Please help somebody..i'm desparate!
- Status
1 - 3 of 3 Posts
4
Hello vineeta29,
Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.
***************************************************
Before we begin, please move HiJackThis to it's own folder, like c:\HJT. While we’re cleaning the rest of your system, various tools used will clean the temp folder which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later.
***************************************************
Please ensure you have Ewido's latest definition files.
-----------------------------------
Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.
-----------------------------------
Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
WinBudget
-----------------------------------
Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries:
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O18 - Protocol: Festoon - (no CLSID) - (no file)
O20 - AppInit_DLLs:
Click 'Fix Checked' and close HijackThis.
-----------------------------------
Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading:
* select Show hidden files and folders.
* Uncheck Hide protected operating system files (recommended) option.
*Also, make sure there is no checkmark beside Hide file extensions for known file types.
* Click OK.
-----------------------------------
Using 'My Computer', navigate to and delete the following Folder if they still exist.
C:\Program Files\WinBudget
-----------------------------------
Launch Ewido and run a system scan:
If you still have CleanUp installed:
*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! or move them to a permanent location.
Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "Options..."
*Move the arrow down to "Custom CleanUp!"
*Put a check next to the following:
Press the CleanUp! button to start the program. Reboot/logoff when prompted.
-----------------------------------
Reboot into Normal Mode.
-----------------------------------
Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:
Perform an online scan with Internet Explorer with Panda ActiveScan
![]()
* Turn off the real time scanner of any existing antivirus program while performing the online scan
-----------------------------------
Run a new scan with HijackThis and save the log.
-----------------------------------
Please include the following in your next reply:
Ewido results
Panda results
New HijackThis log
Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.
***************************************************
Before we begin, please move HiJackThis to it's own folder, like c:\HJT. While we’re cleaning the rest of your system, various tools used will clean the temp folder which, with HiJackThis in it's current location, we'll lose both the program and the backups it creates. These backups are important in case we need to restore any 'fixed' entry(s) later.
***************************************************
Please ensure you have Ewido's latest definition files.
- Launch Ewido:
- On the main screen select the icon "Update" then select the "Update now" link.
- Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
-----------------------------------
Please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Use the up arrow key to highlight Safe Mode and press Enter.
5) Login with your usual account. Make sure to close any open browsers.
-----------------------------------
Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if they exist:
WinBudget
-----------------------------------
Open HijackThis and click on 'Do a System Scan Only'. 'Check' the following entries:
O2 - BHO: BhoApp Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O18 - Protocol: Festoon - (no CLSID) - (no file)
O20 - AppInit_DLLs:
Click 'Fix Checked' and close HijackThis.
-----------------------------------
Go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading:
* select Show hidden files and folders.
* Uncheck Hide protected operating system files (recommended) option.
*Also, make sure there is no checkmark beside Hide file extensions for known file types.
* Click OK.
-----------------------------------
Using 'My Computer', navigate to and delete the following Folder if they still exist.
C:\Program Files\WinBudget
-----------------------------------
Launch Ewido and run a system scan:
- Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
- ewido will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following: - If you have any infections you will prompted, then select "Apply all actions"
- Next select the "Reports" icon at the top.
- Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
- Close ewido.
If you still have CleanUp installed:
*WARNING* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp! or move them to a permanent location.
Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows:
*Click "Options..."
*Move the arrow down to "Custom CleanUp!"
*Put a check next to the following:
- Empty Recycle Bins
- Delete Cookies
- Delete Prefetch files
- Cleanup! All Users
- Click on the "Temporary Files" and uncheck the box for "Scan drives for file matching" if it's checked.
Press the CleanUp! button to start the program. Reboot/logoff when prompted.
-----------------------------------
Reboot into Normal Mode.
-----------------------------------
Please run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:
Perform an online scan with Internet Explorer with Panda ActiveScan
- Click on
located at the bottom of the page.
![]()
- A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
- Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*
- If it finds any malware, it will offer you a report.
- Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
- Click on
then click
![]()
![]()
* Turn off the real time scanner of any existing antivirus program while performing the online scan
-----------------------------------
Run a new scan with HijackThis and save the log.
-----------------------------------
Please include the following in your next reply:
Ewido results
Panda results
New HijackThis log
1 - 3 of 3 Posts
- Status
