malicious spyware killing me from the inside slowly ...

• Download AboutBuster
  
  Unzip it to your desktop but don't run it yet we'll do that later on down in this list in SAFE MODE.
  
• Also download this tool, but once again, don't run it until instructed:
  removereg
  
• Download CWShredder from here, install it, check for updates but again, don't use it yet.
  
  We are going to install Ewido AV. I have included instructions below, but there is also a PDF created by Spydie here if that suits you better.
  
  
• Please download Ewido Security Suite it is a trial version of the program.
  • Install ewido security suite
  • NOTE: If you already have a main AV, then you should NOT install the ewido guard. Just install the scanner.
  • Launch ewido, there should be an icon on your desktop double-click it.
  • The program will now go to the main screen
  You will need to update ewido to the latest definition files.
  • On the left hand side of the main screen click update
  • Then click on Start Update
  The update will start and a progress bar will show the updates being installed.
  If you are having problems with the updater, you can use this link to manually update Ewido.
  Ewido manual updates[?list}
  DO NOT RUN THE SCANNER YET!! JUST UPDATE THE PROGRAM
  
• Print out these instructions so you have them handy as some of the steps need to be done in safe mode and you may not be able to go online. We need IE to remain closed throughout the process. <
• Make sure your PC is configured to show hidden files.How do I show hidden files?
  
• run cwshredder and click the fix button.
  
• Click "Start", "Run…", type "services.msc" and click on "OK". Search for Workstation NetLogon Service . Change the startup type to "Disabled". Then hit the stop button.
  
• Restart your computer in Safe Mode. How do I Safe Boot my computer?
  
• Scan with Hijack This and put check the following:
  
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\dfrzl.dll/sp.html#53142%everything4find.com
  R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\dfrzl.dll/sp.html#53142%everything4find.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\dfrzl.dll/sp.html#53142%everything4find.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\dfrzl.dll/sp.html#53142%everything4find.com
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\dfrzl.dll/sp.html#53142%everything4find.com
  R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\dfrzl.dll/sp.html#53142%everything4find.com
  R3 - Default URLSearchHook is missing
  O2 - BHO: Class - {3959283E-C72B-D2BA-8167-B27A8FA8F55B} - C:\WINDOWS\crqq32.dll
  O4 - HKLM\..\Run: [appxl.exe] C:\WINDOWS\system32\appxl.exe
  O4 - HKLM\..\Run: [iena.exe] C:\WINDOWS\system32\iena.exe
  O4 - HKLM\..\RunOnce: [sdkzp.exe] C:\WINDOWS\sdkzp.exe
  O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\netek.exe (file missing)
  
  
  Then close all windows, and browsers, except HijackThis. Tell HijackThis to "Fix checked".
  
  Delete the following files (it could be that they are deleted already):
  C:\WINDOWS\system32\netek.exe << This file
  C:\WINDOWS\sdkzp.exe << This file
  C:\WINDOWS\system32\iena.exe << This file
  C:\WINDOWS\system32\appxl.exe << This file
  C:\WINDOWS\crqq32.dll << This file
  C:\WINDOWS\dfrzl.dll <
  
• Double click on the AboutBuster tool you downloaded earlier. Follow the instruction prompts to use the program and let it do two scans (it will ask). When finished, press the "Save log" button. I will want a copy of that log after all steps are completed here.
  
• Now run Ewido.
  • Click on scanner
  • Click on Complete System Scan and the scan will begin.
  • NOTE: During some scans with ewido it is finding cases of false positives.**
    • You will need to step through the process of cleaning files one-by-one.
    • If ewido detects a file you KNOW to be legitimate, select none as the action.
    • DO NOT select "Perform action on all infections"
    • If you are unsure of any entry found select none for now.
  • Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  • Click Save report.
  • Save the report .txt file to your desktop.
  Now close ewido security suite.
  **(Ewido for example has been flagging parts of AVG Anti-Virus, pcAnywhere and the game "Risk")
  
• Clean out temporary and tif files. Go to "Start" -> "Run" and type in the box: "cleanmgr". Let it scan your system for files to remove. Make sure these 3 are checked and then press "Ok" to remove:
  
  Temporary Files
  Temporary Internet Files
  Recycle Bin
  
• Back up the registry by going to start-> run. Then type in regedit. Then go to file->export. Save it as something you remember, and make sure the export range is set at "all"
  
• Then run the removereg tool I had you download.
  
