Hello again
Please
subscribe to this thread to get
immediate notification of replies as soon as they are posted. To do this click
Thread Tools, then click
Subscribe to this Thread. Make sure it is set to
Instant Notification, then click
Subscribe.
========
Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.
Please Do Not Attach logs to your posts unless you are advised to do so.
==========
S& D Spybot's Tea Timer
While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
- Open Spybot Search & Destroy.
- In the Mode menu click "Advanced mode" if not already selected.
- Choose "Yes" at the Warning prompt.
- Expand the "Tools" menu.
- Click "Resident".
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- In the File menu click "Exit" to exit Spybot Search & Destroy.
----------
Windows Defender
Please disable your Windows Defender Real-time Protection, as it may hinder the removal of some entries.
- Open Windows Defender.
- Click on Tools>Options.
- Scroll down and uncheck "Use real-time protection (recommended)".
- After you uncheck this, click on the Save button and close Windows Defender.
==========
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries
(If they still exist, make sure you do not miss any)
O2 - BHO: (no name) - {017D90B5-F081-4119-99ED-3231F0E744C8} - C:\WINDOWS\system32\byXPiIca.dll (file missing)
O2 - BHO: (no name) - {07DF7501-A4E0-452E-B36C-170614D115D8} - (no file)
O2 - BHO: (no name) - {189A78B1-CEB8-45FD-9C12-4B9C8A965A58} - C:\WINDOWS\system32\tuvTlmLE.dll (file missing)
O2 - BHO: (no name) - {7298ECDD-7C93-4EF8-9296-3BE188269346} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8FC89E07-D848-41E5-A9AB-2CB71591EFAC} - (no file)
O2 - BHO: (no name) - {988E6186-A4F2-4192-BE95-7A91C8F458F2} - (no file)
O2 - BHO: QXK Olive - {C607C322-F4DF-44B7-98F5-FCAE55BADEA0} - (no file)
O20 - Winlogon Notify: tuvTlmLE - tuvTlmLE.dll (file missing)
O21 - SSODL: adgpfoxs - {693D26B7-D602-43B5-943E-5373D6065550} - (no file)
O21 - SSODL: erpobmsw - {30779CEC-6651-4432-A961-6A3A59A4B253} - (no file)
Please remember to close all other windows, including browsers then click Fix checked.
=========
Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/comb...o-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once the Recovery Console is installed using ComboFix, you should see a message that says:
The Recovery Console was successfully installed.
Please continue as follows:
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
=========
Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.
=========
Logs Required
C:\Combofix.txt
Hijackthis Log