If you don't already have it, download, install and run
AdAware SE Personal.
-
Next, check for, and download any available updates:
1. click "
Check for updates now".
2. Click "
Connect".
3. If updates(definitions) are available click "
Ok", otherwise, click "
Ok".
4. Click "
Finish".
-
Next, configure
AdAware to be as effective as possible:
1. Click the '
gear' in the upper-right hand corner of the
AdAware Window.
2. Click Scanning, and check(tick) the following:
Scan within archives Scan active processes Scan registry Deep-scan registry Scan my IE Favorites for banned URLs Scan my Hosts file
3. Click "
Tweak".
4. Click "
Scanning Engine", then check(tick) the following:
Unload recognized proceses & modules during scan
5. Click "
Cleaning Engine", then check(tick) then following:
>
Always try to unload modules before deletion During removal, unload Explorer and IE if necessary Let Winodws remove files in use at next reboot Delete quarantined objects after retoring
6. Then click "
Proceed"
-
Now, let
AdAware locate and remove anything it finds, by:
1. Click "
Start".
2. Check(tick) "
perform full system scan".
3. Click "
Next".
-
Exit the program.
f you don't already have it, download, install and run
Spybot S & D. Next, update the current definitions by:
-
Next, check for, and download any available updates:
1. Click "
Search for Updates".
2. Check(tick) all available updates.
3. Click "
Download Updates".
4. Click "
Search & Destroy".
5. Click "
Check for Problems".
-
When the scan is completed:
1. Check(tick) everything that was found.
2. Click "
Fix selected problems".
Reboot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (
and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.
_
Locate the ETRemover_v130.exe and click to run.
Locate and
delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
Note that some of these file(s) may or may not be present. If present, and cannot be deleted because they're '
in use', try deleting them from "
Safe Mode".
Run
HiJackThis and click "
Scan", then check(tick) the following, if present:
ALgal
1.2K Posts
0
July 23rd, 2005 23:00
If you don't already have it, download, install and run AdAware SE Personal.
2. Click " Connect".
3. If updates(definitions) are available click " Ok", otherwise, click " Ok".
4. Click " Finish".
2. Click Scanning, and check(tick) the following:
Scan active processes
Scan registry
Deep-scan registry
Scan my IE Favorites for banned URLs
Scan my Hosts file
4. Click " Scanning Engine", then check(tick) the following:
During removal, unload Explorer and IE if necessary
Let Winodws remove files in use at next reboot
Delete quarantined objects after retoring
2. Check(tick) " perform full system scan".
3. Click " Next".
f you don't already have it, download, install and run Spybot S & D. Next, update the current definitions by:
2. Check(tick) all available updates.
3. Click " Download Updates".
4. Click " Search & Destroy".
5. Click " Check for Problems".
2. Click " Fix selected problems".
Go to www.trendmicro.com, and then:
2. Click " Scan now, it's free".
2. Check(tick) " Auto Clean".
3. Click " Scan".
Download Elite Tool Bar Remover from http://www.softpedia.com/progDownload/EliteToolbar-Remover-Download-18774.html
Extract the files from the Zip folder. Do not use yet. This tool must be used while in Safe Mode.
_
Locate the ETRemover_v130.exe and click to run.
Locate and delete the following item(s), if present. Make sure your able to view system and hidden files/ folders:
C:\WINDOWS\AuroraHandler.dll
C:\windows\system32\eliteutd32.exe
C:\WINDOWS\system32\exp.exe
C:\WINDOWS\system32\wintask.exe
C:\WINDOWS\wupdt.exe
c:\windows\system32\ljfdur.exe
C:\WINDOWS\system32\notapi32.dll
Run HiJackThis and click " Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchmiracle.com/sp.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchmiracle.com/sp.php
O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} - C:\WINDOWS\AuroraHandler.dll
O4 - HKLM\..\Run: [checkrun] C:\windows\system32\eliteutd32.exe
O4 - HKLM\..\Run: [cfgmgr52] RunDLL32.EXE C:\WINDOWS\cfgmgr52.dll,DllRun
O4 - HKLM\..\Run: [exp.exe] C:\WINDOWS\system32\exp.exe
O4 - HKLM\..\Run: [WinTask driver] C:\WINDOWS\system32\wintask.exe
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [Win Server Updt] C:\WINDOWS\wupdt.exe
O4 - HKLM\..\Run: [nkesotj] c:\windows\system32\ljfdur.exe r
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\Program Files\EmpirePoker\EmpirePoker.exe (file missing)
Now, with all windows closed except HiJackThis, click " Fix checked".
Reboot your computer and post back a new log.