jupk.com

Hi,

Unfortunately, you're not alone, and it seems to be spreading primarily in the U.K.

Please do the following in the order given.

We need to disable your Microsoft Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.
* Open Microsoft Windows Defender. Click Start, Programs, Windows Defender
* Click on Tools, General Settings
* Under Real-time protection options, unselect the Turn on real-time protection check box
* Click Save

After all of the fixes are complete it is very important that you enable Real-time Protection again.

• Start HijackThis, click System Scan Only and place a checkmark next to the following items:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZN
O17 - HKLM\System\CCS\Services\Tcpip\..\{9A969B63-8D67-464F-8DE2-9A889ED51497}: NameServer = 85.255.116.139,85.255.112.229
O17 - HKLM\System\CS1\Services\Tcpip\..\{9A969B63-8D67-464F-8DE2-9A889ED51497}: NameServer = 85.255.116.139,85.255.112.229

Close ALL browsers and open windows/programs except HijackThis and click 'Fix Checked'.

• You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Save it to your desktop and run it. Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.

Once the desktop loads please post the text that will open (report.txt) in your next reply.

* Clean your Cache and Cookies in IE:

• Close all instances of Outlook Express and Internet Explorer
• Go to Control Panel > Internet Options > General tab
• Click the "Delete Cookies" button
• Next to it, Click the "Delete Files" button
• When prompted, place a check in: "Delete all offline content", click OK

* Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):

• Go to Tools > Options.
• Click Privacy in the menu on the left side of the Options window.
• Click the Clear button located to the right of each option (History, Cookies, Cache).
• Click OK to close the Options window
  Alternatively, you can clear all information stored while browsing by clicking Clear All.
  A confirmation dialog box will be shown before clearing the information.

* Clean other Temporary files + Recycle bin

• Go to start > run and type: cleanmgr and click ok.
• Let it scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
• Press OK to remove them.

• Download and scan with AVG Anti-Spyware v7.5
(This is Ewdio 4.0 renamed. If you already have Ewido installed, please update to this version which has a special "clean driver" for removing persistent malware)
1. After download, double click on the file to launch the install process.
2. Choose a language, click "OK" and then click "Next".
3. Read the "License Agreement" and click "I Agree".
4. Accept default installation path: C:\Program Files\Grisoft\AVG Anti-Spyware 7.5, click "Next", then click "Install".
5. After setup completes, click "Finish" to start the program automatically or launch AVG Anti-Spyware by double-clicking its icon on your desktop or in the system tray.
6. The main "Status" menu will appear. Select "Change state" to inactivate 'Resident Shield' and 'Automatic Updates'.
7. Then right click on AVG Anti-Spyware in the system tray and uncheck "Start with Windows".
8. Go to Start > Run and type: services.msc

• Press "OK".
• Click the "Extended tab" and scroll down the list to find AVG Anti-Spyware guard.
• When you find the guard service, double-click on it.
• In the Properties Window > General Tab that opens, click the "Stop" button.
• From the drop-down menu next to "Startup Type", click on "Manual".
• Now click "Apply", then "OK" and close the Services window.

9. Select the "Update" button and click "Start update". Wait until you see the "Update succesfull message. If you are having problems with the updater, manually update with the
AVG Anti-Spyware Full database installer from here.

Once the updates are installed do the following:
1. Click on the "Scanner" button and choose the "Settings" tab.

• Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
• Under "How to Scan?" check all (default).
• Under "Possibly unwanted software" check all (default).
• Under "What to Scan?" make sure "Scan every file" is selected (default).
• Under "Reports" select "Automatically generate report after every scan" and UNcheck "Only if threats were found".

2. Click the "Scan" tab to return to scanning options.
3. Click "Complete System Scan" to start.
4. When the scan has finished you will be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.

IMPORTANT! Do not save the report before you have clicked the Apply all actions button. If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report. So be sure you save it only AFTER clicking the "Apply all actions?" button.

5. Click on "Save Report" to view all completed scans. Click on the most recent scan you just performed and select "Save report as" - the default file name will be in date/time format as follows: Report-Scan-20060620-142816.txt. Save to your desktop. A copy of each report will also be saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
6. Exit AVG Anti-Spyware when done and submit the log report in your next response.

