Hello and welcome to TSF
You may wish to
Subscribe to this thread (Thread Tools) so that you are alerted when you receive a reply.
Please print out or copy this page to
Notepad in order to assist you when carrying out the following instructions.
--------------
FYI
Do you run AOL Antivirus in conjunction with McAfee Antivirus? If so, you should disable one of them because running two AVs together can cause system instability in itself.
----------------
HJT IN TEMPORARY FOLDER
You are running Hijack This from a temporary directory. It needs to be in a permanent folder. Please go into Windows Explorer, click on C: then click on File > New > Folder and call it
HJT , or another name of your choice. The program creates backup files that we may need to use later. If the program is in a Temporary folder, files may be deleted by you or automatically if your system is set to empty temp files.
-----------------
Go to
My Computer >Tools >Folder Options >View tab and
select Show hidden files and folders.
Uncheck the Hide protected operating system files (recommended) option. Also make sure there is no checkmark beside
Hide file extensions for known file types. Click OK.
------------------
DOWNLOADS
Download and install
CleanUp! but
do not run it yet.
*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.
-----------------
Download
Ewido Anti-Malware- Install Ewido Anti-Malware
- Double-click the icon on Desktop to launch Ewido
You will need to update Ewido to the latest definition files.
- On the top of the main screen click Shield
- Click the word active to change it to inactive
- On the top of the main screen click Update.
- Then click on Start Update. The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to
manually update Ewido- Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
- Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
- Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"
When you have finished updating,
EXIT Ewido anti-spyware. Do Not run a scan just yet, we will shortly.
----------------
SAFE MODE
Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work. Login on your usual account. Make sure to close any open browsers.
----------------
ADD/REMOVE PROGRAMS
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if they exist):
AWS
-----------------
FIXES WITH HIJACK THIS
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries
(make sure you do not miss any)
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O20 - Winlogon Notify: rendpa - rendpa.dll (file missing)
Please remember to close all other windows, including browsers then click Fix checked.
----------------
FILE DELETIONS
Delete the following Files indicated in
RED and Folders indicated in
BLUE if they still exist.
C:\Program Files\AWS
---------------
CLEANUP!
Open
Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "
Options..."
*Move the arrow down to "
Custom CleanUp!"
*Put a check next to the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- Cleanup! All Users
- Click on the “Temporary Files” and uncheck the box for “Scan drives for file matching” if it’s checked.
Click
OK
Press the
CleanUp! button to start the program.
DO NOT reboot/logoff when prompted.
-----------------
EWIDO
Run
Ewido with it's updated definitions:(...it's important that all windows must be closed)
- Click Scanner
- Click on the Scan tab
- Click Complete System Scan to begin scanning.
Once the scan is complete do the following:
- If you have any infections you will prompted, then select "Apply all actions"
- Once finished, click the Save report button, then click Save Report As and save it to your desktop. (make sure to remember where you saved that file, this is important).
Restart in normal mode.
------------------
ONLINE SCAN
Perform an online scan with Internet Explorer with
Panda ActiveScan
Click on the "Free To Use ActiveScan" located on the top right hand corner- Click Check Now and a "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
- Enter your e-mail address, country, and state & click Scan Now * The download of the 8 MB Panda's ActiveX control will take place *
Begin the scan by selecting
My Computer- If it finds any malware, it will offer you a report.
- Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
- Click on See report then click Save report
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan
Paste the
Panda Scan report here together with a new
HiJackThis log and
Ewido's log.
----------------