- First we need to make all files and folders VISIBLE:
- Go to start>control panel>folder options>view (tab)
- Choose to "show hidden files and folders,"
- Uncheck the "hide protected operating system files" and the "hide extensions for know file types" boxes.
- Close the window with ok
- Please RUN HijackThis.
. Click the SCAN button to produce a log.
- Place a check mark beside each one of the following items:
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://cdn.eyewonder...6731/popup.html
O2 - BHO: (no name) - {00F1D395-4744-40f0-A611-980F61AE2C59} - (no file)
O2 - BHO: WinStat - {0BAE99AF-A9F7-4f7e-9C72-2C1CC81BE0FF} - C:\WINDOWS\System32\WinStat13.dll
O4 - HKLM\..\Run: [sp] rundll32 C:\DOCUME~1\Jimmy\LOCALS~1\Temp\se.dll,DllInstall
O4 - HKLM\..\Run: [lzlrr] C:\WINDOWS\System32\lzlrr.exe
O4 - HKLM\..\Run: [vsmf] C:\WINDOWS\System32\vsmf.exe
O15 - Trusted Zone: http://www.neededware.com
O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windup...bridge-c356.cab
- Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
- Reboot Your System in Safe Mode
How to use the F8 method to Start Your Computer in Safe Mode
- Restart the computer.
- As soon as BIOS is loaded begin tapping the F8 key until the Advanced Options menu appears.
- Use the arrow keys to select the Safe mode menu item
- Press Enter.
- Using Windows Explorer, locate the following files/folders, and DELETE them (if they are present):
C:\WINDOWS\System32\WinStat13.dll
C:\DOCUME~1\Jimmy\LOCALS~1\Temp\se.dll
C:\WINDOWS\System32\lzlrr.exe
C:\WINDOWS\System32\vsmf.exe
- Exit Explorer, and REBOOT BACK INTO NORMAL MODE
- Finally, RUN Hijackthis again and produce a new HJT log. Post it in the forum so we can check how everything looks now.
Trevuren