Unpack to your desktop and run it. If you have green print at the top then just press Restore Original Hosts then OK.
IF you have red print then press make Hosts Writeable first.
Where it says Full Path of File to Delete you need to type or copy (Hightlight and Ctrl + c) and Paste (move to the killbox and place the cursor in the box and Ctrl + V):
Also download and install ccleaner.exe from
http://www.ccleaner.com. Don't let
it clean anything yet.
Start then right click on My Computer and press Manage. In the new window
Service and Applications then Services. In the right pane scroll down and find
the System Startup Service. Double click on it and and then set the Start Type
to Disabled. Then OK.
unpack(extract) it to your desktop but don't run it yet.
Shutdown and Restart and Boot into Safe Mode by tapping the F8 key when you see the PC
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.
Run HijackThis and just do a Scan only. Check then Fix
Checked the following:
Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.
run ABIRemover. Then reboot into Safe Mode again and run HijackThis.exe
and do a Scan and check (if it still shows up)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - F:\WINDOWS\svcproc.exe
O4 - HKLM\..\Run: [gqxdqdd] F:\WINDOWS\system32\yodiyyb.exe r <==may change its name but look for the "r" by itself
then press Fix Checked.
Reboot into regular mode and install deldomain.inf and run hoster / Restore Default Hosts
just to make sure.
Run another HijackThis log and send it to me. Let's
see how we did.
RKinner
2 Intern
•
5.9K Posts
0
August 31st, 2005 16:00
http://www.funkytoad.com/
IF you have red print then press make Hosts Writeable first.
Get DelDomain.inf from:
http://www.mvps.org/winhelp2002/restricted.htm and then right click on it and Install.
Download the killbox:
216.180.233.142
it clean anything yet.
Start then right click on My Computer and press Manage. In the new window
Service and Applications then Services. In the right pane scroll down and find
the System Startup Service. Double click on it and and then set the Start Type
to Disabled. Then OK.
Get ABIRemover.zip from
maker's logo.
Keep tapping until it tells you it is going to Safe Mode or you see the Safe
Mode menu. Select the top option.
Checked the following:
O4 - HKLM\..\Run: [Tray Temperature] F:\DOCUME~1\Pam\LOCALS~1\Temp\MiniBug.exe 1
O4 - HKLM\..\Run: [Face joy 1 axis] F:\Documents and Settings\All Users\Application Data\trust heart face joy\regs idol.exe
O4 - HKLM\..\Run: [MMC] F:\WINDOWS\inisys.exe
O4 - HKLM\..\Run: [Updater] C:\mt.exe
O4 - HKLM\..\Run: [NI.UWFX5LP_0001_0803] "F:\WINDOWS\Downloaded Program Files\UWFX5LP_0001_0803NetInstaller.exe"
O4 - HKLM\..\Run: [System service63] F:\WINDOWS\etb\pokapoka63.exe
O4 - HKLM\..\Run: [dnam] F:\WINDOWS\system32\d140113.a.Stub.EXE
O4 - HKLM\..\Run: [winsync] F:\WINDOWS\system32\ssgssp.exe reg_run
O4 - HKLM\..\Run: [AUNPS2] RUNDLL32 AUNPS2.DLL,_Run@16
O4 - HKLM\..\Run: [version] F:\WINDOWS\system32\Lwwocp.exe
O4 - HKLM\..\Run: [gqxdqdd] F:\WINDOWS\system32\yodiyyb.exe r
O4 - HKCU\..\Run: [Settingspoll] F:\DOCUME~1\Pam\APPLIC~1\DRIVEN~1\Boldaim.exe
O20 - Winlogon Notify: RunOnce - F:\WINDOWS\system32\crwmdm.dll
O23 - Service: System Startup Service (SvcProc) - Unknown owner - F:\WINDOWS\svcproc.exe
Run ccleaner.exe, uncheck everything on the first page except the two entries
with Temporary and then Run Cleaner.
and do a Scan and check (if it still shows up)
O23 - Service: System Startup Service (SvcProc) - Unknown owner - F:\WINDOWS\svcproc.exe
O4 - HKLM\..\Run: [gqxdqdd] F:\WINDOWS\system32\yodiyyb.exe r <==may change its name but look for the "r" by itself
then press Fix Checked.
just to make sure.
see how we did.
Message Edited by RKinner on 08-31-2005 12:45 PM