• Download CWShredder.Do Not Use It Yet
• Save CWShredder.exe to a convenient location.
• make sure it is up to date.

• Download DLLCompare.Do Not Use It Yet

• Download the Killbox.Do Not Use It Yet
• Unzip the contents of KillBox.zip to a convenient location.

• Please download About:Buster from here: Do Not Use It Yet
• About Buster.
• extract it to c:\aboutbuster.
• update. to latest definitions

• Open CWShredder.exe.
• Click "Fix ->" and click "OK" at the prompt.
• CWShredder will scan and clean your system of CWS files.
• Click "Next->" and then "Exit".
• REBOOT back into Safe Mode by tapping F8 while booting up.l

• Open DllCompare.exe to run the program.
• Click "Run Locate.com" and it will scan your system for files.
• Once the scan has finished click "Compare" to compare your files to valid Windows files.
  Files in the upper window have now been verified to "exist", Files in the lower window were not able to be accessed. Very few files should be listed in the lower window when the Compare scan is complete.
• Once it has finished comparing click " Make a Log of what was found".
• Click on each of the listed entries in the lower section to select them. Right-click on the file and use the Option Rescan This will cause Windows Find to see if the file does exist, and then it will be removed from the list (to reduce the number of identified files)
• Click "Yes" at the ‘View Log file’ prompt to view the log.
• Copy and paste the entire log into your next reply after completing all steps.(saved as log.txt in the DllCompare folder)
• Click "Exit".

• In Safe Mode delete the Running Processes that have been Identified as being part of the infection. If unable to delete them, see below to use Killbox.

• c:\windows\system\syskm.exe
• c:\windows\system\sysmv.exe
• c:\windows\system\netdn.dll
• C:\WINDOWS\system\muuqw.dll

• If unable to delete files above in safe mode please use KillBox that you downloaded earlier:
• Open KillBox
• Highlight the list of names to delete then CTRL-C to copy and then Paste all files into the box "Full Path of File to Delete" . C:\WINDOWS\System32\xxxxx.dll
• Choose Delete on Reboot.
• Click the "Delete File" button which looks like a stop sign.
• Click "Yes" at the Delete on Reboot prompt.
• If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.

• Navigate to the c:\aboutbuster directory and double-click on aboutbuster.exe
• When the tool is open press the OK button,
• then the Start button, then the OK button, and then finally the Yes button.
• It will start scanning your computer for files. If it asks if you would like to do a second pass, allow it to do so.
• Post the log file in your next reply

• Copy the contents of the Quote Box below to Notepad.
• Name the file as fix.reg
• Change the Save as Type to All Files
• and Save it on the desktop

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

• Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process.

• Please check for the following files using the Windows Search Engine:
  
• control.exe
  
• rundll32.exe
  
• wmplayer.exe
  
• msconfig.exe
  
• notepad.exe
  
• shell.dll
  
• SDHelper.dll

• Download the Hoster from here. Press "Restore Original Hosts" and press "OK". Exit Program. This will restore the original deleted Hosts file.
  
• This infection often deletes some system files that need to be replaced. The most frequent one it deletes is shell.dll in Win2K or XP. In XP there are two copies of this file, one in Windows (WINNT) and one in Windows\System32. It does not delete the one in Windows\System so it does not affect Win9x/ME. If you find it missing, please copy the shell.dll from c:\windows\system32\dllcache into both \Windows (WINNT) and Windows\System32 .
  
• The other system file which is most frequently deleted is control.exe. Please check to make sure that you have this file and it is the correct size. If not Please check for the existence of this file by going to to Merijn's Files (sdhelper) and examine where the file should be for your operating system. If the file is missing then download the appropriate file and place it in the proper place according to the information at this website. The control.exe is more often deleted in Win9x/ME.
  
• If you have Spybot S&D installed you will also need to replace one file. Go here: Merijn's Files (sdhelper) and download SDHelper.dll. Copy the file to the folder containing you Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy). Then click Start > Run > regsvr32 "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" and press the OK button

• go to Start > All Programs > Accessories > Cleanmgr
• Select each Hard Drive in order and Click OK
• Let it calculate the amount of space that it can clean
• Make sure Temporary Internet Files, Temporary Files and Recycle Bin are selected
• Click OK and allow it to Clean

Items you may wish to consider to harden your defenses against future infections:

Read "How did I get infected in the first place?"

Download/install IE-Spyad

IE-Spyad puts over 4000 known malicious web sites into IE's "restricted zone" to help prevent you from getting infected.

Check your browser settings at Qualsys.com

A series of "tests" (and suggested fixes) to help tweak IE's settings to help prevent infections when surfing the web.

Follow safe Internet practices:

1. Keep your virus definitions up to date, and scan your system regularly.

2. Don't open email, or download attachments from unrecognized email addresses.

3. Be careful when downloading email attachments, EVEN FROM PEOPLE YOU KNOW! Many virii, worms, and trojans infect a persons system then immeadiately spread themselves to the people in the infected persons addressbook via email attachments.

4. Be careful downloading files from the Internet. Scan all downloaded files with a reliable UP-TO-DATE antivirus program. Scan "zip" files BEFORE unzipping, and scan all unzipped files BEFORE USING THEM.

5. Keep your Windows and IE current with all the latest patches and updates.