• Then do this:
  Copy the contents of the Quote Box below to Notepad.
  
  Name the file as fix.reg
  Change the Save as Type to All Files
  and Save it on the desktop
  
  
  

  REGEDIT4 
  
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HSA] 
  
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE] 
  
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW]

  
  
  Then double-click on the fix.reg file, and when it prompts to merge say yes, and this will clear some registry entries left behind by the process
  
  
• restart in normal mode
  
• NOTE: Two possibly three or four files may have been deleted from your computer by the hijacker and may need to be replaced.
  
  Control.exe
  Shell.dll
  SDHelper.dll (if you are using Spybot Search & Destroy)
  Hosts file (no extension)
  
  If control.exe, shell.dll or SDHelper is missing
  Go here: http://spywareinfo.com/~merijn/winfiles.html and download the needed file.
  
  For a missing Hosts file:
  Download Hoster
  Press "Restore Original Hosts" and press "OK"
  Exit Program.
  Note: if you were using a custom Hosts file you will need to replace any of those entries yourself!
  
  If you have Spybot S&D installed and SDHelper.dll is missing, replace it here:
  http://www.spywareinfo.com/~merijn/winfiles.html#sdhelper and download SDHelper.dll. Copy the file to the folder containing your Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)
  
• Additional: Check your ActiveX security settings. They may have been changed by this CWS variant to allow ALL ActiveX!! If they have been changed, reset your ActiveX security settings in Internet Explorer as recommended.
  
  ActiveX controls and plug-ins:
  • Download signed ActiveX controls (Prompt)
  • Download unsigned ActiveX controls (Disable)
  • Initialize and script ActiveX controls not marked as safe (Disable)
  • Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
  • Script ActiveX controls marked safe for scripting (Prompt)
  
  Do an online scan at the following site. Let it remove any infected files found.
  Trend Micro (PC-Cillin) - Free On-line Scan

• Double-click My Computer.
• Click the Tools menu, and then click Folder Options.
• Click the View tab.
• Put a check by "Hide file extensions for known file types."
• Under the "Hidden files" folder, select "Show hidden files and folders."
• Check "Hide protected operating system files."
• Click Apply, and then click OK.

• Download Adaware
  Adaware is a free program. It scans for known spyware on your computer. These scans should be run at least once every two weeks. For more information, see this tutorial
  The program is available for download here
• Download Spybot
  Spybot is a scanner like adaware. It scans for spyware and other malicious programs. It is important to have both Adaware and Spybot on your computer because each program provides unique detection and pretection measures. Spybot has preventitive tools that stop programs from even installing on your computer.
  To see how to set this up as well as more spybot features, see here
  Spybot can be downloaded at this location
• Download SpywareBlaster
  Spyware blaster is a program that stops known malicious activex controls from installing on your computer. It works by changing settings in your registry. It makes "kill bits" in the registry, so that certain activex controls can't install.
  If you don't know what activex controls are, see here
  You can download SpywareBlaster here here
  
• Download iespyad
  It puts many bad webpages on your restricted zones list. This means that you can still view the "bad" webpages, but the webpages cannot do certain things (such as use javascripts and cookies).
  If you need help understanding how it works, there is a tutorial here
  Download it here
  
• hosts file:
  • Every version of windows has a hosts file as part of them.
  • In a very basic sense, they are used to locate webpages.
  • We can customize a hosts file so that it blocks certain webpages.
  • However, it can slow down certain computers.
  • This is why using a hosts file is optional!!
  Download it here. Make sure you read the instructions on how to install the hosts file. There is a good tutorial here
  If you decide to download the hosts file, the slowdown problems can usually be avoided by following these steps:
  • Click the start button (at the lower left hand corner of your screen)
  • Click run
  • In the dialog box, type services.msc
  • hit enter, then locate dns client
  • Highlight it, then double-click it.
  • On the dropdown box, change the setting from automatic to manual.
  • Click ok
• Use an Anti Virus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some on line & their stand-alone anti virus programs:
  Computer Safety On line - List of free Anti virus programs
  
• Update your Anti Virus Software - It is imperative that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out. See here to choose one
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For more info, check this webpage out.
  See here to choose one

Have a great day,
wng