Note: Close all open windows, programs, and DO NOT USE the computer while AVG Anti-Spyware is scanning. If Explorer or other programs are open during the scan that means certain files will also be in use. Some malware will insert itself and hide in areas that are "protected" by Windows when the files are being used. This can hamper AVG Anti-Spyware's ability to clean properly and may result in reinfection.

Note: If AVG Anti-Spyware "crashes" or "hangs" during the scan, try scanning again by doing this:
1. Scan one sector of the system at a time by using the "Custom Scan" feature. To do this select Scanner > Custom Scan and click on Add drive/directory/file. Browse to C:\Windows > System, add this folder to the list and click on "Start Scan". When the scan is complete, repeat the Custom Scan but this time, browse to and add the System32 folder. Then keep repeating this procedure until all your folders have been scanned. Make sure you include the Documents & Settings folder.
2. If this still does not help, then turn the ADS scanner off while making a Custom Scan. To do this select Scanner > Scan Settings and untick "Scan in NTFS Alternate Data Streams". Then repeat the steps above for performing a Custom Scan.

• Post back with the report.txt, the log from AVG Anti-Spyware and a new HijackThis log.

Continue, please.

• I would like you to do the following.

• Please click Start > Run > and type Regedit
• Click OK and wait for the Registry Editor to open
• Now, please click on File and then Export
• This will bring up the Export Registry File window
• At the bottom of which you will see an option for Export range
• Click the option for Selected branch and in the field underneath that, copy and paste:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
• Enter a file name of Notify, and save the file to your Desktop
• Now go to your Desktop, right click on the file you have created, select Open With and choose Notepad.

• I would also like you to do the following.

• Please click Start > Run > and type Regedit
• Click OK and wait for the Registry Editor to open
• Now, please click on File and then Export
• This will bring up the Export Registry File window
• At the bottom of which you will see an option for Export range
• Click the option for Selected branch and in the field underneath that, copy and paste:
  HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
• Enter a file name of Run, and save the file to your Desktop
• Now go to your Desktop, right click on the file you have created, select Open With and choose Notepad.

• Finally, download and save F-Secure Blacklight to your desktop.
http://www.europe.f-secure.com/exclude/blacklight/blbeta.exe
- Double-click blbeta.exe then accept the agreement.
- Click Scan -> then Next
- You will see a list of all items found.
- Don't choose rename yet! I want to see the log first because legitimate items can also be present there…like "wbemtest.exe".
- There must be also a log on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx stand for numbers)
- Post the contents of the log in your next reply.

Note: If you downloaded Blacklight to your desktop, just double-click to run from there and it will create the "fsbl-xxxxxxx.log" on your desktop.

• Post back with the contents of the two export keys and the Blacklight log.

