==First could you download and save to Desktop CWShredder.exe from my signature below
Don't run it yet
===Download to desktop
About:Buster.zipby RubbeR Ducky
Unzip the contents to desktop, a folder will be placed on your desktop
Open it and run About:buster.exe
Click the Update Button and check for updates, if any, download them
Then close it for now, we'll need this later
===Download and UNZIP to desktop Cwsserviceremove.zip
So you have cwsserviceremove.reg on the desktop
Cwsserviceremove.zip==Download and Install this small program
to help clean your temp folders,cookies, etc...
Windows CleanupInstall for now, don't run a scan yet
===Could you next
Set Windows To Show Hidden Files and Folders
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select Show hidden files and folders.
* Uncheck the Hide protected operating system files (recommended) option.
* Uncheck the Hide Extensions for known file types
* Click Yes to confirm.
* Click OK.
Please Print this out or save these instructions to a Notepad file and save it to your Desktop for easy access
RESTART your Computer in SAFE MODE
You can do this by tapping the F8 key as the computer is restarting
Next: Go to START>>>RUN>>>type in
services.msc and hit Enter
In the next window, look on the right hand side for this service
name----
Remote Procedure Call (RPC) Helper <--there are other similiar names, disable just this one
Double click on it--- STOP the service-- if still running
In the drop down menu, change the startup type to
Disabled===Stay in safe mode and navigate to these files or folders and delete them if they exist
C:\WINNT\system32\
crma32.exe <-file
C:\WINNT\system32\
crkq32.exeC:\WINNT\system32\
javasl.exeC:\WINNT\
mshq.exeC:\WINNT\
ietb32.dllC:\Program Files\Internet Explorer\
gvspbfrq.exeIn safe mode
Do another Scan with Hijackthis and put a check next to these entries
Not all may be found, but fix what you find
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINNT\system32\scelw.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {6C378F73-1455-6A50-CB91-5DB0EE461C88} - C:\WINNT\ietb32.dll
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [crkq32.exe] C:\WINNT\system32\crkq32.exe
O4 - HKLM\..\RunOnce: [atlwo32.exe] C:\WINNT\atlwo32.exe
O4 - HKLM\..\RunOnce: [javasl.exe] C:\WINNT\system32\javasl.exe
O4 - HKLM\..\RunOnce: [mshq.exe] C:\WINNT\mshq.exe
O4 - HKLM\..\RunOnce: [ea_cleanup] C:\DOCUME~1\Jeremy\LOCALS~1\Temp\ea_cleanup.exe /cleanup
O16 - DPF: {10000000-1000-0000-1000-000000000000} - file://C:\Program Files\Internet Explorer\gvspbfrq.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINNT\system32\crma32.exe (file missing)After you have ticked the above entries, close
All other open windows,
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis
Navigate to About:buster you unzipped and updated earlier
===Start About:Buster and hit ok. Now for the scanning part. Hit Start and then Ok. The program should start scanning.Scan a Second time. Save the log... Then hit exit
You may have to scan more than twice, try 3 or 4 times until no files or Data Streams are found
===Double click on
cwsserviceremove.reg and allow it to merge to the registry
===Open Windows CleanUp!>>START>>programs>>Cleanup!
Click on the CleanUp button, let it finish scanning for files, when it's done
Don't log off or restart yet
===Run CWShredder.exe, click the FIX button and let it fix what it finds
===RESTART back in Normal mode
===Look for a file called
shell.dll in your C:\WINNT\system32 folder
If it is not there, Go into System32\dllcache folder
Find shell.dll
Right click on shell.dll and choose copy from the menu. Then paste it into the
system32 folder
===Don't open a browser yet, instead access Internet Options via Control Panel
Under the Programs tab "Reset Web Settings"
Under the General tab---Reset home page
=== Under the Security tab | Custom Level
Check ActiveX security settings:
Make sure that the following settings are correct:
o Download signed ActiveX controls (Prompt)
o Download unsigned ActiveX controls (Disable)
o Initialize and script ActiveX controls not marked as safe (Disable)
o Run ActiveX controls and plug-ins (Enabled)
o Script ActiveX controls marked safe for scripting (Prompt)
===Download and Install the free version of
Ad-Aware SE Personal 1.05Ensure you have this version or the paid version
Open Ad-Aware, ensure to click the
check for updates now link and
Connect to download the latest updates
Perform a Full system scan
When it's finished scanning
At this point you should either right click on the screen and and choose the "Select All" Objects option or individually put a checkmark in each objects checkbox
click on the Next button. Ad-Aware SE will now present you with a confirmation box as to whether or not you would like to remove the objects you have just selected. Press the "OK" button
RESTART your computer to finish the cleaning process
==I don't see any Anti-Virus software running on your computer, this is not safe
If you have your own and I'm mistaken, coud you enable it now and check for updates and run a full system scan
If you don't have your own and need a free solution
Download and Install the Free version of AVG 7
from the link below
http://free.grisoft.com/doc/2/lng/us/tpl/v5Scroll down and click on the link
AVG Free Edition installation files
File Version
avg70free_308a468.exe <-Click here
Save the installer to desktop
Double click to install and follow the prompts
After installation, restart the computer if prompted
Check for updates with AVG and run a Full system scan afterwards
Let it fix whatever it finds
Afterwards, restart the computer again
==Post back a fresh Hijackthis log
Also the logs from About:Buster
===Open Hijackthis>>Open Misc tools section>>Open Hosts file manager
Click the "Open in Notepad"
Copy and paste back the whole contents of this notepad file too
Could you also let me know if you have Spybot 1.3 installed
I'm just checking
