Ok philentropy,
You are going to need to PRINT OUT these instructions as you will need to boot to SAFE MODE for some of these steps and therefore will not have access to the internet to refer to these steps.
Please Enable Viewing of Hidden Files and Folders
You still show multiple items which must be removed. I want you to UPDATE your Norton Anti-virus, but don't scan yet, make sure it is updated.
Update the AVG Anti-Spyware program. Do not run it yet.
Next you need to download, install and update the following programs if you do not already have them. If you DO already have them then update them;
SpyBot Search & Destroy
AdAwareSE Personal Edition
CCleaner
Please download VundoFix.exe to your desktop.Now you will need to disconnect completely from the internet. Remove the internet plug from the back of the computer.
- Double-click VundoFix.exe to run it.
- Place a check in the checkbox labeled Run VundoFix as a task. You will receive a message stating that VundoFix will close and re-open in a minute or less.
- When VundoFix reopens, click the OK button.
- Click the Scan for Vundo button.
- Once it's done scanning, click the Remove Vundo button.
- You will receive a prompt asking if you want to remove the files, click the YES button.
- Once you click yes, your desktop will go blank as it starts removing Vundo.
- When completed, it will prompt that it will shutdown your computer, click the OK button.
Once you have done so then reboot the computer in SAFE MODE.
All of these next steps will be run in SAFE MODE. Do not reboot until all have been completed.
Once the computer is booted into safe mode Open and RUN CCleaner with the default options to clean out temporary files. Only use the Default Scan (Windows Tab) and select Run Cleaner. Do not run any other options from other tabs.
Open SpyBotS & D and Click “Check for Problems.” Allow SpyBot to fix what it finds. REMOVE EVERYTHING SHOWN IN RED
Run Ad-Aware SE. Make sure all other windows, including your browser, is closed.
* Click on the gear icon in the upper right (Settings).
* Click "Scanning".
* Select:
- "Scan within archives"
- "Scan my IE Favorites for banned URLs"
- "Scan my hosts file"
* Click "Tweaks".
* Click "Cleaning Engine".
* Select "Automatically try to unregister objects prior to deletion".
* Click "Proceed".
* Click "Start".
* Select "Use custom scanning options".
* Click "Next" and wait for the scanning process to complete.
* Select all the items found for removal. ("Removal" actually puts things in quarantine, so you can generally recover them if you need to.)
Next run your Norton Anti-Virus program. Have it do a Full system
scan and REMOVE everything found.
Now run the AVG Anti-Spyware click Scanner > Complete System Scan.
Allow it to fix what it finds and click on Save Report. Save the log to where it can be easily found and please attach it along with your HijackThis log when you post back.
Next, STILL IN SAFE MODE and with Viewing of Hidden Files Enabled
I want you to again go to My Computer.
Double Click "C" Drive.
Once in "C" Drive go to the following folders and delete the items noted in RED. I repeat, just the entry noted in RED not the entire folder;
C:\WINNT\system32\wfxqhv.exe
C:\Program Files\System Files\System.exe
C:\Program Files\PSHope\PSHope.exe
C:\Program Files\Common Files\??stem\d?xplore.exe
C:\Program Files\TClock\tclock_install.exe
Make note of any you cannot find and proceed to the next one.
Once you have completed all these steps then reboot the computer in Normal Mode, but do not reconnect to the internet yet.
With ALL browsers closed, run a NEW HJT scan and place a checkmark next to any of the following items remaining in the log;
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.mrfindalot.com/search.asp?si=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.mrfindalot.com/search.asp?si=
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll (file missing)
O2 - BHO: Ozbyq Class - {D623BC2F-A58D-4A75-A10D-CC244A702A35} - C:\WINNT\system32\xeymi.dll (file missing)
O2 - BHO: (no name) - {E5E2A3E7-00FE-4D31-A030-A10799DDCA66} - (no file)
O4 - HKLM\..\Run: [qcr40486] "RUNDLL32.EXE" w20c5d8c.dll,n 002404840000000320c5d8c
O4 - HKLM\..\Run: [w20cc6f4.dll] "RUNDLL32.EXE" w20cc6f4.dll,I2 00240484020cc6f4
O4 - HKLM\..\Run: [spywarebot] C:\Program Files\spywarebot\SpywareBot.exe -boot
O4 - HKCU\..\Run: [CAS2] "C:\Program Files\System Files\System.exe"
O4 - HKCU\..\Run: [PSHope] "C:\Program Files\PSHope\PSHope.exe"
O4 - HKCU\..\Run: [Lflwn] C:\Program Files\Common Files\??stem\d?xplore.exe
O4 - HKCU\..\Run: [TClock.exe] C:\Program Files\TClock\tclock_install.exe
O15 - Trusted Zone: http://download.windowsupdate.com
O16 - DPF: {74CD40EA-EF77-4BAD-808A-B5982DA73F20} - http://yax-download.yazzle.net/Yazzl...cab?refid=1123
O18 - Filter: text/html - {B5F86455-BF18-4E12-965A-6642A0AC0549} - C:\WINNT\system32\xeymi.dll
O20 - Winlogon Notify: awtqn - C:\WINNT\system32\awtqn.dll (file missing)
O20 - Winlog
on Notify: MS-DOS Emulation - C:\WINNT\
Once you have placed checkmarks next to any of the above items found then click the FIX button.
Exit HJT.
Reboot, and with ALL BROWSERS CLOSED run a NEW HJT scan, save the log. Reconnect to the internet and post it here with the saved AVG log.
DO NOT, I repeat, DO NOT run any other fixes other than those noted here. Do not post any logs other than those requested.
Reply With Quote
Originally Posted by philentropy
