Hello and Welcome. Please subscribe to this thread to get immediate notification of replies as soon as they are posted.
Before begining the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.
---------------------------------------------------------------------------------------------
Before you do anything else, create a folder for HijackThis and put it in a permanent folder (like C:\HJT) instead of the Temp folder. This is required because HijackThis will create backups and we don't want them to be deleted.
---------------------------------------------------------------------------------------------
Download
Ewido Anti-Malware- Install Ewido Anti-Malware
- When installing, under "Additional Options" uncheck..
- Install background guard
- Install scan via context menu
- Double-click the icon on Desktop to launch Ewido
You will need to update Ewido to the latest definition files.
- On the left hand side of the main screen click update.
- Then click on Start Update.
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to
manually update Ewido
When you have finished updating,
EXIT Ewido.
Download and install
CleanUp!
NOTE: Do NOT run this program if you have XP Professional 64 bit edition. If you're unsure please do not run it! Download & run this tool to find out for sure.....http://www.kellys-korner-xp.com/regs...p_whichcpu.exe
Please download & Install -
FixWareout.exe
When you reach the final page of the installation process, make sure
"Run fixit" is checked.
Follow the on-screen prompts & reboot your computer when instructed to do so.
**Do not be alarmed if your computer takes longer than usual to load.
FixWareOut will produce a logfile, report.txt located within the C:\fixwareout folder
--------------------------------------------------------------------------
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' if they still exist (make sure not to miss any):
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Shadowfinder
O2 - BHO: (no name) - {77701e16-9bfe-4b63-a5b4-7bd156758a37} - (no file)
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [yaemu.exe] C:\WINDOWS\system32\yaemu.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{93DB1AA3-F04D-4563-B63A-A8E002CB94C9}: NameServer = 85.255.113.110,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{CEEB4AB1-31F2-4485-96B4-63778C916900}: NameServer = 85.255.113.110,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{D204DA3F-D75B-402D-984F-E2FFA8355AF9}: NameServer = 85.255.113.110,85.255.112.105
O17 - HKLM\System\CCS\Services\Tcpip\..\{F305A1A6-0AEB-422D-9930-343105C412FB}: NameServer = 85.255.113.110,85.255.112.105
---------------------------------------------------------------------------------------------
Open
Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "
Options..."
Move the arrow down to "
Custom CleanUp!"
Put a check next to the following (
Make sure nothing else is checked!):
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files (if present)
- Cleanup! All Users
Click
OK
Press the
CleanUp! button to start the program.
It may ask you to log-off/reboot at the end, if it does please do so.
Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.
---------------------------------------------------------------------------------------------
Run
Ewido with it's updated definitions:(...it's important that all windows must be closed)
- Click Scanner
- Click Complete System Scan to begin scanning.
- Click OK when prompted to clean files
With the first file it prompts to clean, select the option:
- "Perform action on all infections"
- Choose clean and click OK.
Once finished, click the
Save report button & save the report to your desktop
** Ewido scan would require at least an hour.
---------------------------------------------------------------------------------------------
Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading, select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Also make sure there is no checkmark beside Hide file extensions for known file types
* Click Yes to confirm and then click OK.
Delete the following
Files/
Folders if they exist:
C:\WINDOWS\system32\yaemu.exe
C:\WINDOWS\system32\howiper.exe
---------------------------------------------------------------------------------------------
Restart in normal mode.
---------------------------------------------------------------------------------------------
Perform an online scan with Internet Explorer with
Panda ActiveScan
Click on the "Free To Use ActiveScan" located on the top right hand corner- Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
- Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *
Begin the scan by selecting
My Computer- If it finds any malware, it will offer you a report.
- Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
- Click on See report then click Save report
*Turn off the real time scanner of any existing antivirus program while performing the online scan
---------------------------------------------------
Run a new HijackThis scan. Save the log file and post it here.
---------------------------------------------------------------------------------------------
Please return with results from:
Wareout
Ewido
Panda
HJT
---------------------------------------------------