TexRanger

Hello hanoihancock,

Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER.

Please also note that it is very important that you follow all of the steps below, and on each post I make. We'll get through this infection, but I'll need you to stay with me and make sure to keep checking if I've posted. Only when it's time will we consider this issue resolved. Thanks!
=============================

Clear your IE Cookies and Cache

* Launch Internet Explorer
* Click Tools
* Click Internet Options
* Delete Cookies
=============================

Reboot your system in Safe Mode (By repeatedly tapping the F8 key until the menu appears).

Go to Start > Run and type: regsvr32 /u occache.dll and click OK.

Delete the following files:

C:\windows\downloaded program files\gdnUS2338.exe
C:\Documents and Settings\Owner\Local Settings\Application Data\f06ff1b7.exe
C:\WINDOWS\system32\f06ff1b7.exe

Go to Start > Run and type: regsvr32 occache.dll and click OK.

Reboot your system in Normal Mode.
=============================

It looks like your uninstall log isn't complete. Please generate another one for me.

* Open HijackThis
* Click on the Configure button on the bottom right
* Click on the tab Misc Tools
* Click on the Box that says Open Uninstall Manager
* Click on the button Save list

Please save a copy and paste the contents with your next reply.
=============================

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

Paste the Kaspersky report here together with a new HiJackThis log and a complete uninstall list.