Hello and welcome to TSF. I apologize for the delay, we have been very busy lately. I assure you it is not becauese you gave too much detail
I recommend you Subscribe to this thread so you are notified of any replies via email. To do this click
Thread Tools, then click
Subscribe to this Thread. Make sure it is set to
Instant Notification, then click
Subscribe.
Please print out or copy this page to
Notepad in order to assist you when carrying out the following instructions.
Downloads(make sure to save these in a permanent location)
Cleanup!- Install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does not make backups.
Ewido Anti-Malware- Install Ewido Anti-Malware
- Double-click the icon on Desktop to launch Ewido
You will need to update Ewido to the latest definition files.
- On the top of the main screen click Shield
- Click the word active to change it to inactive
- On the top of the main screen click Update.
- Then click on Start Update. The update will start and a progress bar will show the updates being installed.
- I also recommend changing the "Update interval" to something more reasonable like 12 hours.
If you are having problems with the updater, you can use this link to
manually update Ewido
When you have finished updating,
EXIT Ewido.
win32delfkil.exe-Save it on your desktop.
- Double click on win32delfkil.exe and install it. This creates a new folder on your desktop called win32delfkil.
- Close all windows and open the win32delfkil folder and double click on fix.bat.
- Once the tool has finished the computer will reboot automatically. If it does not reboot...please do so manually.
- Include the contents of the logfile c:\windelf.txt in your next reply.
Next, please reboot your computer in Safe Mode by doing the following:
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
- Instead of Windows loading as normal, a menu should appear
- Select the first option, to run Windows in Safe Mode.
Add/Remove
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs:
Websearch
WebRebates
Viewpoint
HijackThis!
Open Hijack This and click on Scan. Check the following entries
(make sure you do not miss any)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {249e2583-6642-4987-a6c5-f8254fd248b4} - C:\WINDOWS\system32\mfcCHE.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: ADefaultSearch Class - {944864A5-3916-46E2-96A9-A2E84F3F1208} - blank (file missing)
O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00309} - C:\WINDOWS\compstuid.dll
O2 - BHO: (no name) - {A4F94C0C-54A7-4DB1-9AF3-B22E63D00310} - C:\WINDOWS\system32\compstuid.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll
O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - blank (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [websearch] javaw -cp "C:\Program Files\websearch\System\Code" Main lp: "C:\Program Files\websearch"
O4 - HKLM\..\Run: [WebRebates] wjview /cp:p "C:\Program Files\websearch\System\Code" Main lp: "C:\Program Files\websearch
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [p2pnetworking] p2pnetworking.exe
O4 - HKLM\..\Run: [monitor1a] C:\Windows\monitor1a.exe
O4 - HKCU\..\Run: [clc] C:\WINDOWS\system32\clc.exe
O4 - HKCU\..\Run: [5e69735e.exe] C:\Documents and Settings\Sonia\Local Settings\Application Data\5e69735e.exe
O18 - Filter: application/x-bt2 - {6E1DDCE8-76BC-4390-9488-806E8FB1AD77} - blank
O20 - Winlogon Notify: cfgmngr32 - C:\WINDOWS\g29394086.dll
O20 - Winlogon Notify: mfcCHE - C:\WINDOWS\SYSTEM32\mfcCHE.dll
O20 - Winlogon Notify: winbae32 - winbae32.dll (file missing)
Please remember to close all other windows, including browsers then click Fix checked.
File and Folder Deletions
Delete the following Files indicated in
RED and Folders indicated in
BLUE if they still exist.
p2pnetworking.exe <Find via Start>Search
C:\Windows\monitor1a.exe
C:\WINDOWS\g29394086.dll
C:\WINDOWS\system32\5e69735e.exe
C:\WINDOWS\system32\clc.exe
C:\WINDOWS\system32\mfcCHE.dll
C:\Documents and Settings\Sonia\Local Settings\Application Data\5e69735e.exe
C:\Program Files\Viewpoint
C:\Program Files\websearch
Tools
Open
Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "
Options..."
*Move the arrow down to "
Custom CleanUp!"
*Put a check next to the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- Cleanup! All Users
- Click on the "Temporary Files" and uncheck the box for "Scan drives for file matching" if it’s checked.
Click
OK
Press the
CleanUp! button to start the program. If prompted to reboot, click No.
Run
Ewido with it's updated definitions:(...it's important that all windows must be closed)
- Click Scanner
- Click on the Scan tab
- Click Complete System Scan to begin scanning.
- When the scan is complete click Recommended Action and change it to Quarantine
- Then click Apply all actions
Once finished, click the
Save report button, then click
Save Report As and save it to your desktop.
Reboot your system in Normal Mode.
Online Scans
Perform an online scan with Internet Explorer with
Panda ActiveScan
**
click on "Free use ActiveScan" located on the top right hand corner- Click Scan your PC & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
- Click Scan Now
- Enter your e-mail address & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls
Begin the scan by selecting
My Computer- If it finds any malware, it may ask you to purchase the program, this is not necessary we will take care of the entries manually.
- At the end of the scan click on see report. Then click Save report
Please post that log in your next reply.
In your next post please include:
- C:\Windelf.txt
- Ewido Log
- Panda Activescan Log
- A new Hijackthis! Log