Ried

Hello snub and welcome to TSF,

Please print out or copy this page to Notepad since you will not have any of browsers open while you are fixing this. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. Again, you should not have any open browsers when you are following the procedures below.

Go to My Computer->Tools/View->Folder Options->View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled. Also make sure that 'Display the contents of system folders' is checked.

For the options that you checked/enabled earlier, you may uncheck them after your log is clean. If we ask you to fix a program that you use or want to keep, please post back saying that (we don't know every program that exists, so we may tell you to delete a program that we think is bad to keep).

The Temp folders should be cleaned out periodically as installation programs and hijack programs leave a lot of junk there. Download CleanUp! (Alternate Link if main link doesn't work) and install it. Do not run it yet.

Download these two tools from Symantec:

Trojan.Vundo Removal Tool
http://securityresponse.symantec.com...oval.tool.html


FixVundo http:securityresponse.symantec.com/avcenter/FixVundo.exe and run it.

Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:

HuntBar
WeatherBug - it's adware. If you didn't install this yourself, uninstall it. If you did install it yourself, you may keep it and ignore any fixes/deletions listed below.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

R3 - URLSearchHook: (no name) - {87766247-311C-43B4-8499-3D5FEC94A183} - (no file)
O2 - BHO: (no name) - {2527BEEF-1B3C-4D3B-98F0-7F3C1EB910A0} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nualue.dat (file missing)
O2 - BHO: (no name) - {446CF8A5-617E-4D91-95AE-AE78CE0D06AF} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\vaniw.dat (file missing)
O2 - BHO: (no name) - {68132581-10F2-416E-B188-4E648075325A} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\sndniam.dat
O2 - BHO: (no name) - {BB54DE33-E539-4749-BFAC-CC49617E8F2A} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\alueyalp.dat
O2 - BHO: (no name) - {FF4D5071-EE0E-4DCA-BC1C-D776B0F2276E} - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\kabbew.dat
O4 - HKLM\..\Run: [tcpnut] C:\WINNT\Fonts\tcpnut.exe
O4 - HKLM\..\Run: [sysexp] C:\WINNT\Web\sysexp.exe
O4 - HKLM\..\Run: [*tcpnut] C:\WINNT\Fonts\tcpnut.exe
O4 - HKLM\..\Run: [*avodbc] C:\WINNT\system\avodbc.exe
O4 - HKLM\..\Run: [*vsswave] C:\WINNT\msagent\vsswave.exe
O4 - HKLM\..\Run: [*fontip] C:\WINNT\Tasks\fontip.exe
O4 - HKLM\..\Run: [*netplay] C:\WINNT\addins\netplay.exe
O4 - HKLM\..\Run: [*acdisk] C:\WINNT\Cursors\acdisk.exe
O4 - HKLM\..\Run: [*cabsvr] C:\WINNT\msagent\chars\cabsvr.exe
O4 - HKLM\..\Run: [*waves] C:\WINNT\java\TrustLib\waves.exe
O4 - HKLM\..\Run: [*dbmfc] C:\WINNT\repair\dbmfc.exe
O4 - HKLM\..\Run: [*accmp3] C:\WINNT\Speech\accmp3.exe
O4 - HKLM\..\Run: [*cat] C:\WINNT\Driver Cache\cat.exe
O4 - HKLM\..\Run: [*wms] C:\WINNT\repair\wms.exe
O4 - HKLM\..\Run: [*urlxml] C:\WINNT\addins\urlxml.exe
O4 - HKLM\..\Run: [*vbtapi] C:\WINNT\inf\vbtapi.exe
O4 - HKLM\..\Run: [*dbkey] C:\WINNT\Windows Update Setup Files\dbkey.exe
O4 - HKLM\..\Run: [*playinfo] C:\WINNT\Speech\playinfo.exe
O4 - HKCU\..\Run: [tcpnut] C:\WINNT\Fonts\tcpnut.exe
O4 - HKLM\..\RunOnce: [*playeula] C:\WINNT\Speech\playeula.exe rerun
O9 - Extra button: WeatherBug (HKCU)
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuit.../ITDetector.cab

Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

C:\WINNT\Fonts\tcpnut.exe
C:\WINNT\Web\sysexp.exe
C:\WINNT\system\avodbc.exe
C:\WINNT\msagent\vsswave.exe
C:\WINNT\Tasks\fontip.exe
C:\WINNT\addins\netplay.exe
C:\WINNT\Cursors\acdisk.exe
C:\WINNT\msagent\chars\cabsvr.exe
C:\WINNT\java\TrustLib\waves.exe
C:\WINNT\repair\dbmfc.exe
C:\WINNT\Speech\accmp3.exe
C:\WINNT\Driver Cache\cat.exe
C:\WINNT\repair\wms.exe
C:\WINNT\addins\urlxml.exe
C:\WINNT\inf\vbtapi.exe
C:\WINNT\Windows Update Setup Files\dbkey.exe
C:\WINNT\Speech\playinfo.exe
C:\WINNT\Speech\playeula.exe rerun
C:\Program Files\Huntbar
C:\Program Files\WeatherBug

Run CleanUp! and click on CleanUp! button. When it asks you if you want to logoff, click on Yes.

Reboot into Normal Mode run a new HijackThis scan and post the log.