Total hijack

hi


Download Ad-aware Second Edition here and install it. If you already have Ad-aware Second Edition skip to the next step.

Open adaware and Click the "Check for updates now" line on the main screen. Click the "Connect" button on the webupdate screen.

If an update is available download it and install it. Click the "Finish" button to go back to the main screen.

Click on the "Settings" button (gear symbol in the upper right corner of the main status screen) in the quick launch toolbar to open the General settings screen. Check the "Automatically quarantine objects prior to removal" setting and then click "Proceed" to save your changes

Click the "Scan now" button in the main menu on the left side of the main status screen or use the "Start" button in lower right corner. This will open the Preparing System Scan screen. Please deselect "Search for negligible risk entries", as negligible risk entries (MRU's) are not considered to be a threat. Then select "Use custom scanning options" and click "Customize". This will open the "Scan Settings Page. Make sure all of the following are On with a "green" checkmark:

Scan within archives
Scan active processes
Scan Registry
Deep-scan Registry
Scan my IE Favorites for banned URLs
Scan my Hosts File

Then click on the "Tweak" Button to open up the tweak settings.

Open up the Scanning Engine section and make sure all of the following are On with a "green" checkmark:

Scan registry for all users instead of current user only

Make sure the following is unchecked with a "red" X:

Unload recognized processes & modules during scan.

Open up the Cleaning Engine section and make sure all of the following are On with a "green" checkmark:

Always try to unload modules before deletion
During Removal, unload Explorer and IE if necessary
Let Windows remove files in use at next reboot.

Click the "Proceed" button to save settings.

Click the "Next" button to start the scan.

When a scan is completed the Performing System Scan screen will change name to "Scan Complete".

Click the "Next" button to get to the Scanning Results screens where more information about the objects detected during the scan is available.

Click the Critical Objects Tab. In general all of the items listed will be bad. Be carefull with the Hosts file entries. Malware uses the hosts file to redirect you websites. However you can use the hosts file as a way to prevent malware. If the object has 127.0.0.1 in it, it should most likely not be deleted as it is protecting against unwanted sites. For more information on how to use a host file to protect yourself read here. So in short, you may or may not want to fix the hosts file entries.

To fix all the bad critical objects do the following:

Right click on one of them to open up the selection screen. Click the "Select All" button to select all entries. In general all should be selected with the exception of the good hosts file entries.

When all are selected Click "Next" and then "OK" in the pop-up window to confirm the removal.

Then,

Download SPYBOT Search and Destroy here if it is not already installed on your computer
Install the program and then start it. Once the program has started make sure you are in the Spybot-S&D section. Click on the "Search for Updates" button. Download all updates. In some cases the program will restart after an update. When updated, click on the "Check for Problems" button. When the Check is over All problems displayed in red are regarded as real threats and should be dealt with. Make sure they are all selected and click the "Fix selected problems" button.

then next
reboot into
safe mode

rescan with everything you have there, including microsoft antispyware
allow them to remova what they find

reboot back to normal mode

rescan with hijackthis and post a fresh hjt log

Download and Save Spywadfix to your computer from this link:
http://www.thespykiller.co.uk/files/spywadfix.exe

It will automatically extract to c:\spywad where it needs to be to run and will automatically open the remove spywad.vbs script for you ready to paste in the line mentioned below.
If you have script blocking enabled you will get a warning about a malicious script wanting to run. Please allow this script to run.

It is not malicious.
It will open an Input box. Paste this line into the box

C:\WINDOWS\System32\Hui.exe

The script will kill that process, backup and then delete any matching files in System32 and your Windows Directory. It will create a log of all files deleted. This log file will be named Spywad.txt and be located inside the C:\Spywad Folder. The backups will also be located in two subfolders there. One named Systems and the other named Window.

The script will search the Windows Directory and delete desktop.html and popup.html if they exist. It will add entries to the log if these files are found and deleted.

