adwar.betterinternet and aurora spyware will not clean up

Hi theresarue

You may want to print out these instructions or save them as a text file with Notepad to your desktop because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Read this instructions carefully and feel free to ask if you're unsure about something





Download the trial version of Ewdio Security Suite. Install it, and update the definitions to the newest files. Do NOT run a scan yet.



Download Nailfix. Unzip it to the desktop but please do NOT run it yet.

Please download hoster from here. Unzip it to the desktop but please do NOT run it yet.

Boot into Safe Mode. To do this:

1. Reboot your computer.

2. Tap the F8 button as your computer is booting to bring you to an Advanced Options Menu.

3. Select Safe Mode and press Enter.

start
control panel
add/remove programs

Find and remove these programs (if they are present)

Viewpoint Manager
MyWebSearch

Next, run Ewido

1. Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.
2. If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.
3. When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Next please run HijackThis, click Scan, and check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php
R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O1 - Hosts: 66.38.215.115 kazza.com
O1 - Hosts: 66.38.215.115 www.kazza.com
O1 - Hosts: 66.38.215.115 kaza.com
O1 - Hosts: 66.38.215.115 www.kaza.com
O1 - Hosts: 66.38.215.115 kaaza.comO1 - Hosts: 66.38.215.115 www.kaaza.com
O1 - Hosts: 66.38.215.115 kahza.com
O1 - Hosts: 66.38.215.115 www.kahza.com
O1 - Hosts: 66.38.215.115 edonkey.com
O1 - Hosts: 66.38.215.115 www.edonkey.com
O1 - Hosts: 66.38.215.115 emule.com
O1 - Hosts: 66.38.215.115 www.emule.com
O1 - Hosts: 66.38.215.115 suprnova.com
O1 - Hosts: 66.38.215.115 www.suprnova.com
O1 - Hosts: 64.124.166.37 klite.com
O1 - Hosts: 64.124.166.37 www.klite.com
O1 - Hosts: 64.124.166.37 k-lite.com
O1 - Hosts: 64.124.166.37 www.k-lite.com
O1 - Hosts: 64.124.166.37 kazaalite.com
O1 - Hosts: 64.124.166.37 www.kazzalite.com
O1 - Hosts: 64.124.166.37 kazalite.com
O1 - Hosts: 64.124.166.37 www.kazalite.com
O1 - Hosts: 64.124.166.37 kaazalite.com
O1 - Hosts: 64.124.166.37 www.kaazalite.com
O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
O4 - HKLM\..\Run: [windows] C:\WINDOWS\\\\\\\\\\\\\\
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Donald\LOCALS~1\Temp\sysnet.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [Spooler Subsystem] spoolsub.exe
O4 - HKLM\..\Run: [ProSiteFinder] C:\Program Files\ProSiteFinder\prositefinder.exe
O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe
O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exe
O4 - HKLM\..\Run: [hcxgdll] C:\WINDOWS\hcxgdll.EXE
O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe
O4 - HKLM\..\Run: [4tmf4jgd] C:\WINDOWS\system32\4tmf4jgd.exe
O4 - HKLM\..\Run: [mpoufl] c:\windows\system32\lrmgoaw.exe r
O4 - HKLM\..\RunServices: [Spooler Subsystem] spoolsub.exe
O4 - HKCU\..\Run: [uzrq] C:\PROGRA~1\COMMON~1\uzrq\uzrqm.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} -
http://www.ysbweb.com/ist/softwares/v4.0/ysb_mp3.cab
O16 - DPF: {4D7F48C0-CB49-4EA6-97D4-04F4EACC2F3B} (InstallShield Setup Player 2K2) -
http://www.napster.com/client/setup.exe
O16 - DPF: {972BB342-14A7-4660-83C1-51DDBEE171DB} - http://www.pacimedia.com/install/pcs_0005.exe

Press Fix Checked, HJT will prompt you to confirm if you would like to remove those items, select Yes.

Note: This line may have mutated on you: O4 - HKLM\..\Run: [mpoufl] c:\windows\system32\lrmgoaw.exe r If it isn't in the scan... look for a line that similar... randomly named... with an "r" after the "exe". You will need to fix that line. Write the filename down as well as you will need that later. Don't include the "r" after the "exe".

Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.
Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.