Hi, here are the two export keys and blacklight log Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] "DLLName"="Ati2evxx.dll" "Asynchronous"=dword:00000000 "Impersonate"=dword:00000001 "Lock"="AtiLockEvent" "Logoff"="AtiLogoffEvent" "Logon"="AtiLogonEvent" "Disconnect"="AtiDisConnectEvent" "Reconnect"="AtiReConnectEvent" "Safe"=dword:00000000 "Shutdown"="AtiShutdownEvent" "StartScreenSaver"="AtiStartScreenSaverEvent" "StartShell"="AtiStartShellEvent" "Startup"="AtiStartupEvent" "StopScreenSaver"="AtiStopScreenSaverEvent" "Unlock"="AtiUnLockEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,33,00,32,00,2e,00,64,00,6c,00,\ 6c,00,00,00 "Logoff"="ChainWlxLogoffEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] "Asynchronous"=dword:00000000 "Impersonate"=dword:00000000 "DllName"=hex(2):63,00,72,00,79,00,70,00,74,00,6e,00,65,00,74,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Logoff"="CryptnetWlxLogoffEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] "DLLName"="cscdll.dll" "Logon"="WinlogonLogonEvent" "Logoff"="WinlogonLogoffEvent" "ScreenSaver"="WinlogonScreenSaverEvent" "Startup"="WinlogonStartupEvent" "Shutdown"="WinlogonShutdownEvent" "StartShell"="WinlogonStartShellEvent" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui] @="" "DLLName"="igfxsrvc.dll" "Asynchronous"=dword:00000001 "Impersonate"=dword:00000001 "Unlock"="WinlogonUnlockEvent" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] "DLLName"="wlnotify.dll" "Logon"="SCardStartCertProp" "Logoff"="SCardStopCertProp" "Lock"="SCardSuspendCertProp" "Unlock"="SCardResumeCertProp" "Enabled"=dword:00000001 "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "StartShell"="SchedStartShell" "Logoff"="SchedEventLogOff" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] "Logoff"="WLEventLogoff" "Impersonate"=dword:00000000 "Asynchronous"=dword:00000001 "DllName"=hex(2):73,00,63,00,6c,00,67,00,6e,00,74,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] "DLLName"="WlNotify.dll" "Lock"="SensLockEvent" "Logon"="SensLogonEvent" "Logoff"="SensLogoffEvent" "Safe"=dword:00000001 "MaxWait"=dword:00000258 "StartScreenSaver"="SensStartScreenSaverEvent" "StopScreenSaver"="SensStopScreenSaverEvent" "Startup"="SensStartupEvent" "Shutdown"="SensShutdownEvent" "StartShell"="SensStartShellEvent" "PostShell"="SensPostShellEvent" "Disconnect"="SensDisconnectEvent" "Reconnect"="SensReconnectEvent" "Unlock"="SensUnlockEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] "Asynchronous"=dword:00000000 "DllName"=hex(2):77,00,6c,00,6e,00,6f,00,74,00,69,00,66,00,79,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Impersonate"=dword:00000000 "Logoff"="TSEventLogoff" "Logon"="TSEventLogon" "PostShell"="TSEventPostShell" "Shutdown"="TSEventShutdown" "StartShell"="TSEventStartShell" "Startup"="TSEventStartup" "MaxWait"=dword:00000258 "Reconnect"="TSEventReconnect" "Disconnect"="TSEventDisconnect" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon] "Logon"="WLEventLogon" "Logoff"="WLEventLogoff" "Startup"="WLEventStartup" "Shutdown"="WLEventShutdown" "StartScreenSaver"="WLEventStartScreenSaver" "StopScreenSaver"="WLEventStopScreenSaver" "Lock"="WLEventLock" "Unlock"="WLEventUnlock" "StartShell"="WLEventStartShell" "PostShell"="WLEventPostShell" "Disconnect"="WLEventDisconnect" "Reconnect"="WLEventReconnect" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000000 "SafeMode"=dword:00000001 "MaxWait"=dword:ffffffff "DllName"=hex(2):57,00,67,00,61,00,4c,00,6f,00,67,00,6f,00,6e,00,2e,00,64,00,\ 6c,00,6c,00,00,00 "Event"=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings] "Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\ 00,00,4d,16,1a,49,b8,1b,d0,4d,a4,c6,4b,a6,15,16,d3,30,04,00,00,00,04,00,00,\ 00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,60,cf,53,27,c4,86,b9,3d,\ 2a,f2,49,3b,bc,4b,95,6e,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,39,\ 93,ee,e9,05,2b,2c,20,f3,82,40,86,f1,56,70,48,08,06,00,00,10,c1,66,d3,7f,8b,\ 07,ec,4e,31,5e,4f,7d,8a,72,d9,b6,35,ac,2e,a4,6d,7d,8c,53,a0,94,71,f4,7b,8c,\ 85,45,40,10,62,3f,49,50,93,4c,97,18,9d,6f,5f,87,93,61,45,43,d9,42,3e,00,86,\ ef,9c,8a,83,1f,df,d9,56,94,7d,8c,ae,55,d5,59,69,52,66,e5,a4,7e,b0,ce,c5,80,\ d7,37,8c,54,bc,19,21,f1,f4,31,5a,68,9b,13,92,51,e5,88,8b,c9,4e,91,d8,4a,5d,\ d0,7d,df,dc,f0,11,a3,d5,ae,7c,0c,9d,2d,d9,e9,69,b8,b3,24,d5,ce,9a,a3,7d,8f,\ bb,ed,bb,24,39,c5,5a,21,a2,cd,0b,80,7f,86,a2,ff,f6,7f,2b,e0,2c,85,a5,88,8e,\ a7,c9,52,d8,52,d3,f2,15,25,4d,a8,90,3f,97,0a,95,be,be,9a,1d,2f,d2,67,4f,15,\ 57,ce,87,cc,60,96,37,38,f3,cc,ec,e8,40,08,ae,bc,21,3f,30,75,db,3d,6b,a8,72,\ 96,d4,a5,15,7f,aa,24,cd,58,4a,ca,bd,90,e8,0e,fc,8b,13,75,cd,f1,99,26,ca,3f,\ ab,d7,72,1b,cf,f3,05,94,e5,33,55,ac,72,f9,4e,56,ef,4e,36,93,86,56,af,fe,18,\ f6,75,92,2b,d1,df,47,c3,68,1c,52,6e,85,ba,42,07,d8,80,f8,79,cb,fb,70,30,34,\ ac,91,73,dd,b9,5f,20,fe,2d,8f,b7,bf,f8,05,a0,d4,f6,cb,af,45,88,97,7a,0e,44,\ ef,27,dd,1b,7f,81,ed,7d,f4,d8,19,18,d6,aa,cf,29,d7,12,cd,90,7a,4f,59,76,db,\ b5,81,3d,33,1e,d6,6e,e5,f2,52,20,46,c0,90,5e,42,e6,79,98,a6,18,9e,46,5a,a4,\ f0,e7,f6,55,b3,d2,0d,e9,d3,18,79,c4,75,e2,56,a9,49,89,e9,50,3d,15,39,f0,a7,\ 42,25,df,75,15,83,a4,46,28,31,c6,14,e2,a1,3a,db,9f,75,af,25,e5,88,c1,97,a8,\ de,21,0c,cf,c0,2e,69,12,31,99,f4,2e,9e,79,67,73,70,a2,4d,28,ef,a5,a6,1a,40,\ db,78,f1,8f,27,dc,9b,f6,b7,5d,61,e8,23,66,65,0e,f2,66,11,f4,22,93,b4,89,fe,\ eb,12,1b,4f,51,94,52,8e,17,d8,c0,e4,f6,b5,14,37,b3,3f,b6,0f,99,80,84,88,99,\ 20,d9,a7,04,22,fc,7c,69,40,f8,c8,3d,cb,12,70,02,d0,72,a8,b6,5a,ec,dd,d5,94,\ f8,c8,12,82,3e,59,a2,68,9d,f4,a0,61,3e,47,cf,72,75,e1,4e,86,26,eb,38,7e,f2,\ 88,55,77,63,ba,ea,08,61,cf,84,72,91,ef,82,f1,8f,84,46,e5,66,85,bf,37,34,b8,\ 81,eb,0e,a6,71,0f,60,cd,41,25,a9,1d,1a,05,30,a7,1c,6c,1e,64,40,bc,46,d4,d9,\ 46,15,e7,3c,17,7f,05,d4,42,41,b8,35,3d,a6,81,a2,e6,2f,65,56,a7,71,bb,00,51,\ bc,aa,b9,c4,0f,73,70,96,be,f3,b4,45,64,f0,71,ec,e1,a6,2b,71,46,3f,11,ef,ea,\ b6,eb,3b,6b,d4,c5,51,11,1d,18,6d,56,19,f0,5f,7d,76,e6,10,d8,a0,16,b5,fa,2a,\ 16,3e,89,cc,e6,43,62,5c,8b,df,12,7a,74,f1,74,3e,69,a4,ed,2f,2b,20,85,07,6a,\ 70,67,92,f2,e8,ab,fe,fa,b8,2c,05,cf,7b,e5,76,1d,dd,bb,a9,42,28,c7,e8,51,a1,\ d9,9b,f8,de,89,8a,51,0f,92,a3,6a,b5,ff,56,d6,48,4e,b5,c6,07,72,df,3c,37,bd,\ d9,7b,6f,5a,f0,2f,6d,d5,b6,d7,7b,00,68,8f,a5,3a,5a,f4,d4,0a,33,30,84,14,15,\ 1e,26,f6,2b,38,4a,67,fd,5a,31,3d,0f,88,07,46,63,4a,e8,65,59,72,14,30,1a,7a,\ d5,8e,c7,27,be,06,c7,2f,fb,41,34,9a,8b,cd,09,28,40,05,e2,be,45,7f,90,51,9c,\ 38,12,97,e0,94,15,95,06,0d,2f,cf,ba,2e,67,92,69,56,3b,09,7a,5e,07,a8,e8,62,\ 09,87,22,80,c1,79,ae,5e,e1,16,62,cc,65,36,df,bd,4f,81,48,ad,9c,00,4d,02,db,\ 89,4d,7a,d0,0c,29,5b,19,68,36,cc,3a,d7,de,65,3b,26,45,64,50,4c,7a,ed,84,64,\ f8,48,21,e6,96,d5,75,c3,7e,76,86,e3,a8,37,4c,b9,31,33,5d,f4,b9,af,be,98,00,\ 