It will then kill Explorer. You will lose your taskbar and desktop. It will repair the registry entries returning your windows default desktop and context menu functions.
It will restart Explorer.


after restart hijackthis should start automatically, if not start it
normally i would tell you what items to fix, but this time i'll tell what to leave untouched. read the list carefully as fixing these entries accidentally can be harmful !!
doublecheck if in doubt
leave these:

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [EPSON Stylus C42 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P23 "EPSON Stylus C42 Series" /O6 "USB001" /M "Stylus C42"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe" /minimize
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup151.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\Program Files\AVPersonal\AVWUPSRV.EXE
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kavsvc.exe


with the rest of the log items: put a checkmark next to them, close all browsers and explorer windows, and click fix checked


When finished, post the contents of Spywad.txt and a new Hijackthis log.

i suppose this wont get the desktop fixed yet, because there possibly is another trojan holding it.
we will get that one next

good luck

Hi Illukka Problem - I downloaded and installed spywadfix but when I tried to remove the hui.exe entry I got an error message saying permission denied code 800A0046. So, what do I do next please? Kind regards and many thanks for all your help.

hi
the 015 item looks legit
lets check if it hides something malicious

Download rkfiles.zip from here
UNZIP the contents to a permanent folder

Reboot in SAFE MODE !! Important !!
°To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key

Please set your system to show all files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.
Click OK.

Doubleclick rkfiles.bat
It will scan for a while, so please be patient.
Wait till the doswindow closes and reboot back to normal mode.

Post the contents of C:\log.txt in your next reply.


also the first log of your showed signs of another infection

to verify its gone lets do panda online virus scan:
go to Panda ActiveScan

checkmark auto clean and do the scan
when finished save the report it makes and post here too

