You have some work ahead of you, but we should be able to get you clean
Download and save to a folder
Cleanall.zip
Unzip the contents so you now have fixdisply.reg>>remove.bat>>cwserviceremove.reg in the same folder
We'll need these later
[attachment=167:attachment]
Download and save to a folder CWShredder.exe from my signature below
==Download and Unzip to a folder
Hoster.zipWe'll need this later
===Download to a folder
About:Buster.zipby RubbeR Ducky
Unzip the contents, another folder will be placed inside
Open it and run About:buster.exe
Click the Update Button and check for updates, if any, download them
Then close it for now, we'll need this later
====Download the
Pocket KillboxUNZIP it to a folder of your choice
Save the rest of these instructions too a Notepad file and then disconnect from the Internet>>It's best to save this too notepad as I need you too copy and paste some directions
Close All browser windows, including this one
In SAFE MODE
Go to START>>>RUN>>>type in
services.msc and hit Enter
In the next window, look on the right hand side for this service
name----
System Startup Service Double click on it--- STOP the service--If running
In the drop down menu, change the startup type to
DisabledDo the same for this service name
Network Security ServiceNavigate to About:buster you unzipped and updated earlier
==Start About:Buster and hit ok. Now for the scanning part. Hit Start and then Ok. The program should start scanning.Scan a Second time. Save the log... Then hit exit
You may have to scan more than twice, try 3 or 4 times until no files or Data Streams are found
==Double click on
cwserviceremove.reg you unzipped earlier
and allow to merge to the registry when prompted
Run Pocket KillBox>>Now killbox and this notepad file is open
In the
Full Path of File to Delete box, copy and paste the entire line directly below in
bold, do not type this in
C:\WINDOWS\d3az32.exeSelect the radio button to
Delete on RebootClick The Red circle and a white X
When prompted to Delete on Reboot, click YES
If prompted to Reboot Now, Click NO
Do the same for these paths to the file names
c:\windows\system32\juxtyn.exe
C:\WINDOWS\System32\spoolsrv32.exe
C:\WINDOWS\ipsm.exe
C:\WINDOWS\MURPZX.EXE
C:\WINDOWS\System32\CCEUOVX.EXE
C:\WINDOWS\System32\INIT32M.EXE
C:\WINDOWS\System32\VXGAME3.EXE
C:\WINDOWS\NAIL.EXE
C:\WINDOWS\SSK_B5.EXE
C:\WINDOWS\SVCPROC.EXE
C:\WINDOWS\SYJLIO~1.EXE
C:\WINDOWS\SASENT.DLL
C:\WINDOWS\SASETUP.DLL
C:\WINDOWS\System32\Q17I9A4J.EXE
C:\WINDOWS\System32\70TOVMTO.INI
C:\WINDOWS\System32\AP9H4QMO.INI
C:\WINDOWS\System32\Q17I9A4J.INI
C:\WINDOWS\System32\DRPMON.DLLAllow the computer to Reboot
or Restart anyways when you've entered the last full path to the file name
(Make sure you enter them all)
Can you please restart back to Safe mode
Don't worry about any file not found error messages if prompted
Find and delete this folder if it exists
C:\Windows\SYSTEM32\
cache32_rtneg <-this folder
Go to START>>RUN>>type in
cmdHit OK
At the command prompt
type in the following>>(Enter) indicates hitting the Enter key on your keyboard
cd C:\Windows (Enter) <-notice single space after cd
nail.exe /FullRemove (Enter) <-space after exe
exit (enter)
After doing the above
Double click on
remove.bat You unzipped earlier
A dos window will open and close, this is normal
Double click on
fixdsply.reg Allow to merge to the registry at the prompt
Do another scan with Hijackthis and put a check next to these entries:
Not all may exist, but take a look
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe
O4 - HKLM\..\Run: [d3az32.exe] C:\WINDOWS\d3az32.exe
O4 - HKLM\..\Run: [epdzfb] c:\windows\system32\juxtyn.exe
O4 - HKLM\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O4 - HKCU\..\RunOnce: [Srv32 spool service] C:\WINDOWS\System32\spoolsrv32.exe
O15 - Trusted IP range: 66.197.161.149
O23 - Service: Network Security Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\ipsm.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exeAfter you have ticked the above entries, close
All other open windows, including this one
Leave Hijackthis open and click FIX CHECKED
OK the prompt and exit Hijackthis
Open Windows CleanUp!>>START>>programs>>Cleanup!
Click on the CleanUp button, let it finish scanning for files, when it's done
Don't log off yet
==Open Hoster you unzipped earlier
Click the "Restore Original Hosts" button
==Run CWShredder.exe
Click the FIX button, let it fix what it finds
Afterwards
Restart back to Normal mode
Do the following
1. Open the Control Panel.
2. Open Display Properties.
3. Click the Desktop tab.
4. Click the Customize Desktop button.
5. Click the Web tab in the Desktop Items window.
6. Make sure all checkboxes in this window are un-checked.
OK your way out
Log off your user account and log back on again if anything was unchecked
Post back a fresh hijackthis log>>try to post one in Normal mode
Also run FindIt's.bat again and post the log
We'll still have some cleaning to do, but this is a good start
http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'
\' />
Please do as much of the above as you can before posting back as I may not see your updated logs until I get off work tomorrow
