Major Problem - browser hijacked, cannot get rid of routing.exe, wserving.exe

[jholland1964]

Hi, You can run HJT again and place a checkmark next to this entry;
23 - Service: WakeMeUp! Service (svcWMU) - Unknown owner - C:\Program Files\WakeMeUp\WMUSvc.exe (file missing)
Then click the Fix Checked button and then exit HJT.

Can you tell me about this program? ClamWin. I am not familiar with it. But from what I can find

ClamWin is a Free Antivirus program for Microsoft Windows 98/Me/2000/XP/2003 and Vista.

It does show as being in your Startups in your original HJT log, I just failed to mention it earler, since we sort of got "waylaid" by other things.

[floppsybunny]

checked and fixed the wakemeup entry in hjt but doesn't seem to have gotten rid of it, checked by restarting and still there.

clamwin is a free antivirus recommended to me by a friend, hadn't noticed it doing anything strange (lets me shut it off w/out much fuss in task manager, which is actually probably not a great feature for an antivirus to have). now that i remember - i did actually uninstall (or attempt to) from the control panel but it claimed to have corrupted files and didn't uninstall properly...

[jholland1964]

Anytime you complete fixes with HJT then you need to do a new scan AFTER the fix has been applied and post the log. I cannot see anything without those new logs.

now that i remember - i did actually uninstall (or attempt to) from the control panel but it claimed to have corrupted files and didn't uninstall properly...

Uninstall WHAT?

Let's see if we can get that wakemeup entry removed this way. Go to Start, Control Panel, Administrative Tools, Services.
Scroll down through the list until you see WakeMeUp! Service (svcWMU) and double click it.
When it opens change the Startup Type to Disabled. Click ok. Close services. Shut down/Reboot the computer and run a NEW HJT SCAN and post the log.

[floppsybunny]

that seems to have worked on wakemeup. (hjt log attached.)

i tried to uninstall clamwin that way, through the add/remove programs, but still shows up in the list and claims to have corrupted parts. maybe not a big deal as it doesn't seem to run on startup now.

[jholland1964]

Can you boot to Safe Mode? If so go into C:\Program Files\ClamWin\
and delete that ClamWin folder.

[jholland1964]

After you have done that then do the following;
Please download OTCleanIt.exe and save to your Desktop.

• Connect to the Internet and double-click on the file to launch the program.
• Click on the green CleanUp! button.
• If you get a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the Internet, please allow the connection.
• When it has finished, OTCleanIt will ask you to reboot so it can remove itself.

-- Note: Doing this will remove any specialized tools (including this one) downloaded and used. All of the tools we used are updated frequently so if you would need them in the future, HOPEFULLY NOT, then you would need the newest versions anyway so get rid of these now.
Judy

[floppsybunny]

i tried to delete 'c:\program files\clamwin' in safe mode but it gave me an access denied dialogue related to 'ExpShell.dll' which is actually the only file/folder left in the directory '...\ClamWin\bin\ExpShell.dll'

?

[jholland1964]

Evidently this is a problem with this program because I found numerous references on this same problem. If it isn't running then for now leave it alone and I will search for a remedy. Please run that OTCleanIt program

[floppsybunny]

ok, ran OTCleanIt - no problems.

clamwin might be an annoyance i have to live with? though very happy to get rid of it if you can find some way of doing that.

otherwise, you have certainly rescued my computer from near certain doom, and a lot of my unbackedup work over the last six months with it. will definitely continue running AVG anti-virus (surprisingly, does not drain that much processing power) and probably buy an outboard USB storage device for backing things up more readily (i have about 100G of cubase audio processing projects and documents that should probably be updated weekly at least, and i've run out of dvd-rs.)

let me know if there's anything else i should do to keep myself clean. and a million thank you's again for all your time and expertise over the past (almost) week of nailbiting and cursing at my computer - don't know what i would have done without you. (probably reformat and cry a lot...)

[jholland1964]

Definitely get something to back up important items as you noted.
I would also recommend adding SpywareBlaster to the computer. A truly MUST have program, wouldn't run my computer without it.
Nice thing...it is FREE, but also it DOES NOT run in the background but offers protections against trojans, dialers, downloaders, hijackers, blocks tracking cookies and restricts unwanted sites too. Great program!
Just download, install, update and enable it and close it. That is it! Just remember to update manually each week and enable new protections.
I will also keep looking for the full removal of that Clamwin program, but as long as it isn't running I think you are ok.