Please delete these folders using Windows Explorer(if present):

C:\WINDOWS\etb
C:\Program Files\Viewpoint\Viewpoint Manager
C:\Program Files\SurfSideKick 3
C:\Program Files\SurfAccuracy
C:\Program Files\ProSiteFinder
C:\Program Files\Media Gateway
C:\PROGRA~1\COMMON~1\uzrq
C:\Program Files\MyWebSearch\bar\2.bin
C:\WINDOWS\\\\\\\\\\\\\\

Please delete these files using Windows Explorer(if present):

C:\WINDOWS\hcxgdll.EXE
C:\WINDOWS\dinst.exe
C:\WINDOWS\system32\4tmf4jgd.exe
C:\WINDOWS\system32\lanbrup.exe
C:\WINDOWS\system32\lrmgoaw.exe
C:\Documents and Settings\Donald\Local Settings\Temp\sysnet.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\tddi.exe
 

Note: Again... this one may have mutated on you: c:\windows\system32\lrmgoaw.exe , if so... use the filename you wrote down earlier in place of this one

 

open Hoster.exe.

Then click on "Restore Original Hosts"

Close program when complete.

Empty Recycle Bin


Reboot and "copy/paste" a new log file into this thread.

Also please describe how your computer behaves at the moment, Thanks.

Hi Theresarue You may want to print out these instructions or save them as a text file with Notepad to your desktop because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Read this instructions carefully and feel free to ask if you're unsure about something  

The first thing you need to do is download CCleaner , do NOT use yet

Boot into Safe Mode. To do this: 1. Reboot your computer. 2. Tap the F8 button as your computer is booting to bring you to an Advanced Options Menu. 3. Select Safe Mode and press Enter.

Once in Safe Mode, please double-click on Nailfix.cmd. Your desktop and icons will disappear and reappear, and a window should open and close very quickly --- this is normal.  

Please go to:

 

• 
  
• start
• 
  
• control panel
• 
  
• add/remove programs

Find and remove these programs (if they are present)

 

prositefinder

MediaGateway

Next, run Ewido

 

1.      Click on the Scanner button in the left menu, then click on Complete System Scan. This scan can take quite a while to run.

2.      If ewido finds anything, it will pop up a notification. We have been finding some cases of false positives with the new version of Ewido, so we need to step through the fixes one-by-one. If Ewido finds something that you KNOW is legitimate (for example, parts of AVG Antivirus, pcAnywhere and the game "Risk" have been flagged), select "none" as the action. DO NOT check "Perform action with all infections". If you are unsure of an entry, select "none" for the time being. I'll see that in the log you will post later and let you know if ewido needs to be run again.

3.      When the scan finishes, click on "Save Report". This will create a text file. Make sure you know where to find this file again.

Next please run HijackThis, click Scan, and check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://searchmiracle.com/sp.php

R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - C:\Program Files\SurfSideKick 3\SskBho.dll (file missing)

R3 - URLSearchHook: (no name) - _{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)

R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe

O2 - BHO: Band Class - {00F1D395-4744-40f0-A611-980F61AE2C59} - C:\WINDOWS\dsr.dll (file missing)

O4 - HKLM\..\Run: [hcxgdll] C:\WINDOWS\hcxgdll.EXE

O4 - HKLM\..\RunServices: [Spooler Subsystem] spoolsub.exe

O4 - HKLM\..\Run: [ProSiteFinder] C:\Program Files\ProSiteFinder\prositefinder.exe

O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exe

O4 - HKLM\..\Run: [Media Gateway] C:\Program Files\Media Gateway\MediaGateway.exe

O4 - HKLM\..\Run: [lanbrup] C:\WINDOWS\system32\lanbrup.exe

O4 - HKLM\..\Run: [Dinst] C:\WINDOWS\dinst.exe

O4 - HKLM\..\Run: [4tmf4jgd] C:\WINDOWS\system32\4tmf4jgd.exe

O4 - HKLM\..\Run: [winsync] C:\WINDOWS\system32\oaablb.exe reg_run

O4 - HKLM\..\Run: [ezuvsf] c:\windows\system32\xfdywfr.exe r

Press Fix Checked, HJT will prompt you to confirm if you would like to remove those items, select Yes.

Note: This line may have mutated on you: O4 - HKLM\..\Run: [ezuvsf] c:\windows\system32\xfdywfr.exe r If it isn't in the scan... look for a line that similar... randomly named... with an "r" after the "exe". You will need to fix that line. Write the filename down as well as you will need that later. Don't include the "r" after the "exe".

Click Start. Open My Computer. Select the Tools menu and clickFolder Options. Select theView Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".

Uncheck the "Hide protected operating system files (recommended)" option.

 Uncheck the "Hide file extensions for known file types" option. Click Yes to confirm. Click OK.

