Hi mshivalkar.
Big post again, so take your time, there is no rush, you will be fine.
I want you to install a host file, this will hopefully keep you out of trouble game surfing:
I would like you to go
Here and download Host manager :(IMG:http://www.bluetack.co.uk/Kimberly/Images/HMMain.jpg)
The Bluetack HOSTS Manager will do everything automatically, including the download.
Go to Downloads Section and click "download" and follow prompts any problem get back to me.
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:
Computer Safety on line - Anti-Malware
__________________
Download
ATF Cleaner by Atribune and save it to your Desktop.
Do not use yet!
__________________
Ewido is now known as ( AVG Anti-Spyware.)
Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
- Install AVG Anti-Spyware by double clicking the installer.
- Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
- On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
- Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the
Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
Dont use yet!
__________________
Open up your spybot search and destroy program, select recovery, place a check by these items, there are two buttons,
one that says recover selected Items and one that says purge selected Items we want to click purge selected items.
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WildTangent4.zip/wcmdmgr.exe
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WildTangent4.zip ZIP:
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WildTangent2.zip/1.2.5.0/wcmdmgr.exe
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WildTangent2.zip ZIP:
If you have fixed some spyware problems in the past, this list will show it.
__________________
Can you delete the
smitfraud folders you downloaded at the begining and also the smitfraud zip foder, then
empty the recycle bin
You have one here on C: drive
C:\Documents and Settings\yijendra Pun\Desktop\SmitfraudFix
Two here on E drive:
E:\Softwares\SmitfraudFix.zip/SmitfraudFix
E:\Softwares\SmitfraudFix.zip ZIP:
———————————————————–
Unregister dlls for removal.
Go to
Start, Run OR
Start, Programs, Accessories, Command Prompt. Enter each of the following lines in turn, followed by 'Enter'.
regsvr32 /u wodata32.dll
It's OK if any are not found, or 'error' out.
Type "Exit" to leave the command-line box.
________________
For the following
Would you let me know If you find it in this location? if you dont find it in this location try this location:
D:\Documents and Settings\USERNAME\\Application Data\Identities\{8AA7FE63-E695-11D7-A97B-00C02664B33A}
Cure sent folder with
E-Trust scanner. (Select
folders to cure.
D:\WINDOWS\Application Data\Identities\{8AA7FE63-E695-11D7-A97B-00C02664B33A}
Delete the contents of the sent folder or the above mails there are four under this name "
Mihir Shivalkar" and another …
"Date Fri, 18 Mar 2005 15:42:21 +0530]/UNNAMED BadJoke"
In Outlook Express, go to the menu item > File > Folder > Compact. Once the folder contents have been compacted, then the you should empty the deleted items folder.Outlook Express LOGICALLY deletes emails, so they still exist in the DB, and PHYSICALLY deletes them when they are compacted.
_____________________________
Re-boot into safe mode
- Next, please reboot your computer in Safe Mode by doing the following:
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
- Instead of Windows loading as normal, a menu should appear use arrow up to highlight
- Select the first option, to run Windows in Safe Mode hit enter.
- For additional help in booting into Safe Mode, see the following site: HERE
I'm assuming you have not hidden the files and folders yet?
If you have, can you reveal files and folders
______________________
Run HijackThis, select
Do a system scan only and place checks against the following entries
(if they are still present)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O20 - Winlogon Notify: rpcc - C:\WINDOWS\System32\rpcc.dll (file missing)
WITH ALL OTHER WINDOWS CLOSED Click on
Fix Checked and exit
_________________________________
I want you to open up killbox again as you did before, for me.
Double-click on Killbox.exe to run it. Place the following lines (complete paths) in
bold in the "Full Path of File to Delete" box in Killbox, and click the red button with the white X on it after each
D:\WINDOWS\SYSTEM\minidrv.exe
D:\WINDOWS\SYSTEM\minidrv.exe
D:\WINDOWS\SYSTEM32\wodata32.dll
For these file, put a mark next to "Delete on Reboot". Copy and paste each file into the file name box, then click the red button with the X after each. It will ask you if you want to reboot each time you click it, answer
NO until after you've pasted the last file name, at which time you should answer
Yes.
_________________
Note!: I need you to delete this folder "Screensavers and Games" The games are sharing infected binaries and uninstallers
Whatever company or website is the origin of that folder is causing you big trouble, at least one Uninstaller is infected
Right click start, In the drop down menu click "
Explore" Then navigate to each file\ folder in the left hand pane, which will reveal its content in the right hand pane, highlight file or folder right click and Delete, if present:
G:\Mihir\personal\
Screensavers & Games <=========This folder, see
note!
D:\WINDOWS\Downloaded Program Files\
watch_me_now.exe <=========This file
_________________
Run ATF cleaner- Double click ATF-Cleaner.exe to run the program.
- Check the following boxes:
- Windows Temp
- Current User Temp
- All Users Temp
- Temporary Internet Files
- Prefetch
- Recycle Bin
- Java Cache
- The rest are optional - if you want to remove the lot, check Select All.
- Now click Empty Selected.
- When you get the Done Cleaning message, click OK.
__________________________
Run AVG Anti-Spyware
Close
ALL open Windows / Programs / Folders. Please start
AVG Anti-Spyware and run a full scan.
- Click on Scanner on the toolbar.
- Click on the Settings tab.
- Under How to act?
- Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
- All checkboxes should be ticked.
- Under Possibly unwanted software:
- All checkboxes should be ticked.
- Under Reports:
- Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
- Click on the Scan tab.
- Click on Complete System Scan to start the scan process.
- Let the program scan the machine.
- When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
[external image: Posted Image]
- When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
- Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
Please include new HJT log, AVG Anti-Spyware log
in your next post
Thanks dan