wng_z3r0
*warning, you still appear to have an rbot on your computer*
*The below Registry file was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format!*
1) Click on Start, Settings, Control Panel
2) Double click on Add/Remove Programs
3) Find "Web Search Toolbar", "Virtual Bouncer" and "Win-Tools Easy Installer (By Web Search)" in the list of installed programs and click on Change/Remove to uninstall it.
During the uninstall process, you will be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software.
Please go to:
start–>run
and type this in:
regedit
Then click on the FILE menu and select export
Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL
Then, go to start–>run
and type this in:
notepad
Paste this into the box:
Then click on the FILE menu and select save as
Save the file as regfix.reg. Save the file to the desktop.
IMPORTANT: make sure to save the file as "all types" and NOT as a text file
*The above Registry file was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format!*
Now double click on regfix.reg and insert it into the registry.
We need to do a search. Start | Search | For Files and Folders.
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this entire line into the Search for files and folders named box:
"yea.reg","staff.html","Gamma.html","hidden32.exe","x.bat","C:\Documents and Settings\Mom & Dad\Desktop\s3rkv.exe","C:\Documents and Settings\Mom & Dad\Desktop\servm3.exe","C:\Program Files\InetGet","C:\Documents and Settings\All Users\Application Data\msw","C:\Documents and Settings\All Users\Application Data\SetupOptionWebOnline","C:\Documents and Settings\Mom & Dad\Application Data\Camp kind","C:\Documents and Settings\Mom & Dad\Application Data\jugsrefcomp","C:\WINDOWS\woinstall.exe"
If any of these files are found please delete them.
Finally, open up internet explorer. Go to tools->internet options->security tab
click on the internet icon. Then hit default level. Then,
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
Change the allow paste operations via script to Disable
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next, click on the local intranet icon. Hit default level. DO the same for trusted sites and restricted sites.
Hit ok. Close internet explorer.
Open notepad and copy and paste the contents of the following code box in it:
Save this as findjobs.bat, choose to save it as all files and place it on your desktop.
Double-click on "findjobs.bat". Post the content of the txt file you get in your next reply.
Reboot, give me a new Kaparsky log, a findjobs.bat log, and a new HijackTHis log.
wng
*The below Registry file was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format!*
1) Click on Start, Settings, Control Panel
2) Double click on Add/Remove Programs
3) Find "Web Search Toolbar", "Virtual Bouncer" and "Win-Tools Easy Installer (By Web Search)" in the list of installed programs and click on Change/Remove to uninstall it.
During the uninstall process, you will be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software.
Please go to:
start–>run
and type this in:
regedit
Then click on the FILE menu and select export
Save the file as backup. Save the file somewhere you will remember and not delete.
IMPORTANT: make sure to set the export range to ALL
Then, go to start–>run
and type this in:
notepad
Paste this into the box:
REGEDIT4
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN]
"iexplore"="dword:0"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"searchassistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\MaxiFiles]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\MaxiFilesTB]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults]
"html"="dword:3"
[HKEY_LOCAL_MACHINE%\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs]
"C:\WINDOWS\Downloaded Program Files\MirarSetup.exe"=-
"C:\WINDOWS\System32\WinDmy.dll"=-
[HKEY_CURRENT_USER\Software\Microsoft\OLE]
"msoft-updater23"=-
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_MSDIRECTX]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MSDIRECTX]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MSDIRECTX]
Then click on the FILE menu and select save as
Save the file as regfix.reg. Save the file to the desktop.
IMPORTANT: make sure to save the file as "all types" and NOT as a text file
*The above Registry file was written specifically for this infection on this person's computer. It is NOT to be used on another computer, as it may cause damage that could result in a format!*
Now double click on regfix.reg and insert it into the registry.
We need to do a search. Start | Search | For Files and Folders.
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this entire line into the Search for files and folders named box:
"yea.reg","staff.html","Gamma.html","hidden32.exe","x.bat","C:\Documents and Settings\Mom & Dad\Desktop\s3rkv.exe","C:\Documents and Settings\Mom & Dad\Desktop\servm3.exe","C:\Program Files\InetGet","C:\Documents and Settings\All Users\Application Data\msw","C:\Documents and Settings\All Users\Application Data\SetupOptionWebOnline","C:\Documents and Settings\Mom & Dad\Application Data\Camp kind","C:\Documents and Settings\Mom & Dad\Application Data\jugsrefcomp","C:\WINDOWS\woinstall.exe"
If any of these files are found please delete them.
Finally, open up internet explorer. Go to tools->internet options->security tab
click on the internet icon. Then hit default level. Then,
This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
Change the allow paste operations via script to Disable
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next, click on the local intranet icon. Hit default level. DO the same for trusted sites and restricted sites.
Hit ok. Close internet explorer.
Open notepad and copy and paste the contents of the following code box in it:
dir %Windir%\tasks /a h > files.txt notepad files.txt
Save this as findjobs.bat, choose to save it as all files and place it on your desktop.
Double-click on "findjobs.bat". Post the content of the txt file you get in your next reply.
Reboot, give me a new Kaparsky log, a findjobs.bat log, and a new HijackTHis log.
wng