Please delete these files using Windows Explorer(if present):

C:\Program Files\ProSiteFinder\prositefinder.exe

C:\WINDOWS\system32\lanbrup.exe

C:\Program Files\Media Gateway\MediaGateway.exe

C:\WINDOWS\dinst.exe

C:\WINDOWS\system32\4tmf4jgd.exe

C:\WINDOWS\system32\oaablb.exe

c:\windows\system32\xfdywfr.exe

C:\WINDOWS\hcxgdll.EXE

spoolsub.exe

Note: Again... this one may have mutated on you: c:\windows\system32\xfdywfr.exe r , if so... use the filename you wrote down earlier in place of this one, if so... use the filename you wrote down earlier in place of this one

Browse to your C:\Windows\Prefetch folder. Delete all the files in the folder, do not delete the folder itself. Empty your Recycle Bin. Run CCleaner.

Reboot Window normally and post a new HijackThis log along with the log Ewido created.

Thanks   

---

Mat2

 

In Training at Malware Removal University , You too could train to help others

 

Threads will be considered closed 7 days after the last posting.

 

Hi Mat -

 

It took me a few days, but it is much better. I still have the yaplock error but no popups.

 

Here is the latest HJT log, and thanks for your help.

 

Logfile of HijackThis v1.99.1
Scan saved at 9:39:37 PM, on 8/9/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\HJT\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.com/avcenter/fix_homepage
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [LexPPS.exe] C:\WINDOWS\system32\lexpps.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MBp7RTdnO] powinit.exe
O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"
O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE
O4 - Startup: Yaplock.lnk = C:\RECYCLER\S-1-5-21-1100786757-1438306768-2374220816-1009\Dc34.url
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm492YYUS
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://bin.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
O16 - DPF: {A762E064-A885-40E4-AC10-671BB62DC2B2} (OFMailHTMLCtl Class) - http://www.eomniform.com/OF5/nsplugins/OFMailX.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://bin.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
O16 - DPF: {BD8667B7-38D8-4C77-B580-18C3E146372C} (Creative Toolbox Plug-in) - http://ak.imgag.com/imgag/cp/install/Crusher.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\apawsvc.exe (file missing)

 

 

Hi You may want to print out these instructions or save them as a text file with Notepad to your desktop because we will be restarting into Safe Mode later on in the fix and you might not be able to access the Internet. Read this instructions carefully and feel free to ask if you're unsure about something

First thing you need to do is download DSRFix from here : http://www.atribune.org/downloads/dsrfix.zip, Unzip file onto the desktop, DO NOT Use Yet

1. Restart your computer. As your computer restarts, repeatedly press the F8 key on your keyboard until the Windows Advanced Options menu appears.

2. Use the arrow key to select Safe Mode, and then press ENTER.

3. Use an arrow key to select an operating system and press ENTER. 4. When prompted whether you want your Windows to run in safe mode, click Yes.

Start control panel add/remove programs

Find and remove these programs (if they are present)

MyWebSearch

 

Now Double click DSRFix folder, then DSRFix ,It adds other files and reg entries that will be taken care of by the tool.

Next please run HijackThis, click Scan, and check the following:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drsnsrch.com/sidesearch.cgi?id=

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://websearch.drsnsrch.com/sidesearch.cgi?id=

O4 - HKCU\..\Run: [MBp7RTdnO] powinit.exe

O4 - HKCU\..\Run: [CMAPP] "C:\Program Files\CMAPP\Client\cmappclient.exe"

O4 - HKCU\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe

O4 - HKCU\..\Run: [CAS Client] "C:\Program Files\Cas\Client\casclient.exe"

O4 - Startup: MyWebSearch Email Plugin.lnk = C:\Program Files\MyWebSearch\bar\2.bin\MWSOEMON.EXE

O4 - Startup: Yaplock.lnk = C:\RECYCLER\S-1-5-21-1100786757-1438306768-2374220816-1009\Dc34.url

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm492YYUS

O23 - Service: Windows VisFx Components - Unknown owner - C:\WINDOWS\apawsvc.exe (file missing)

 Press Fix Checked, HJT will prompt you to confirm if you would like to remove those items, select Yes.

Click Start. Open My Computer. Select the Tools menu and click Folder Options.

Select the View Tab. Under the Hidden files and folders heading select "Show hidden files and folders".

Uncheck the "Hide protected operating system files (recommended)" option. Uncheck the "Hide file extensions for known file types" option. Click Yes to confirm. Click OK.

Please delete these folders using Windows Explorer(if present):

C:\Program Files\CMAPP

C:\Program Files\SurfSideKick 3

C:\Program Files\Cas

C:\Program Files\MyWebSearch\

 Please delete these files using Windows Explorer(if present):

C:\WINDOWS\apawsvc.exe
powinit.exe

Reboot Windows pack into normal mode, then run HJT and do another log, post back here, Thanks :smileyhappy:

 

---

Mat2

 

In Training at Malware Removal University , You too could train to help others

 

Threads will be considered closed 7 days after the last posting.