Get a copy of winsockxpfix.exe before you do anything. This is just a safety
item in case you can't get on the internet afterwards. You don't run it until
 afterwards and then only if you can't get back on the internet.
You just run it and things should work OK after it reboots your system.

http://www.iup.edu/house/resnet/winfix.shtm

Get DelDomain.inf from:
 
http://www.mvps.org/winhelp2002/restricted.htm  and then right click on it and Install. 

 

Download the Hoster from:

www.funkytoad.com/download/hoster.zip

Unpack to your desktop and run it.  Select Restore Original Hosts.

Download the file, UnHookExec.inf, and save it to your Windows desktop. Do not run it at this time, download it only.

http://securityresponse.symantec.com/avcenter/UnHookExec.inf

If you cannot connect to the Internet from an infected computer:
Download to an uninfected computer, and then save it to a floppy disk.

http://securityresponse.symantec.com/avcenter/UnHookExec.inf

Get Pocket Killbox
 
http://www.bleepingcomputer.com/files/killbox.php
 
and unpack it to your desktop.

Also download and install ccleaner.exe from http://www.ccleaner.com. Don't let
it clean anything yet.

Now shutdown and reboot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.

Locate the downloaded UnHookExec.inf file, either on the Windows desktop or the floppy disk.

Right-click the UnHookExec.inf file and click Install. (This is a small file. It does not display any notice or boxes when you run it.)

Run HijackThis and just do a Scan only. Check then Fix
Checked the following:

O2 - BHO: CWebDirObj Object - {C003C49F-53E4-4A72-B7D6-0B2B9997392F} - E:\WINDOWS\webdir.dll
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/C...Bridge-c112.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FD} - http://217.73.66.1/del/loader.cab
O20 - Winlogon Notify: ckpNotify - E:\WINDOWS\SYSTEM32\ckpNotify.dll

Wait 60 seconds and repeat the scan. Did any of the above come back? IF so
leave HijackThis up and right click on the clock and select Task Manager. Then
Processes. Find Explorer.exe, right click on it and select End Process. The
desktop will disappear but HijackThis should still be there. IF you don't see
it switch to Applications in Task Manager and highlight it there then press
Switch To or just double click on it. Check and Fix Checked the above again.
Restart Explorer by Task Manager, File, New Task(Run), explorer.exe, OK.

 

Now run ccleaner.exe. On the first page, uncheck everything but the two lines
that have the word Temporary in them then Run Cleaner.

Run Killbox and select the Delete on Reboot Option then type or paste into the Full path of File to Delete box:
E:\WINDOWS\SYSTEM32\ckpNotify.dll
Select the Unregister .DLL option and then the red button.  Agree that you want to delete the file on reboot and let it reboot.

You may also want to look at:

http://securityresponse.symantec.com/avcenter/venc/data/trojan.startpage.o.html

Look under: 5. To reverse the changes made to the registry

Verify that your registry does not need these changes.

Reboot into normal mode and run another HijackThis log and post it as a reply.  Let's
see how we did.

Ron
 

Many thanks for the reply.

FYI, the entry that caused the problem was this one.

 

O2 - BHO: CWebDirObj Object - {C003C49F-53E4-4A72-B7D6-0B2B9997392F} - E:\WINDOWS\webdir.dll

 

Not many of the software virus trackers knew about it, it was hard to track down.