[Advertisements]

Hi liam_lad and Welcome to the Geeks to Go Forums!

We need to get HijackThis into a Permanent folder!

To do this>"Right Click" the Desktop>Select "New">Select "Folder">Name it whatever you like!

Now locate the original Zip file for HijackThis and place it in the new folder!

Unzip and "Extract All Files"

I will need you to download 3 programs but please do not run these until Iask you to!

Download Ewido Security Suite, install then from within the program check for updates BUT dont scan yet
Ewido Security Suite:
http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu". When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK.
We will fix this in a moment.

From the main Ewido screen, click on update in the left menu, then click the Start update button.

After the update finishes (the status bar at the bottom will display "Update successful"), Now close the program.

If you have problems updating see here
http://www.ewido.net...wnload/updates/

AdawareSE 1.05
http://www.bleepingc...showtutorial=48

Please Install>Update and Configure just as described in the link!

CleanUp! 4.0
http://downloads.ste...p/CleanUp40.exe

Go to Add\Remove Programs and Remove any of these if they exist

180searchassistant\nCase
ErrorGuard
NavHelper

Reboot into SAFE MODE(Tap F8 when restarting)
Here is a link on how to boot into Safe Mode:
http://service1.syma...src=sec_doc_nam

After restarting in Safe Mode,Configure Windows to Show All Hidden Files and Folders,this must be done after restarting in Safe Mode!!

Here is a link to help with that
http://www.bleepingc...showtutorial=62

Be sure to follow the directions that apply to your Operating System!

Run CleanUp!

Click "Cleanup" and it will Scan and Remove all available Temp files>Click "Close">Click "No" to Logoff!

Click Start>Click Search(Opens the Search Assistant)>Select All Files and Folders>Select Advanced Options>Make sure there is a check by these 3

Search System Folders
Search hidden files and folders
Search Subfolders

Now under All Files and Folders,enter this into the open box:

RK17j6EN.exe

igfhela2.exe

Delete any exact matches you get!

Locate and Delete these

C:\Program Files\180searchassistant<< Folder!

C:\Program Files\ErrorGuard<< Folder!

C:\Documents and Settings\All Users\Application Data\ProgramMpegLongAmok<< Folder!

C:\Documents and Settings\All Users\Application Data\Rule Junk Hold Poll<< Folder!

C:\Documents and Settings\Owner\Application Data\BOLTAR~1<< Folder>>Unsure of entire name!

Open HijackThis and put a check by these but DO NOT hit the Fix Checked button yet!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qgb9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://jdwsonfglcwhe...1eEdk652qP/.jsp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb9.hpwis.com/

O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)

O4 - HKLM\..\Run: [RK17j6EN] C:\documents and settings\owner\local settings\temp\RK17j6EN.exe

O4 - HKLM\..\Run: [rs9j3mj] igfhela2.exe

O4 - HKLM\..\Run: [longamokusermfcd] C:\Documents and Settings\All Users\Application Data\ProgramMpegLongAmok\META 32.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [Hold poll lite load] C:\Documents and Settings\All Users\Application Data\Rule Junk Hold Poll\Second Date.exe

O4 - HKLM\..\Run: [saap] c:\program files\180searchassistant\saap.exe

O4 - HKLM\..\Run: [tmtif] C:\WINDOWS\tmtif.exe

O4 - HKCU\..\Run: [Exit Trans] C:\DOCUME~1\Owner\APPLIC~1\BOLTAR~1\boneplanelse.exe

O4 - Startup: PowerReg Scheduler.exe

O15 - Trusted Zone: *.registration.sonystyle-europe.com (HKLM)

O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguar...ion/Install.cab

O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory....sharingctrl.cab

O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory....ap/DigWXMSN.cab

Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button!!

Please Run Ewido Security Suite now and Make sure to Save the Reprot it generates!

Go ahead and Run Ad Aware>Delete all it finds and make sure to delet all quaratine files!

Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG, click on Start -> Run -> type in MSCONFIG -> click OK!

Under the "General" Tab
Make Sure Normal Startup is Checked!!

Click Apply>>OK>>Follow the Prompts to Restart!!

Restart Normal and have the PC Scanned here
Panda Active Scan

You will need to be using Internet Explorer for the Scan to work!

Save the Report it generates!

Once backin Normal Mode>Post a fresh HijackThis log along with the Reports from Ewido and Panda!

[Wizard]

Hi liam_lad and Welcome to the Geeks to Go Forums!

We need to get HijackThis into a Permanent folder!

To do this>"Right Click" the Desktop>Select "New">Select "Folder">Name it whatever you like!

Now locate the original Zip file for HijackThis and place it in the new folder!

