Ok, let's sink our teeth into this.
Please copy this page to
Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out these instructions.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.
***************************************************
Downloads:
Please download
SmitfraudFix (by
S!Ri) and extract the content (a folder named
SmitfraudFix) to your Desktop. Do not run it yet.
Download
combofix **Important** Place combofix on your desktop.**
Download
Ewido anti-spyware from
HERE and save that file to your desktop.
This is a 30 trial of the program- Once you have downloaded Ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program.
- Once the setup is complete you will need run Ewido and update the definition files.
- On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
- Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
- Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
- Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"
Close Ewido anti-spyware, Do Not run a scan just yet, we will shortly.
Download and install CleanUp! but
do not run it yet. (Not Recommended for XP64).
*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.
Finally, using Internet Explorer, download
ResetTeaTimer.bat.
If you are using Firefox, right click the above link and choose ‘Save As’. Save it to your desktop.
Double click
ResetTeaTimer.bat to remove all entries set by TeaTimer.
***************************************************
Open this folder program files >
haxfix and double click on
fix.bat (or double click on
fix.bat desktop icon)
- Close all other open windows since this step requires a reboot
- Select option 2. Run auto fix by typing 2 and then pressing "Enter"
If an infection is found, you'll get a message to close all other open windows.
- Close all open windows except the red dos window from haxfix and then press "Enter"
- The computer will reboot
- After reboot a logfile will open > (c:\haxfix.txt)
- Post the contents of that logfile in your next reply.
-----------------------------------
Go to
<<Start>> then
<<Run>> then
paste in the
single line command then click
OK
"%userprofile%\desktop\combofix.exe" /v d3dishsv wmneprfl dxmamcia
When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
-----------------------------------
Please reboot your computer in
Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5)
Login with your usual account. Make sure to close any open browsers.
-----------------------------------
Open HijackThis and click on 'Do a System Scan Only'. Check the following entries if they exist:
O4 - HKLM\..\Run: [Upnp] c:\dolhv.exe
O4 - HKLM\..\Run: [uhvjsul.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\uhvjsul.dll,mrpmvyf
O4 - HKCU\..\Run: [adobemgr] C:\WINDOWS\system32\adobemgr.exe
O20 - AppInit_DLLs: , d3dishsv.dll wmneprfl.dll
O20 - Winlogon Notify: dxmamcia - C:\WINDOWS\system32\dxmamcia.dll
O20 - Winlogon Notify: winbjt32 - winbjt32.dll (file missing)
O20 - Winlogon Notify: wnmicf - C:\WINDOWS\SYSTEM32\wnmicf.dll
Click
'Fix Checked' and close HijackThis.
-----------------------------------
Go to
My Computer->
Tools->
Folder Options->
View tab:
* Under the Hidden files and folders heading:
*
select Show hidden files and folders.
*
Uncheck Hide protected operating system files (recommended) option.
*Also, make sure there is no checkmark beside
Hide file extensions for known file types.
* Click OK.
-----------------------------------
Delete the following
Files if they still exist.
c:\dolhv.exe
C:\WINDOWS\system32\uhvjsul.dll
C:\WINDOWS\system32\adobemgr.exe
-----------------------------------
Open the SmitfraudFix Folder, then double-click
smitfraudfix.cmd file to start the tool.
Select option
#2 - Clean by typing
2 and press
Enter.
Wait for the tool to complete and disk cleanup to finish.
You will be prompted : "
Registry cleaning - Do you want to clean the registry?" answer
Yes by typing
Y and hit
Enter.
The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer
Yes to the question "
Replace infected file?" by typing
Y and hit
Enter.
A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.
Reboot in Safe Mode.
The tool will create a log named
rapport.txt in the root of your drive, eg: Local Disk C:
(C:rapport.txt) or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
Clean out your
Temporary Internet files.
*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! or move them to a permanent location.
Open
Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "
Options..."
*Move the arrow down to "
Custom CleanUp!"
*Put a check next to the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- Cleanup! All Users
- Click on the "Temporary Files" and uncheck the box for "Scan drives for file matching" if it's checked.
Click
OK
Press the
CleanUp! button to start the program.
Do NOT reboot/logoff when prompted.
--------------------------------------------------------------------------
Next go to Control Panel click Display>Desktop>Customize Desktop>Web> Now,
Uncheck Everything and
delete if present:
· "Security Info"
· "Warning Message"
· "Security Desktop"
· "Warning Homepage"
· "Desktop Uninstall"
Also make sure the
'Lock desktop items' box is
unticked. Click OK, and then Click Apply, then OK.
______________________________
IMPORTANT: Do not open any other windows or programs while Ewido is scanning, it may interfere with the scanning proccess:
- Lauch Ewido-anti-spyware by double-clicking the icon on your desktop.
- Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
- Ewido will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
- If you have any infections you will prompted, then select "Apply all actions"
- Next select the "Reports" icon at the top.
- Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
- Close ewido and reboot your system back into Normal Mode.
**Ewido is compatible with most AV and anti-spyware products, and the free version will continue to be useful as a second anti-malware scanner.
______________________________
Open the SmitfraudFix folder and double-click
smitfraudfix.cmd
Select option
#3 - Delete Trusted zone by typing
3 and press
Enter. Answer
Yes to the question "Restore Trusted Zone ?" by typing
Y and hit
Enter.
Note, if you use
SpywareBlaster and/or
IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
______________________________
Once you reboot......
Perform an online scan with Internet Explorer with
Panda ActiveScan
**
click on "Free use ActiveScan" located on the top right hand corner- Click Check Now & a 'pop up' window shall appear. *ensure that your pop up blocker doesn't block it
- Enter your e-mail address, country, and state & click Scan Now ...begins downloading 8 MB Panda's ActiveX controls
Begin the scan by selecting
My Computer- If it finds any malware, it will offer you a report.
- Please ignore any entry it finds and wants you to buy the program for removal as we will address this later.
- Click on see report. Then click Save report
-----------------------------------
Run a new HijackThis scan. Save the log file and post it here.
Then post the following logs in your next reply...
haxfix.txt
Ewido log
C:\rapport.txt (log from the tool)
Panda log
ComboFix.txt
NewHijackthis log