Run the installer.
When installing uncheck:
Install background guard
Install scan via context menu
Now open Ewido.
Update the definitons for Ewido.
Now close Ewido for right now.
================
Please download Ad-Aware SE Personal from
this page. Install it and check for updates.
Now download the VX2 Cleaner from
this page. Make sure Ad-Aware SE Personal is closed and install the VX2 Cleaner.
Run Ad-Aware SE Personal.
Click Add-Ons.
Double-click VX2 Cleaner.
Click Ok to Excute this tool.
If nothing is found click Ok and exit the program.
or
If malware is found click Clean System.
When it's done click Start in Ad-Aware SE Personal.
Make sure Perform smart system scan is checked.
Click Next.
Let it clean anything it finds.
=================
Go to
Add/Remove programs and remove(uninstall) the following, if present:
InstaFinder MyWebSearch WildTangent
==================
Open the DSRFix folder on your Desktop. Double click dsrfix.bat to run the program. A DOS window should open and close quickly, this is normal. Once the fix has completed the tool will close on its own.
===================
Run
HiJackThis and click "
Scan", then check(tick) the following, if present:
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present ...
(Unless you've set these with a anti-spyware program like SpyBot'sImmunize feature, have HiJackThis fix this.)
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm799BOUS
Run Ewido. Click on scanner. (Whilst the Ewido scan is running you must not do anything on your computer, including opening any windows/browsers or control panels) Click Complete System Scan. If you get a prompt asking to clean files then click OK. When it cleans the first file put a check by Perform action on all infections and then choose clean and click OK. Once the scan is done choose Save Report and save it your desktop. Close Ewido.
==================
Run Ad-Aware SE Personal. Click Start in Ad-Aware SE Personal. Make sure Perform smart system scan is checked. Click Next. Let it clean anything it finds.
==================
Now reboot back into normal mode and post a new HijackThis log along with the Ewido log. :)
P3-450
35 Posts
0
September 1st, 2005 23:00
You may want to print the below or copy it to Notepad as you will be going into safe mode without internet access.
===============
Please download DSRFix. Extract the files to your Desktop. Don't run anything in the folder yet.
================
Please download Ewido Security Suite.
Run the installer.
When installing uncheck:
Install background guard
Install scan via context menu
Now open Ewido.
Update the definitons for Ewido.
Now close Ewido for right now.
================
Please download Ad-Aware SE Personal from this page. Install it and check for updates.
Now download the VX2 Cleaner from this page. Make sure Ad-Aware SE Personal is closed and install the VX2 Cleaner.
Run Ad-Aware SE Personal.
Click Add-Ons.
Double-click VX2 Cleaner.
Click Ok to Excute this tool.
If nothing is found click Ok and exit the program.
or
If malware is found click Clean System.
When it's done click Start in Ad-Aware SE Personal.
Make sure Perform smart system scan is checked.
Click Next.
Let it clean anything it finds.
=================
Go to Add/Remove programs and remove(uninstall) the following, if present:
InstaFinder
MyWebSearch
WildTangent
==================
Open the DSRFix folder on your Desktop. Double click dsrfix.bat to run the program. A DOS window should open and close quickly, this is normal. Once the fix has completed the tool will close on its own.
===================
Run HiJackThis and click " Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = websearch.drsnsrch.com/q.cgi?q=
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll
O2 - BHO: BolgerObj Class - {302A3240-4805-4a34-97D7-1645A0B08410} - C:\WINDOWS\Bolger.dll
O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL
O2 - BHO: NLS UrlCatcher Class - {AEECBFDA-12FA-4881-BDCE-8C3E1CE4B344} - C:\WINDOWS\system32\nvms.dll
O2 - BHO: CB UrlCatcher Class - {CE188402-6EE7-4022-8868-AB25173A3E14} - C:\WINDOWS\system32\mscb.dll
O2 - BHO: CSBHO Class - {D14D6793-9B65-11D3-80B6-00500487BDBA} - C:\PROGRA~1\Comet\Bin\csbho.dll
O2 - BHO: (no name) - {D714A94F-123A-45CC-8F03-040BCAF82AD6} - C:\WINDOWS\Downloaded Program Files\SbCIe02a.dll
O3 - Toolbar: Comet Toolbar - {FE6BC4EF-5676-484B-88AE-883323913256} - C:\PROGRA~1\Comet\Bin\csietb.dll
O3 - Toolbar: (no name) - {52FE5233-367C-4EFB-BDD7-0BE4D212C107} - (no file)
O4 - HKLM\..\Run: RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: "C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0803NetInstaller.exe"
O4 - HKLM\..\Run: c:\windows\system32\utxjio.exe r
O4 - HKLM\..\Run: c:\windows\system32\kjgauog.exe r
O4 - HKLM\..\RunServices: xmconfig.exe
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
... (Unless you've set these with a anti-spyware program like SpyBot's Immunize feature, have HiJackThis fix this.)
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm799BOUS
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/SmileyCentralFWBInitialSetup1.0.0.8-2.cab
O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F98} (CR64Loader Object) - http://www.miniclip.com/puzzlepirates/miniclipGameLoader.dll
O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe
Now, with all windows closed except HiJackThis, click " Fix checked".
==================
Next, please reboot your computer in SafeMode by doing the following:
=================
Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
folders...
C:\Program Files\winupdates
C:\PROGRA~1\INSTAF~1
C:\PROGRA~1\Comet
C:\Program Files\WildTangent
files...
C:\WINDOWS\wupdt.exe
C:\WINDOWS\dinst.exe
C:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0803NetInstaller.exe
c:\windows\system32\utxjio.exe
C:\WINDOWS\Nail.exe
C:\WINDOWS\dsr.dll
C:\WINDOWS\Bolger.dll
C:\WINDOWS\system32\nvms.dll
C:\WINDOWS\system32\mscb.dll
c:\windows\system32\kjgauog.exe
C:\WINDOWS\svcproc.exe
Search for...
xmconfig.exe
...using " Start | Search...".
=================
Run Ewido.
Click on scanner. (Whilst the Ewido scan is running you must not do anything on your computer, including opening any windows/browsers or control panels)
Click Complete System Scan.
If you get a prompt asking to clean files then click OK.
When it cleans the first file put a check by Perform action on all infections and then choose clean and click OK.
Once the scan is done choose Save Report and save it your desktop.
Close Ewido.
==================
Run Ad-Aware SE Personal.
Click Start in Ad-Aware SE Personal.
Make sure Perform smart system scan is checked.
Click Next.
Let it clean anything it finds.
==================
Now reboot back into normal mode and post a new HijackThis log along with the Ewido log. :)