Hello and Welcome CrazyNiNe!

Please print these instructions out for use in Safe Mode.

Please allow this script to run if you receive pop-up asking you if you want to allow this script to run.

Please download VundoFix.exe from http://www.atribune.org/downloads/VundoFix.exe to your desktop.
 Double-click VundoFix.exe to extract the files
 This will create a VundoFix folder on your desktop.
 After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
 Once in safe mode open the VundoFix folder and doubleclick on KillVundo.bat
 You will first be presented with a warning and a list of forums to seek help at.
it should look like this

VundoFix V2.1 by Atri
By pressing enter you agree that you are using this at your own risk
Please seek assistance at one of the following forums:
http://www.atribune.org/forums
http://www.247fixes.com/forums
http://www.geekstogo.com/forum
http://forums.net-integration.net
 At this point press enter one time.
 Next you will see:
Type in the filepath as instructed by the forum staff
Then Press Enter, Then F6, Then Enter Again to continue with the fix.
 At this point please type the following file path (make sure to enter it exactly as below!):
C:\WINDOWS\Cursors\abrjava.dll
 Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
 Next you will see:
Please type in the second filepath as instructed by the forum staff
Then Press Enter, Then F6, Then Enter Again to continue with the fix.
 At this point please type the following file path (make sure to enter it exactly as below!):
C:\WINDOWS\Cursors\avajrba.*
 Press Enter, then press the F6 key, then press Enter one more time to continue with the fix.
 The fix will run then HijackThis will open.
 In HijackThis, please place a check next to the following items and click FIX CHECKED:
-

O4 - HKLM\..\RunOnce: [InstallShieldSetup] C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\8\INTEL3~1\IDriver.exe /reboot{2E4E8905-5F24-4AEA-84E2-923CC12E3AB1} /z

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://software-dl.real.com/23ec8937d8ea02108a05/netzip/RdxIE601.cab

O20 - Winlogon Notify: abrjava - C:\WINDOWS\Cursors\abrjava.dll

O23 - Service: nirton (mn) - Unknown owner - C:\WINDOWS\System32\IEXPLORER.exe" -service (file missing)

Now, with all windows closed except HiJackThis, click "Fix checked".

 After you have fixed these items, close Hijackthis and Press any key to Force a reboot of your computer.
 Pressing any key will cause a "Blue Screen of Death" this is normal, do not worry!
 Once your machine reboots please continue with the instructions below.
Then, please run this online virus scan from http://www.pandasoftware.com/products/activescan.htm

Copy the results of the ActiveScan and paste them here along with a new HijackThis log and the vundofix.txt file from the vundofix folder.

Hello CrazyNiNe,

Did you run the panda scan? I would like to see the results please.   

Hello CrazyNiNe,

Next, check for, and download any available updates:

1.  click "Check for updates now".
2.  Click "Connect".
3.  If updates(definitions) are available click "Ok", otherwise, click "Ok".
4.  Click "Finish".

Next, configure AdAware to be as effective as possible:

1.  Click the 'gear' in the upper-right hand corner of the AdAware Window.
2.  Click Scanning, and check(tick) the following:

   Scan within archives
   Scan active processes
   Scan registry
   Deep-scan registry
   Scan my IE Favorites for banned URLs
   Scan my Hosts file

3.  Click "Tweak".
4.  Click "Scanning Engine", then check(tick) the following:

   Unload recognized proceses & modules during scan

5.  Click "Cleaning Engine", then check(tick) then following:

   Always try to unload modules before deletion
   During removal, unload Explorer and IE if necessary
   Let Winodws remove files in use at next reboot
   Delete quarantined objects after retoring

6.  Then click "Proceed"

Now, let AdAware locate and remove anything it finds, by:

1.  Click "Start".
2.  Check(tick) "perform full system scan".
3.  Click "Next".

Exit the program.

Next, check for, and download any available updates:

1. Click "Search for Updates".
2. Check(tick) all available updates.
3. Click "Download Updates".
4. Click "Search & Destroy".
5. Click "Check for Problems".

When the scan is completed:

1. Check(tick) everything that was found.
2. Click "Fix selected problems".

Click "Ok", then exit the program.

When running an Ewido scan no windows or programs should be open!. Do not use the Computer while the Ewido scan is running!

Please download the trial version of Ewido Security Suite here:
http://www.ewido.net/en/download/
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu."
Launch ewido, there should be a big "E" icon on your desktop, double-click it.
The program will prompt you to update; click the "OK" button
The program will now go to the main screen
Update ewido:
You will need to update ewido to the latest definition files.
On the left hand side of the main screen click update
Click on Start
The update will start and a progress bar will show the updates being installed. After the updates are installed, exit ewido.
Do NOT run a scan yet.

* Click Complete System Scan and the scan will begin.
* During the scan it will prompt you to clean files, click OK
* When the scan is finished, look at the bottom of the screen and click the Save report button.
* Save the report to your desktop

Close Ewido

Now, with all windows closed except HiJackThis, click "Fix checked".

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.