sUBs

Hi and Welcome to TSF!

Please subscribe to this thread to be notified of fixes as soon as they are posted by our Team. To do this, please click the "Thread Tools" button located in the original thread line and selecting "Subscribe to this Thread".

It would appear that your Operating System and Internet Explorer are not up to date and this seems to be contributing to your problems. Please consider going to Windows Update site and install all available Critical Updates. Patch your system with the most current security fixes and plug all the known vulnerabilities.

There seems to be no anti-virus application installed on this machine. Anti-virus programs protect against infections. Without one, you're vulnerable to every virus, spyware program, trojan and piece of malware that is floating around out there. I urge you to install an anti-virus program as quickly as possible. Please choose one from these 3 free programs that are available for home use:

• AVG Anti-Virus
• Avast Home Edition
• BitDefender Free Edition v7

It's better to print out the next instructions or save them in notepad, because you also have to work in safe mode without networking support, so this page wouldn't be available then.
It is also important you don't miss a step and perform everything in the right order!!.
If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should not have any open browsers when you are carrying out the procedures below.


~~~~~~~~~~~~~~

Please download these additional files/programs :- (Do not run them unless instructed to do so)
Unplug your computer from the Internet when you have finished downloading

CleanUp! - Install

KillBox v2.0.0.175 - Save to Desktop.

FixO.exe - Unzip to a new folder on your desktop called FixO. Open the folder and doubleclick FixO.bat. It will generate a log afterwards. Copy and paste the contents of that log in your next reply


~~~~~~~~~~~~~~

Uninstall the following programs, if present, using Control Panel > Add/Remove Programs :

• Keen Value
  ViewPoint

~~~~~~~~~~~~~~

Copy to clipboard, all the items below by highlighting them & pressing [CTRL]+[C] on your keyboard.

C:\WINDOWS\System32\SMSSU.EXE
C:\WINDOWS\System32\Tmntsrv32.EXE
C:\Program Files\Kqryb\Tgjzv.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\xmllib.dll
C:\WINDOWS\spxtres.exe
C:\WINDOWS\system32\spxtres.exe
C:\Program Files\Common files\updmgr\updmgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\epswad3.exe
C:\WINDOWS\System32\appmgr.exe
C:\WINDOWS\System32\d3dim700.exe

Start KillBox.

1. Go to the File menu, and choose Paste from Clipboard.
   Verify that you've done this properly by clicking the dropdown-arrow next to the Full Path of File to Delete field. The filenames you pasted will be found in there.
2. Select/tick the following:
   * Delete on Reboot
   * End Explorer Shell While Killing File
   * Unregister.dll Before Deleting" if it's not grayed out.
3. Click the RED X button.
4. Click [Yes] at the 'Delete on Reboot' prompt. Click [Yes] at the Pending Operations prompt.

* If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here to download and run missingfilesetup.exe. Then try Killbox again.


~~~~~~~~~~~~~~

Reboot to SafeMode

1. Shut Windows down, and then turn off the computer.
2. Restart the computer. The computer begins processing a set of instructions known as the Basic Input/Output System (BIOS). What is displayed depends on the BIOS manufacturer. Some computers display a progress bar that refers to the word BIOS, while others may not display any indication that this process is happening.
3. As soon as the BIOS has finished loading, begin tapping the F8 key on your keyboard. Continue to do so until the
   [Windows Advanced Options] menu appears.
4. Using the arrow keys on the keyboard, scroll to and select the Safe mode menu item, and then press Enter.

~~~~~~~~~~~~~~

Run a scan with HiJackThis & select(tick) the following & click [Fix checked] :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://default.home
R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O2 - BHO: XMLDP Class - {60371670-81B9-4d06-9C42-4DEC1AABE62B} - C:\WINDOWS\xmllib.dll
O4 - HKLM\..\Run: [03Ei3mg] spxtres.exe
O4 - HKLM\..\Run: [Evymuq] C:\Program Files\Kqryb\Tgjzv.exe
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [AdPopup] C:\WINDOWS\epswad3.exe
O4 - HKCU\..\Run: [appmgr] C:\WINDOWS\System32\appmgr.exe
O4 - HKCU\..\Run: [d3dim700] C:\WINDOWS\System32\d3dim700.exe
O4 - HKCU\..\Run: [SMSSU] C:\WINDOWS\System32\SMSSU.EXE
O4 - HKCU\..\Run: [Tmntsrv32] C:\WINDOWS\System32\Tmntsrv32.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MT...od/install.html
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0002.exe
O16 - DPF: {EC51659D-721F-4CBF-9CEA-5E776D89CEA9} - http://www.pacimedia.com/install/pcs_0002.exe
O16 - DPF: {F229AB32-7BF9-4225-B78F-B4680AE6FC23} (Snapfish File Upload ActiveX Control) - http://www.snapfish.com/SnapfishUpload.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab


~~~~~~~~~~~~~~

Enable the viewing of Hidden files

1. Open Windows Explorer
2. Go to Tools>Folder Options>View tab.
3. enable the option for `Show hidden files and folder´
4. disable the option for `Hide file extensions for known types´
5. disable the option for `Hide protected operating system files´
6. click "Yes" to confirm & then click "OK"

Locate and delete the following folder(s), if present:

• C:\Program Files\Kqryb\
  C:\Program Files\Viewpoint\
  C:\Program Files\Common files\updmgr\

Search for & delete ... using "Start>Search..." the following file(s), if present:

• spxtres.exe

~~~~~~~~~~~~~~

Run Cleanup! & configure the program up as follows:

1. Click Options...
2. Move the arrow down to Custom CleanUp!
3. Put a check next to the following:
   • Empty Recycle Bins
   • Delete Cookies
   • Delete Prefetch files
   • [X]Scan local drives for temporary files (Please uncheck this option)
   • Cleanup! All Users
4. Click OK
5. Press the CleanUp! button to start the program. Reboot/logoff when prompted.

* CleanUp! will delete all the files in your temp folders without making a backup


~~~~~~~~~~~~~~

Reboot to NormalMode.

Do an online scan at Kaspersky

Take note the names and locations of any file it detects but fails to clean.
* Turn off the real time scanner of any existing antivirus program while performing the online scan


Download Trend Micro™ Anti-Spyware for the Web Utility (by clicking the "Scan and Clean your PC" button).

• Save it to your desktop.
• Double-click the new icon on your desktop (tmas-web-scan.exe)
• It will say "Loading TrendMicro definitions".
• Once the definitions are loaded, the program will appear to close then re-open.
• Click "Start Scan"
• After it's done scanning, click "Scan Results"
• Make sure all items found have a check next to them, then click "Clean Threats Now".
• Click Exit.

Reboot your computer. In place of the TrendMicro icon will be a text file called "Antispyware.log", please double-click that log and copy the entire contents and paste them here.

Reboot Again & Run a new scan with HiJackThis. Save the log file and post the contents in your next reply.

In your next post, please include fresh copies of:

1. Copy of HiJackThis log
2. List of files that online scans failed to disinfect
3. FixO's log
4. Antispyware.log

Please provide details of any problems you encountered whilst performing the above steps.
Update us on how your computer behaves now