Unzip and "Extract All Files"

I will need you to download 3 programs but please do not run these until Iask you to!

Download Ewido Security Suite, install then from within the program check for updates BUT dont scan yet
Ewido Security Suite:
http://www.ewido.net/en/download/

When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu". When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK.
We will fix this in a moment.

From the main Ewido screen, click on update in the left menu, then click the Start update button.

After the update finishes (the status bar at the bottom will display "Update successful"), Now close the program.

If you have problems updating see here
http://www.ewido.net...wnload/updates/

AdawareSE 1.05
http://www.bleepingc...showtutorial=48

Please Install>Update and Configure just as described in the link!

CleanUp! 4.0
http://downloads.ste...p/CleanUp40.exe

Go to Add\Remove Programs and Remove any of these if they exist

180searchassistant\nCase
ErrorGuard
NavHelper

Reboot into SAFE MODE(Tap F8 when restarting)
Here is a link on how to boot into Safe Mode:
http://service1.syma...src=sec_doc_nam

After restarting in Safe Mode,Configure Windows to Show All Hidden Files and Folders,this must be done after restarting in Safe Mode!!

Here is a link to help with that
http://www.bleepingc...showtutorial=62

Be sure to follow the directions that apply to your Operating System!

Run CleanUp!

Click "Cleanup" and it will Scan and Remove all available Temp files>Click "Close">Click "No" to Logoff!

Click Start>Click Search(Opens the Search Assistant)>Select All Files and Folders>Select Advanced Options>Make sure there is a check by these 3

Search System Folders
Search hidden files and folders
Search Subfolders

Now under All Files and Folders,enter this into the open box:

RK17j6EN.exe

igfhela2.exe

Delete any exact matches you get!

Locate and Delete these

C:\Program Files\180searchassistant<< Folder!

C:\Program Files\ErrorGuard<< Folder!

C:\Documents and Settings\All Users\Application Data\ProgramMpegLongAmok<< Folder!

C:\Documents and Settings\All Users\Application Data\Rule Junk Hold Poll<< Folder!

C:\Documents and Settings\Owner\Application Data\BOLTAR~1<< Folder>>Unsure of entire name!

Open HijackThis and put a check by these but DO NOT hit the Fix Checked button yet!

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qgb9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb9.hpwis.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://jdwsonfglcwhe...1eEdk652qP/.jsp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-qgb9.hpwis.com/

O3 - Toolbar: (no name) - {5AA06644-BC46-4220-A460-47A6EB47C96D} - (no file)

O4 - HKLM\..\Run: [RK17j6EN] C:\documents and settings\owner\local settings\temp\RK17j6EN.exe

O4 - HKLM\..\Run: [rs9j3mj] igfhela2.exe

O4 - HKLM\..\Run: [longamokusermfcd] C:\Documents and Settings\All Users\Application Data\ProgramMpegLongAmok\META 32.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [Hold poll lite load] C:\Documents and Settings\All Users\Application Data\Rule Junk Hold Poll\Second Date.exe

O4 - HKLM\..\Run: [saap] c:\program files\180searchassistant\saap.exe

O4 - HKLM\..\Run: [tmtif] C:\WINDOWS\tmtif.exe

O4 - HKCU\..\Run: [Exit Trans] C:\DOCUME~1\Owner\APPLIC~1\BOLTAR~1\boneplanelse.exe

O4 - Startup: PowerReg Scheduler.exe

O15 - Trusted Zone: *.registration.sonystyle-europe.com (HKLM)

O16 - DPF: {205FF73B-CA67-11D5-99DD-444553540006} (CInstall Class) - http://www.errorguar...ion/Install.cab

O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory....sharingctrl.cab

O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory....ap/DigWXMSN.cab

Now Make sure ALL WINDOWS and BROWSERS are CLOSED and hit the Fix Checked Button!!

Please Run Ewido Security Suite now and Make sure to Save the Reprot it generates!

Go ahead and Run Ad Aware>Delete all it finds and make sure to delet all quaratine files!

Run MSCONFIG and enable everything in the startup area. To get to MSCONFIG, click on Start -> Run -> type in MSCONFIG -> click OK!

Under the "General" Tab
Make Sure Normal Startup is Checked!!

Click Apply>>OK>>Follow the Prompts to Restart!!

Restart Normal and have the PC Scanned here
Panda Active Scan

You will need to be using Internet Explorer for the Scan to work!

Save the Report it generates!

Once backin Normal Mode>Post a fresh HijackThis log along with the Reports from Ewido and Panda!

[Wizard]

Go to Add\Remove Programs and Remove

MessengerPlus! 3<<< Thats where the LOP Infection came from!!!

Restart the PC and Post the results of the Panda Scan and Ewido Scan I asked for earlier