Hello and welcome to TSF
Please print out or copy this page to
Notepad in order to assist you when carrying out the following instructions.
The file you are stopping is a legitimate file from the following Windows update. Do not stop it from running again!
http://www.microsoft.com/technet/sec.../ms06-015.mspx
Go to
My Computer >Tools >Folder Options >View tab and
select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option. Also make sure there is no checkmark beside
Hide file extensions for known file types. Click OK.
Please disable Spywareguard, as it may hinder the removal of some entries. You can re-enable it after you're clean.
- Right click the running icon of Spywareguard located in the system tray
- Go to Menu > File > Exit and confirm the programs close.
I see that you already have ewido. From the main ewido screen, click on update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful")
Close Ewido.
Please download
Cleanup! or use this
(Alternate Link) if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.
Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).
Open Hijack This and click on Scan. Check the following entries
(make sure you do not miss any)
O16 - DPF: ppctlcab -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} -
O16 - DPF: {5D8844F9-1CB8-11D2-A0A0-00600859EB9F} -
O16 - DPF: {5F0C30E4-1E72-4DCC-85E5-57810F1CA97B} -
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} -
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) -
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} -
O16 - DPF: {DD85FDB7-9363-4873-B50C-CC46F3E4B704} -
O16 - DPF: {E56347B0-6C2B-4C2E-939F-EE513EAC80BC} -
Please remember to close all other windows, including browsers then click Fix checked.
Open
Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:
Click
Options
Move the slider button down to
Custom CleanUp!
Check the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- Cleanup! All Users
Uncheck the following :
- Scan local drives for temporary files
Click
OK, Press the
CleanUp! button to start the program. DO NOT reboot when prompted.
Run Ewido with it's updated definitions:(...it's important that all windows must be closed)
- Click Scanner
- Click Complete System Scan to begin scanning.
- Click OK when prompted to clean files
- With the first file it prompts to clean, select the option: "Perform action on all infections"
- Choose clean and click OK.
- Once finished, click the Save report button & save the report to your desktop
** Ewido scan would require at least an hour.
Reboot your system in Normal Mode.
Perform an online scan with Internet Explorer with
Panda ActiveScan
Click on the "Free To Use ActiveScan" located on the top right hand corner- Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
- Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *
Begin the scan by selecting
My Computer- If it finds any malware, it will offer you a report.
- Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
- Click on See report then click Save report
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan
Paste the
Panda Scan report here together with a new
HiJack This log, and
Ewido's log.