Hi again Here are the two logs - I ran activescan first but it gave me no options to fix anything. I also ran it again after running rkfiles C:\Program Files\rkfiles PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE. Files Found in system Folder………… ———————— C:\WINDOWS\system32\vxh8jkdq6.exe: UPX! C:\WINDOWS\system32\ole32vbs.exe: FSG! C:\WINDOWS\system32\dfrg.msc: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAwGpEc213 Files Found in all users startup Folder………… ———————— Files Found in all users windows Folder………… ———————— C:\WINDOWS\sasent.dll: UPX! C:\WINDOWS\sasetup.dll: UPX! C:\WINDOWS\thin-137-3-x-x.exe: UPX! Finished bye Before running rkfiles Incident Status Location Adware:adware/adsmart No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\1.qtdfmp Adware:adware/sahagent No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\bundletracking.asp Dialer:dialer.cos No disinfected C:\Documents and Settings\Owner\Application Data\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\exsplorer.lnk Dialer:dialer.akd No disinfected C:\Documents and Settings\Owner\Application Data\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\WinMoviePlugIn.lnk Adware:adware/virmaid No disinfected C:\WINDOWS\SYSTEM32\ole32vbs.exe Spyware:spyware/smitfraud No disinfected C:\WINDOWS\SYSTEM32\ptainfo1.ico Adware:adware/craft No disinfected C:\WINDOWS\SYSTEM32\web.exe Adware:adware/ncase No disinfected C:\TEMP\salm.log Adware:adware/cws.searchmeup No disinfected C:\WINDOWS\drexinit.dll Adware:adware/cws No disinfected C:\Documents and Settings\Owner\Favorites\Online Gambling Adware:Adware/Startpage.TA No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\1.qtdfmp Virus:Trj/Small.LW Disinfected C:\Documents and Settings\Owner\Local Settings\Temp\7.qtdfmp Adware:Adware/Popuper No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\temp.frD303 Virus:Bck/Dumador.AB Disinfected C:\Documents and Settings\Owner\Local Settings\Temp\trA.exe Dialer:Dialer.NO No disinfected C:\RECYCLER\S-1-5-21-1482476501-1708537768-839522115-1003\Dc2.exe Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Abj.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Abm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Acs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Aef.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Aki.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Alt.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Apb.html Virus:Trj/Ldpinch.JD Disinfected C:\WINDOWS\assest.dll Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Atm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Aup.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bjs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bka.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bmc.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bnl.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cal.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cje.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cka.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cml.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cul.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Deo.html Virus:Trj/Agent.NN Disinfected C:\WINDOWS\drexinit.dll Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Emr.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Erm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Esm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Esu.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Evs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Fbg.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Fid.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Fsn.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gng.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gno.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Goi.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Grd.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gug.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gvh.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hck.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hkd.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hnb.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hss.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Huf.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ifq.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Iht.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Iil.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ioe.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Iuq.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Jap.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Kac.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Kgm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Lfp.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Lvo.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mbr.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mdf.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mfj.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mjq.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mnv.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Nau.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Nlh.html Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_acirpa.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_ckifvl.txt Virus:Trj/Downloader.DKJ Disinfected C:\WINDOWS\n_dvoqzz.log Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_endwjs.dat Adware:Adware/SuperSpider No disinfected C:\WINDOWS\n_ksgikm.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_lbgdcd.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_pmxnfw.txt Adware:Adware/CWS.HomeSearchAsisstantNo disinfected C:\WINDOWS\n_qutoxx.dat Adware:Adware/Howprotect No disinfected C:\WINDOWS\n_wnfoye.dat Virus:Bck/Haxdoor.H Disinfected C:\WINDOWS\n_wvvzir.txt Adware:Adware/SearchExe No disinfected C:\WINDOWS\n_yvgaqx.txt Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Obn.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ods.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Oia.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Otg.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Oti.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Pbs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Poh.html Virus:Trj/Downloader.BNW Disinfected C:\WINDOWS\prntsvra.dll Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Qer.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Qff.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Qpt.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Qtd.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Rgr.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Rlj.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Rmo.html Dialer:Dialer.CRZ No disinfected C:\WINDOWS\sasent.dll Dialer:Dialer.CRZ No disinfected C:\WINDOWS\sasetup.dll Adware:Adware/PsGuard No disinfected C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\Desktop.htt Dialer:Dialer.BZG No disinfected C:\WINDOWS\system32\LogFiles\OD7211900.so Adware:Adware/PsGuard No disinfected C:\WINDOWS\system32\ole32vbs.exe Virus:Trj/Small.LW Disinfected C:\WINDOWS\system32\vxh8jkdq7.exe Adware:Adware/Startpage.TA No disinfected C:\WINDOWS\system32\vxh8jkdq8.exe Virus:Trj/Downloader.BQE Disinfected C:\WINDOWS\system32\web.exe Virus:Bck/Dumador.AB Disinfected C:\WINDOWS\system32\winldra.exe Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Tci.html Spyware:Spyware/BetterInet No disinfected C:\WINDOWS\thin-137-3-x-x.exe Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Tif.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Tpe.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Tsu.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Tvg.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ubp.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Uqf.html After running rkfiles Incident Status Location Adware:adware/adsmart No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\1.qtdfmp Adware:adware/sahagent No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\bundletracking.asp Dialer:dialer.cos No disinfected C:\Documents and Settings\Owner\Application Data\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\exsplorer.lnk Dialer:dialer.akd No disinfected C:\Documents and Settings\Owner\Application Data\MICROSOFT\INTERNET EXPLORER\QUICK LAUNCH\WinMoviePlugIn.lnk Adware:adware/virmaid No disinfected C:\WINDOWS\SYSTEM32\ole32vbs.exe Spyware:spyware/smitfraud No disinfected C:\WINDOWS\SYSTEM32\ptainfo1.ico Adware:adware/ncase No disinfected C:\TEMP\salm.log Adware:adware/cws No disinfected C:\Documents and Settings\Owner\Favorites\Online Gambling Adware:Adware/Startpage.TA No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\1.qtdfmp Adware:Adware/Popuper No disinfected C:\Documents and Settings\Owner\Local Settings\Temp\temp.frD303 Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Abj.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Abm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Acs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Aef.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Aki.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Alt.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Apb.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Atm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Aup.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bjs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bka.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bmc.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Bnl.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cal.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cje.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cka.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cml.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Cul.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Deo.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Emr.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Erm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Esm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Esu.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Evs.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Fbg.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Fid.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Fsn.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gng.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gno.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Goi.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Grd.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gug.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Gvh.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hck.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hkd.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hnb.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Hss.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Huf.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ifq.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Iht.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Iil.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ioe.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Iuq.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Jap.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Kac.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Kgm.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Lfp.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Lvo.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mbr.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mdf.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mfj.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mjq.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Mnv.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Nau.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Nlh.html Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_ckifvl.txt Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_endwjs.dat Adware:Adware/SuperSpider No disinfected C:\WINDOWS\n_ksgikm.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_lbgdcd.dat Adware:Adware/SearchAid No disinfected C:\WINDOWS\n_pmxnfw.txt Adware:Adware/CWS.HomeSearchAsisstantNo disinfected C:\WINDOWS\n_qutoxx.dat Adware:Adware/Howprotect No disinfected C:\WINDOWS\n_wnfoye.dat Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Obn.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Ods.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Oia.html Spyware:Spyware/Slimield No disinfected C:\WINDOWS\Otg.html

