No constant bumping....
Get Ewido either in Safe Mode with Networking or from another computer and burn it to a CD.
Print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.
Download smitRem at
http://noahdfear.geekstogo.com/click...click.php?id=1 and save the file to your desktop.
NOTE: If you have Windows 9x/ME, you don't need to use Ewido (skip this step).
Download Ewido Security Suite at
http://www.ewido.net/en/download/
1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you might get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on start update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'.
8. Exit Ewido. DO NOT scan yet.
If you are having problems with the updater, you can go to
http://www.ewido.net/en/download/updates/ to update manually.
If you have not already installed Ad-Aware SE 1.06, follow the download and setup instructions at
http://rstones12.geekstogo.com/adawareSE_setup.htm. Otherwise, check for updates. Don't run it yet!
Download CleanUp!
http://cleanup.stevengould.org/ (Alternate Link if main link don't work -
http://www.greyknight17.com/spy/CleanUp.exe ) and install it. Don't run it yet.
Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.
CleanUp! deletes EVERYTHING out of your temp/temporary folders. It does not make backups. If you have any documents or programs that are saved in any Temporary Folders, make a backup of these before running CleanUp!. Run CleanUp! and click on the CleanUp! button. Let it run. After it's done, click the Close button and choose Yes to logoff.
Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
O4 - HKLM\..\Run: [Manager 006] C:\WINNT\svchost.exe
O4 - HKLM\..\RunServices: [Manager 006] C:\WINNT\svchost.exe
O4 - HKLM\..\RunOnce: [Manager 006] C:\WINNT\svchost.exe
O4 - HKLM\..\RunServicesOnce: [Manager 006] C:\WINNT\svchost.exe
O4 - HKCU\..\Run: [Manager 006] C:\WINNT\svchost.exe
O4 - HKCU\..\RunOnce: [Manager 006] C:\WINNT\svchost.exe
Delete this:
C:\WINNT\svchost.exe - only delete it in this folder
Run the smitRem.exe tool you downloaded earlier. There should be a folder called smitrem created on your desktop. Open it and double click on the RunThis file. Follow the prompts on the screen. Wait for the tool to complete and disk cleanup to finish.
The tool will create a log named smitfiles.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Post that log along with all others requested in your next reply.
Open Ad-aware and do a full scan. Remove all it finds.
Run Ewido now:
* Click on scanner and then Settings. Under 'What to scan' select 'Scan every file' and hit OK.
* Click on 'Complete System Scan' and the scan will begin.
* While the scan is in progress you will be prompted to clean the first infected file it finds. Choose 'Remove', then put a check next to 'Perform action with all infections' in the left corner of the box so you don't have to sit and watch Ewido the whole time. Click OK.
* Once the scan has completed, there will be a button located on the bottom of the screen named 'Save report'.
* Click 'Save report'. Save it to your desktop.
Right click on your desktop and go to Properties. Then go to the Desktop tab and click on Customize Desktop. Go to the Web tab and delete everything there except My Current Home Page (which should be unchecked). Click OK.
Restart your computer to get back to Normal Mode.
Perform an online scan with Internet Explorer at Panda ActiveScan
http://www.pandasoftware.com/products/activescan.htm
* Click on 'Scan your PC' button. There should be a popup - if you have a pop-up blocker, make sure it's not blocking it.
* Click 'Check Now' & a pop-up window will appear.
* Enter your Country, State and E-mail Address & click 'Scan Now' - begin downloading Panda's ActiveX controls (8 MB size).
* Begin the scan by selecting My Computer.
* If it finds any malware, it will offer you a report. Ignore any entry it finds (since it wants you to buy the program for removal) as we will address this later.
* Click on see report. Then click Save report.
* Post that log in your next reply.
Then post the Panda log here along with the logs for smitfiles.txt, Ewido and a new HijackThis log.