15,b5,b5,e8,75,a3,4a,6b,e2,17,94,41,47,df,2e,9a,78,c0,ac,2f,fc,6b,02,75,e5,\ 93,6b,af,10,7c,07,0e,8b,e1,d0,e3,61,f5,f5,9e,64,f0,19,5c,35,1e,b5,e0,59,bd,\ f4,19,d5,06,4f,da,c4,84,02,d1,2a,01,87,08,d4,a9,49,66,7e,38,b1,67,2f,69,2d,\ dc,3d,f0,91,72,a7,db,e4,c5,17,87,d5,16,d8,d3,c6,66,bf,57,a3,32,d8,40,b4,4d,\ 96,74,cd,28,48,d8,09,fd,39,dd,d7,47,5a,ae,c6,ba,4b,28,ad,5c,c6,60,8e,74,44,\ b2,56,7c,28,01,2b,a6,60,7b,1d,f6,ea,0b,f2,5e,2c,bb,eb,83,ce,dc,11,23,4a,27,\ cd,0e,f7,d7,36,69,5c,f5,81,e6,72,18,3d,d8,a4,28,f1,34,da,fe,99,fa,48,81,e1,\ 3d,e1,b6,2d,7e,f1,60,ce,20,de,b5,a8,e2,ea,78,8c,77,6b,dd,18,5a,00,ba,f7,eb,\ 58,71,c4,e7,c3,f8,52,e1,78,00,d8,5b,90,79,18,d4,2f,33,f5,80,e8,49,e8,dd,fc,\ 8d,f9,fb,91,3e,3d,6b,74,ff,41,63,e0,4d,7a,3c,76,d5,df,a2,d2,60,a2,f6,1b,08,\ 75,76,fb,c2,fa,64,82,c7,32,33,6d,1e,ae,16,28,b9,85,60,e6,b6,da,ed,49,6b,a6,\ 26,51,9a,d1,52,33,b9,74,9e,2b,c3,73,de,dd,67,1f,40,9e,32,ce,00,5c,2d,ed,53,\ 18,25,4e,8b,9f,c5,81,0a,ac,42,93,c7,3e,55,41,0e,cf,c2,0a,7d,a6,57,2d,46,a7,\ 98,1e,0d,20,ea,fb,94,04,82,2a,4b,46,f4,f7,12,ca,45,54,34,b2,af,3a,b5,0e,87,\ 8e,b2,0e,62,dc,a1,fb,88,00,27,f8,35,4d,4e,2f,98,5d,ed,5a,88,17,5c,fc,bd,99,\ 84,02,66,54,0c,39,42,fd,ef,f2,f4,a8,e6,46,19,1d,bd,f1,48,78,45,3c,fb,e0,e2,\ 03,94,dc,19,00,54,cf,6a,1f,72,25,e4,6f,f8,62,5c,9b,af,09,fd,a1,b6,d5,d0,cb,\ 66,80,ea,8c,72,0c,d8,12,a8,5b,e9,c3,ea,cd,5b,d9,c8,33,e7,f6,01,22,d6,ec,83,\ f4,f3,aa,da,ce,db,16,fb,0c,c4,6c,38,64,59,9e,b5,7f,83,86,5a,3d,33,cf,fd,49,\ 33,ad,1f,5c,16,bf,2d,20,bd,b8,7b,36,13,3d,56,ba,eb,05,78,89,ef,cf,5c,19,92,\ be,f7,ec,21,35,b2,05,17,13,c1,e4,b1,61,6d,5d,df,49,30,5b,a6,b4,75,4d,68,1f,\ 2b,8d,5f,0c,f4,09,c4,b1,ee,93,08,bb,e3,7f,28,8a,ef,59,b9,33,b1,78,ad,e0,05,\ 63,e2,53,55,f7,37,db,20,03,fa,3e,b8,80,3d,4d,f6,60,63,34,fe,fc,11,fb,d5,02,\ 5d,f4,ae,42,b4,fd,f7,42,83,52,92,9a,b4,e9,83,83,b4,2b,20,d6,19,bb,0e,01,62,\ 71,35,cd,2d,0c,00,6a,18,09,83,26,9f,db,4b,a5,52,dd,e6,a9,c7,ef,dc,06,63,aa,\ 53,f3,e3,3d,f1,ff,13,b0,c2,00,7b,76,48,14,00,00,00,8a,3e,04,8c,a9,af,30,b8,\ ac,d9,f5,b1,02,a4,ae,41,9d,ff,28,25 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] "DLLName"="wlnotify.dll" "Logon"="RegisterTicketExpiredNotificationEvent" "Logoff"="UnregisterTicketExpiredNotificationEvent" "Impersonate"=dword:00000001 "Asynchronous"=dword:00000001 Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "ShStatEXE"="\"C:\\Program Files\\Network Associates\\VirusScan\\SHSTAT.EXE\" /STANDALONE" "McAfeeUpdaterUI"="\"C:\\Program Files\\Network Associates\\Common Framework\\UpdaterUI.exe\"" "PinnacleDriverCheck"="C:\\WINDOWS\\System32\\PSDrvCheck.exe" "SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon" "ATIPTA"="\"C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe\"" "IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe" "CoolSwitch"="C:\\WINDOWS\\system32\\taskswitch.exe" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] "Installed"="1" 12/03/06 16:20:28 [Info]: BlackLight Engine 1.0.47 initialized 12/03/06 16:20:28 [Info]: OS: 5.1 build 2600 (Service Pack 2) 12/03/06 16:20:28 [Note]: 7019 4 12/03/06 16:20:28 [Note]: 7005 0 12/03/06 16:20:41 [Note]: 7006 0 12/03/06 16:20:41 [Note]: 7011 1496 12/03/06 16:20:41 [Note]: 7026 0 12/03/06 16:20:41 [Note]: 7026 0 12/03/06 16:21:03 [Note]: FSRAW library version 1.7.1020 12/03/06 16:37:19 [Note]: 2000 1012 12/03/06 16:37:19 [Note]: 2000 1012 12/03/06 16:38:25 [Note]: 7007 0