hi

first: sorry, due to a DNS issue i could not acces this site for some time

i'm afraid the rkfiles log shows that another infection is present

lets kill it


Please print these next instructions out, or copy them to a NotePad file for reading while in Safe Mode.


Download smitRem.exe and save the file to your desktop.
Double click on the file to extract it to it's own folder on the desktop.

Place a shortcut to Panda ActiveScan on your desktop.

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/

Please read Ewido Setup Instructions
Install it, and update the definitions to the newest files. Do NOT run a scan yet.

If you have not already installed Ad-Aware SE 1.06, follow these download and setup instructions, otherwise, check for updates:
Ad-Aware SE Setup
Don't run it yet!

Next, please reboot your computer in SafeMode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
• Instead of Windows loading as normal, a menu should appear
• Select the first option, to run Windows in Safe Mode.

Now scan with HJT and place a checkmark next to each of the following items, then click FIX CHECKED:
===================================================

O15 - Trusted IP range: 66.197.161.149
===================================================

Close HiJackThis.

Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.

The tool will create a log named smitfiles.txt in the root of your drive, eg; Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


Open Ad-aware and do a full scan. Remove all it finds.


Run Ewido:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• NOTE: During some scans with ewido it is finding cases of false positives.
• You will need to step through the process of cleaning files one-by-one.
• If ewido detects a file you KNOW to be legitimate, select none as the action.
• DO NOT select "Perform action on all infections"
• If you are unsure of any entry found select none for now.
• When the scan is finished, click the Save report button at the bottom of the screen.
• Save the report to your desktop

Close Ewido

Next go to Control Panel click Display > Desktop > Customize Desktop > Web > Uncheck "Security Info" if present.

Reboot back into Windows and click the Panda ActiveScan shortcut, then do a full system scan. Make sure the autoclean box is checked!
Save the scan log and post it along with a new HijackThis Log, the contents of the smitfiles.txt log and the Ewido Log by using Add Reply.
Let us know if any problems persist.


good luck again

hi

you can manually delete those files panda active scan reports

otherwise looks good

now a few words on prevention:

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Managing Windows Millenium System Restore
  
  or
  
  Windows XP System Restore Guide
  
  Reenable system restore with instructions from tutorial above
  
  
• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety

• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.
• Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
  Using Winpatrol to protect your computer from malicious software

cheers and greetings from finland..

Hi Illukka Greetings from London - thank you ever so much for all you have done - very much appreciated! Kind regards W

hi

glad we could help


as this is now resolved, i'll close this topic now

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php