Hi Vic and Welcome!!
I need you to send me 3 files please!
Make a folder on the Desktop called Files!
Make sure Windows is Showing Hidden Files
http://www.bleepingcomputer.com/forums/ind...torial=62#winxpLocate these 3 Files please
C:\
sys.exeC:\WINDOWS\
vr_sys.dllC:\WINDOWS\System32\
zolk.dllRight Click each File and Select Copy>>Go to the New Folder on the Desktop and open it>>Place the pointer inside it and right click and Select Paste!
Once all three are in there>>Close the folder and then Right Click on it and Select Send to>>Compressed(Zipped)Folder!
Send that Zipped folder to
[email protected]Once I confirm I recieved it,please delete both folders we just created and empty the Recycle bin!
Download Pocket KillBox from here:
http://www.bleepingcomputer.com/files/killbox.phpThere is a Direct Download and a description of what the Program does inside this link.
Download
Ewido Security Suite, install then from within the program check for updates BUT dont scan yet
Ewido Security Suite:
http://www.ewido.net/en/download/When installing, under "
Additional Options" uncheck "
Install background guard" and "Install scan via context menu". When you run ewido for the first time, you will get a warning "
Database could not be found!". Click
OK.
We will fix this in a moment.
From the main Ewido screen,
Click on
Update in the left menu, then click the
Start Update button.
After the Update finishes (the status bar at the bottom will display "
Update successful"), Now close the program.
If you have problems updating see here
http://www.ewido.net/en/download/updates/Be sure Ad Aware is configured as shown in this link
http://www.bleepingcomputer.com/forums/ind...showtutorial=48Download
CleanUp! 4.0http://downloads.stevengould.org/cleanup/CleanUp40.exeReboot into
SAFE MODE(Tap F8 when restarting)
Here is a link on how to boot into Safe Mode:
http://service1.symantec.com/SUPPORT/tsgen...src=sec_doc_namAfter restarting in Safe Mode,
Configure Windows to Show All Hidden Files and Folders,this must be done again after restarting in Safe Mode!!
Here is a link to help with that
http://www.bleepingcomputer.com/forums/ind...torial=62#winxpRight Click the Taskbar near the clock and Select Task Manager
Click Processes and any instances of RunDll32.exe>>Please Right Click or Highlight and Select "End Process"
Exit Task Manager
[color=\"red\"]Remove these Files with Pocket Killbox[/color]
C:\sys.exe
C:\winstall.exe
C:\WINDOWS\vr_sys.dll
C:\Windows\Desktop.html
C:\WINDOWS\System32\Services
C:\WINDOWS\System32\zolk.dll
C:\WINDOWS\System32\win32.exe
C:\Program Files\SpySheriff\SpySheriff.exe
C:\Program Files\SpySheriff
From the Above list,Copy&Paste each entry into Killboxes "Full Path of File to Delete"
As each is pasted in,place a tick by any of these selections available
"Standard File Kill"
"End Explorer Shell while Killing File"
"Unregister .dll before Deleting"
"Deltree(Include Subdirectories)"[color=\"red\"]Click the Red Circle with the White X in the Middle to Delete!![/color]
If any of the entries refuse to delete,keep track of the names,we will remove them before restarting!
Open HijackThis and put a check by these but DO NOT hit the Fix Checked button yet!
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.clicksearchclick.com/index.php?aff=19O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\zolk.dll
O4 - HKLM\..\Run: [Systems Restart] Rundll32.exe zolk.dll, DllRegisterServer
O4 - HKLM\..\Run: [Service Host] C:\WINDOWS\System32\Services\{58E1A6E3-7447-4C06-B2C6-BF61B1F27EAF}\SVCHOST.EXE
O4 - HKLM\..\Run: [Disk Keeper] C:\WINDOWS\System32\Services\{3BB40ACB-5209-4ED7-8F84-799E55BF954F}\SECURITY.EXE
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [wupd] C:\WINDOWS\System32\win32.exe
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe
O16 - DPF: {11010101-1001-1111-1000-110112345678} - ms-its:mhtml:file://C: oo.mht!
http://195.225.177.33//vx//targ.chm::/win32.exeO16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
http://software-dl.real.com/027360aaea8a53...ip/RdxIE601.cabO21 - SSODL: System - {CC4BB2E7-BA35-4BFA-9D1D-6D7CC2C7D272} - vr_sys.dll (file missing)
Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button!!
Scan the System with Ewido>>If it detects an Infection>>Select "Clean" and place a check in the box to "Always use this Action"
Once the Scan is Complete>>Click the tab to Save the Report and place it on your Desktop for easy access!
Now Scan the System with Ad Aware and remove all it finds and delete the Quaratine Files!
Run CleanUp!Click
"Cleanup" and it will Scan and Remove all available Temp files>Click
"Close">Click
"No" to Logoff!
If you have any entries that Killbox couldnt delete,please paste them into Killbox and plac a tick by these selections
"[color=\"red\"]Delete on Reboot[/color]" If more than 1 file
Click
"[color=\"green\"]Yes[/color]" to Confirm
Click
"[color=\"red\"]No[/color]" to Reboot
Once at the last file
Click
"[color=\"green\"]Yes[/color]" to Confirm
Click
"[color=\"green\"]Yes[/color]" to Reboot
[color=\"blue\"]If you get a PendingFileRenameOperations Registry Data has been Removed by External Process! message then just restart manually.[/color]
Restart Normal and have the
PC Scanned here
Panda Active ScanYou will need to be using Internet Explorer for the Scan to work!Save the Report it generates!
Go to Start > Control Panel > Add or Remove Programs and remove the following:
SpySheriff[color=\"red\"]RIGHT-CLICK HERE[/color] and go to Save As (in IE it's "Save Target As") in order to download the smitfraud reg to your desktop.
Double-click
smitfraud.reg on your desktop. When asked if you want to merge with the registry click
YES. After the merged successfully prompt, please reboot your computer.
You should be able to change your desktop back to normal now.
Post back with the Reports from Ewido and Panda along with a fresh HijackThis log!
Once all that is Completed,Please Install one of these Free Antivirus Softwares
AVG
http://www.grisoft.com/doc/1Antivir
http://www.free-av.com/avast! 4 Home Edition
http://www.avast.com/eng/avast_4_home.htmla-squared Free
http://www.emsisoft.com/en/software/free/BitDefender Free Edition v7
http://www.bitdefender.com/bd/site/products.php?p_id=24ClamAV
http://www.clamwin.com/
