adware removal

Hi awhite1:

Please print, or copy and paste this text into a Notepad file and place it on your desktop, to review as you work. Please proceed with this fix in the order provided below.

Please download the inf Files by Winhelp from http://www.mvps.org/winhelp2002/DelDomains.inf
This will open a text document. Click on File –> Save as….Save it to a conveniently reachable place as My Documents. Right-click on it and and select Install. This will remove all the entries in Trusted Zone.

Please note that if you use Spybot S&D, it will need to be re-imunized
and IE-Spyad will need to be re-installed, after using the INF file.
Please, do not fail to do so, without delay.

Next:

Go to control Panel–>Add/Remove Programs and Uninstall/Remove……
oiko
PPATCH~1 Note that this may have more letters in the name.

Next:
Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

Please set your system to show all files; please see here if you're unsure how to do this.

Close all windows and browsers, leaving only HijackThis running.

Place a check beside each of these entries listed below, if still present.

R3 - URLSearchHook: (no name) - {A558F32E-49EA-1219-EEA8-608481E41FCE} - C:\WINDOWS\system32\lpsxueg.dll (file missing)
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - {CC19C0D1-2247-27BE-41F4-05E2977426C7} - C:\WINDOWS\system32\cgyjg.dll (file missing)
O2 - BHO: SSL encrypt - {746455FE-D059-47e7-AF0E-140E03F5A447} - C:\WINDOWS\system32\nsr103.dll
O2 - BHO: (no name) - {CC19C0D1-2247-27BE-41F4-05E2977426C7} - C:\WINDOWS\system32\cgyjg.dll (file missing)
O4 - HKLM\..\Run: [adstart] "iexplore.exe" "http://iesettingsupdate"
O4 - HKCU\..\Run: [oiko] C:\Program Files\Common Files\oiko\oikom.exe
O4 - HKCU\..\Run: [Faiezb] C:\WINDOWS\MCROSO~1.NET\WNWORD~1.EXE
O4 - HKCU\..\Run: [Tsme] "C:\PROGRA~1\COMMON~1\PPATCH~1\attrib.exe" -vt ndrv
O4 - HKCU\..\Run: [] C:\WINDOWS\MCROSO~1.NET\WNWORD~1.EXE
O4 - HKCU\..\Run: [Cli] C:\WINDOWS\MCROSO~1.NET\WNWORD~1.EXE
O15 - Trusted Zone: *.elitemediagroup.net
O15 - Trusted Zone: *.mmohsix.com
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINDOWS\system32\xeymi.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\spool32.dll

Click on Fix Checked when finished and exit HijackThis.

[*]Reboot into Safe Mode: see here if you are not sure how to do this.


Using Windows Explorer, locate the following files/folders shown DARK and delete them, if still present:

C:\WINDOWS\system32\lpsxueg.dll
C:\WINDOWS\system32\cgyjg.dll
C:\WINDOWS\system32\nsr103.dll
C:\WINDOWS\system32\xeymi.dll
C:\WINDOWS\system32\spool32.dll

C:\WINDOWS\MCROSO~1.NET\WNWORD~1.EXE

C:\Program Files\Common Files\oiko\oikom.exe
C:\PROGRA~1\COMMON~1\PPATCH~1\attrib.exe

Exit Explorer, enable hidden files and reboot.

If you were unable to delete any of the files, then please follow these additional instructions:
Download Pocket Killbox and unzip it; save it to your Desktop.
Run it, and click the radio button that says Delete a file on reboot. For each of the files you could not delete, paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes.
Let the system reboot.

Updating Java

• Download the latest version of Java Runtime Environment (JRE) 5.0 Update 8.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-1_5_0_08-windowsi586-p.exe to install the newest version.

Then, lets run Ewido. Be sure to use the setup and running instructions provided.

First, lets do a bit of cleaning, to make the Ewido report managable.

Clean your Cache and Cookies in IE:

• Close all instances of Outlook Express and Internet Explorer
• Go to Control Panel > Internet Options > General tab
• Click the "Delete Cookies" button
• Next to it, Click the "Delete Files" button
• When prompted, place a check in: "Delete all offline content", click OK

Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):

• Go to Tools > Options.
• Click Privacy in the menu on the left side of the Options window.
• Click the Clear button located to the right of each option (History, Cookies, Cache).
• Click OK to close the Options window
  Alternatively, you can clear all information stored while browsing by clicking Clear All.
  A confirmation dialog box will be shown before clearing the information.