Hi, • Please go to Start > Control Panel > choose "Network Connections" - Right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up - Click on "Properties" - Double-click on the "Internet Protocol (TCP/IP)" item > select the radio button that says "Obtain DNS servers automatically" - Click OK twice, and restart your computer. • Run FixWareout again. Make sure you are connected to the Internet when you do run it. • Post back with the FixWareout log and a new HijackThis log.

Hi,

• Start HijackThis, click System Scan Only and place a checkmark next to the following item:
O17 - HKLM\System\CCS\Services\Tcpip\..\{9FB8FD8E-B5CD-4CF1-8835-E6FE7F5466AC}: NameServer = 85.255.116.139 85.255.112.229

Close ALL browsers and open windows/programs except HijackThis and click 'Fix Checked'.

• Reboot your computer.

• Download Gmer from here:
http://www.gmer.net/gmer.zip
Read here how to unzip/extract properly:
http://metallica.geekstogo.com/xpcompressedexplanation.html

• Disconnect from internet and close running programs.
• There is a small chance this app may crash your computer so save any work you have open
• Double click gmer.exe
• Let the gmer.sys driver load if asked
• If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say OK
• If no warning….
• Click "rootkit" tab and click "scan"
• Once done click "copy"
• Open Notepad and hit "ctrl+v" to paste log.
• Reconnect to internet and post log please.

Hi, Well the jupk.com redirection has stopped and I can now use google.co.uk as my homepage. It also seems to have speeded up my startup which was a little slow. I really appreciate the help you have given me and if you think everything looks ok I will create a clean restore point and go through the preventative methods listed on the forum. Once again thankyou very much

Hi, You were too quick for me. I edited my post, but you had already seen my first post. Please follow the directions above. You still have the O17 entry in your log that caused your problems which means that you're still infected.

Hi, Please post a new HijackThis log.