Clean other Temporary files + Recycle bin

• Go to start > run and type: cleanmgr and click ok.
• Let it scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
• Press OK to remove them.
  
  Please Note: This is a new version of Ewido Anti-Malware. It has a new set of setup and running instructions. Please delete any other versions and use the setup and usage directions shown below.
  
  Download ewido anti-spyware from HERE and save that file to your desktop.
  This is a 30 day trial of the program
  
  • Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run ewido and update the definition files.
  • On the main screen select the icon "Update" then select the "Update now" link.
  • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
  • Select "Automatically generate report after every scan"
  • Un-Select "Only if threats were found"
  Close ewido anti-spyware, Do Not run a scan at this time.
  
  Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter.
  IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess:
  • Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
  • Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
  • ewido will now begin the scanning process, be patient this may take a little time.
    Once the scan is complete do the following:
  • If you have any infections you will prompted, then select "Apply all actions"
  • Next select the "Reports" icon at the top.
  • Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important). I suggest saving it to your desktop.
  Close ewido and reboot your system back into Normal Mode.
  
  Please run Hijack This again. Scan and copy the log, then post it into this topic. along with the Ewido report.
  
  Please advise if any problems remain.
  
  Please use the [external image: Posted Image] button to reply.

Hi awhite1:

That was quite a lot to do, good work. Only a single bad one left. Lets hope it goes as smoothly.

Please print, or copy and paste this text into a Notepad file and place it on your desktop, to review as you work. Please proceed with this fix in the order provided below.
Please give special attention to items in RED

Ewidos quarantine can now be emptied.

Disable Ewido:
Please disable Ewido, as it may interfere with the fix.
To disable Ewido:
From the system tray:

• Right-click the system tray icon and uncheck real time protection.
  or From within Ewido -
• Under 'Your security status', if the real time protection is active, deactivate it by clicking 'real time protection' until the status says 'inactive'.

Once your log is clean you can re-enable Ewido.

Disable Microsoft Windows Defender:
We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

• Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
• Click on Tools, General Settings.
• Under Real-time protection options, unselect the Turn on real-time protection check box
• Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.


Please set your system to show all files; please see here if you're unsure how to do this.

Close all windows and browsers, leaving only HijackThis running.

Place a check beside each of these entries listed below, if still present.

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,yfjufil.exe

Click on Fix Checked when finished and exit HijackThis.

Reboot into Safe Mode: see here if you are not sure how to do this.

Using Windows Explorer, locate the following files/folders shown DARK and delete them, if still present:

C:\WINDOWS\system32\userinit.exe,yfjufil.exe

Exit Explorer, enable hidden files and reboot.

If you were unable to delete any of the files, then please follow these additional instructions:
Download Pocket Killbox and unzip it; save it to your Desktop.
Run it, and click the radio button that says Delete a file on reboot. For each of the files you could not delete, paste them one at a time into the full path of file to delete box and click the red circle with a white cross in it.
The program will ask you if you want to reboot; say No each time until the last one has been pasted in whereupon you should answer Yes.
Let the system reboot.

Please run Hijack This again. Scan and copy the log, then post it into this topic.

Please advise if any problems remain.

Please use the [external image: Posted Image] button to reply.

Did we lose you ?

Sorry…my schedule is quite busy right now. I have completed all the steps you layed out and it seems to have worked. No more redirects or attempts to change homepage. I have had no more pop-ups. This seems to have done the trick. Thank you so much for your help!

Hi awhite1:

I understand being busy, but please take time to protect your PC. The tools below are all FREE. Please, take the time to download and install them. Prevention is much better than the alternative.

One of the best features of Windows XP is the System Restore option, however if Malware infects a computer with this operating system the Malware can be backed up in the System Restore folder. Therefore, clearing the restore points is necessary after a virus removal.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(winXP)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.


Here are a few tips that will keep your PC much safer on the Internet.

How did I get infected in the first place?

You usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:

1.) Watch what you download!
Many freeware programs, and P2P programs like Grokster, Imesh, Kazaa and others are amongst the most notorious, come with an enormous amount of bundled spyware that will eat system resources, slow down your system, clash with other installed software, or just plain crash your browser or even Windows itself. If you insist on using a P2P program, please read This Article written by Mike Healan of Spywareinfo.com fame. It is an updated and comprehensive article that gives in-depth detail about which P2P programs are "safe" to use.

2.) Go to Internet Explorer > Tools > Windows Update > Product Updates, and install ALL High-Priority Security Updates listed.
If you're running Windows XP, that of course includes the Service Pack 2! If you suspect your computer is infected with Malware of any type, we advise you to not install SP2 if you don't already have it. You can post a HijackThis log on our Forums to get free Expert help cleaning your machine. Once you are sure you have a clean system, it is highly recommended to install SP2 to help prevent against future infections.

It's important to always keep current with the latest security fixes from Microsoft.
Install those patches for Internet Explorer, and make sure your installation of Java VM is up-to-date. There are some well known security bugs with Microsoft Java VM which are exploited regularly by browser hijackers.

3.) Open Internet Explorer and go to Internet Options > Security > Internet, then press "Default Level", then OK.

• Now press "Custom Level."

In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".

Now you will be asked whether you want ActiveX objects to be executed and whether you want software to be installed.
Sites that you know for sure are above suspicion can be moved to the Trusted Zone in Internet Option > Security.

So why is ActiveX so dangerous that you have to increase the security for it?
When your browser runs an activex control, it is running an executable program. It's no different from doubleclicking an exe file on your hard drive.
Would you run just any random file downloaded off a web site without knowing what it is and what it does?

4.) Install Javacool's SpywareBlaster

It will protect you from most spy/foistware in it's database by blocking installation of their ActiveX objects.

Download and install, download the latest updates, and you'll see a list of all spyware programs covered by the program (NOTE: this is NOT spyware found on your computer)
Press "Enable All Protection", and you're done.
The spyware that you told Spywareblaster to set the "kill bit" for won't be a hazard to you any longer.
Although it won't protect you from every form of spyware known to man, it is a very potent extra layer of protection.
Don't forget to check for updates every week or so.

5.) Let's also not forget that Spybot Search & Destroy has the Immunize feature which works roughly the same way. Another feature within Spybot is the TeaTimer option. This option immediately detects known malicious processes wanting to start and terminates them. TeaTimer also detects when something wants to change some critical registry keys and gives you an option to allow them or not.
Reboot, after using.

A companion Program is Ad-Aware SE, which is highly recommended.
Download the new Ad-Aware SE version, and follow the instructions on how to do a full scan: Always update before using.
http://forums.spywareinfo.com/index.php?showtopic=11150
-reboot after using Ad-Aware SE.

6.) Microsoft now offers their own free malicious software blocking tool. Windows Defender. (Not compatible with Windows 98 and ME.)

7.) Another excellent program by Javacool we recommend is SpywareGuard.
It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

8.) IE-SPYAD puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. Another good hosts program is mvpshosts. This little program packs a powerful punch as it block ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial.

*It is important to note that all of the above programs/files can be run simultaneously on your system. They will work together in layers, so to speak, to help protect your computer. However, the following suggestions are designed to only run one of each. It is not a good idea to run more than one firewall, and one anti-virus program. Running more than one of these at a time can cause system crashes, high system usage and/or conflicts with each other.*

9.) It is critical that you use a firewall to protect your computer from hackers. We don't recommend the firewall that comes built in to Windows. It doesn't block everything that may try to get in, and the entire firewall is written to the registry. As various kinds of malware hack the Registry in order to disable the Windows firewall, it's far preferable to install one of the excellent third party solutions. Three good ones that are freeware to boot are ZoneAlarm, Kerioand Sygate

10.) An Anti-Virus product is a necessity. There are many excellent programs that you can purchase. However, we choose to advocate the use of free programs whenever possible. Some very good and easy-to-use free A/V programs are AVG, Avast, and AntiVir. It's a good idea to set these to receive automatic updates so you are always as fully protected as possible from the newest virus threats.

11.) Finally, after following up on all these recommendations, why not run Jason Levine's Browser Security Tests
They will provide you with an insight on how vulnerable you might still be to a number of common exploits.

And also see TonyKlein's good advice
http://castlecops.com/postlite7736-.html
So how did I get infected in the first place?

Safe surfing.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php