Please download ewido anti-malware it is a trial version of the program.
- Install ewido security suite
- When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
- Launch ewido, there should be an icon on your desktop double-click it.
- The program will now go to the main screen
You will need to update ewido to the latest definition files.- On the left hand side of the main screen click update
- Then click on Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update ewido.
ewido manual updates
Download CWShredder here to its own folder.
Download about:buster by RubbeRDuckY Here.
Update CWShredder
* Open CWShredder and click I AGREE
* Click Check For Update
* Close CWShredder
Boot into safemode to do this keep tapping F8 on your keyboard while your PC is starting up you will get a menu select safemode.
Open Ewido again
- Click on scanner
- Click on Complete System Scan and the scan will begin.
- While the scan is in progress you will be prompted to clean files, click OK
- When it asks if you want to clean the first file, put a check in the lower left corner of the box that says "Perform action on all infections" then choose clean and click OK.
- Once the scan has completed, there will be a button located on the bottom of the screen named Save report
- Click Save report.
- Save the report .txt file to your desktop.
Now close ewido anti-malware.
Now run CWShredder. Click I Agree, then Fix and then Next, let it fix everything it asks about.
Please run about:buster by RubbeRDuckY:- Click Begin Removal.
- Click Yes to allow it to shutdown explorer.exe.
- It will begin to check your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
- When it has finished, click Save Log. Make sure you save it as I may need a copy of it later.
- Reboot your computer into safe mode again
Run about:buster again following the same instructions as above, this time without the restart at the end
Download http://osc.geekstogo...rviceremove.reg run it it will ask to merge into the registery say yes.
Post the about:buster log, CWShredder results, Ewido restults and a New Hijackthis log here in a reply.
AboutBuster 6.0
Scan started on [1/29/2006] at [2:03:18 PM]
-------------------------------------------------------------
Internet Explorer Instances Terminated!
HomeSearch Service stopped if present
-------------------------------------------------------------
No Ads Found!
-------------------------------------------------------------
No Files Found!
-------------------------------------------------------------
Scan was COMPLETED SUCCESSFULLY at 2:05:07 PM
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 1:47:23 PM, 1/29/2006
+ Report-Checksum: BCFDB41D
+ Scan result:
HKLM\SOFTWARE\Classes\CLSID\{2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} -> Spyware.MiniBug : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{676575DD-4D46-911D-8037-9B10D6EE8BB5} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Classes\CLSID\{FC92C3DE-F786-C2A4-4565-359ECF140E14} -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SE -> Spyware.CoolWebSearch : Cleaned with backup
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SW -> Spyware.CoolWebSearch : Cleaned with backup
HKU\S-1-5-21-1775939193-4071922483-984312418-1003\Software\SNO2 -> Adware.SpySheriff : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.Euroclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Overture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@doubleclick[1].txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Wegcash : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@mediaplex[1].txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][2].txt -> Spyware.Cookie.Wegcash : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.Adjuggler : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.2o7 : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@y-1shz2prbmdj6wvny-1sez2pra2dj6wjmygiazwcpgsdj6x9ny-1seq-2-2.stats.esomniture[2].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\owner@y-1shz2prbmdj6wvny-1sez2pra2dj6wjnyaiazkgoaqdj6x9ny-1seq-2-2.stats.esomniture[1].txt -> Spyware.Cookie.Esomniture : Cleaned with backup
C:\Documents and Settings\Owner\Cookies\
[email protected][1].txt -> Spyware.Cookie.Adserver : Cleaned with backup
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12B5TACU\MlJIdFpFVXl0Sm9BQUZxOGFsNEFBQUNl[1].wmf -> Exploit.MS05-053-WMF : Error during cleaning
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12B5TACU\MVpSU3YwVXl0Sm9BQUZyMnVNZ0FBQURj[1].wmf -> Exploit.MS05-053-WMF : Error during cleaning
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12B5TACU\QGhaNUJrVXl0Sm9BQUNka2U1MEFBQUtS[1].wmf -> Exploit.MS05-053-WMF : Error during cleaning
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12B5TACU\runapl[1].exe -> Trojan.LowZones.df : Error during cleaning
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12B5TACU\runapl[2].exe -> Trojan.LowZones.df : Error during cleaning
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\12B5TACU\runapl[3].exe -> Trojan.LowZones.df : Error during cleaning
C:\ntnc.exe -> Not-A-Virus.Hoax.Win32.Renos.au : Cleaned with backup
C:\ntzl.exe -> Trojan.LowZones.df : Cleaned with backup
C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll -> Spyware.Wheaterbug : Cleaned with backup
C:\Program Files\SpySheriff -> Spyware.SpySheriff : Cleaned with backup
C:\Program Files\SpySheriff\SpySheriff.exe -> Spyware.SpySheriff : Cleaned with backup
C:\Program Files\SpySheriff\Uninstall.exe -> Spyware.SpySheriff : Cleaned with backup
C:\WINDOWS\addhs32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\apipk32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\appwo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\atlbp.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crhu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\crpn.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3hu.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\d3lb.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\iejt.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\ipmo32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\KB824141.log:iqgex -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\KB824141.log:lyjjc -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\KB896358.log:mqlrk -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\logs1.ini:phmxc -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\LUINSTALL.LOG:ydzcy -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\mfczi.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\msuz32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\netwy.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\nsreg.dat:guqaw -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\ntnz32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\pflzx.dll -> Hijacker.Small : Cleaned with backup
C:\WINDOWS\stub2.ini:muyor -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\addvy32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\appop32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\appsr32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\crvi32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\links.exe -> Trojan.LowZones.df : Cleaned with backup
C:\WINDOWS\system32\msfv.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\mskj32.exe -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\system32\netbt32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\netrx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\sdkgb32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\wineo.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\winer32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\system32\winrx.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\wiaservc.log:icgpj -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\winio.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\winjq32.exe -> Trojan.Agent.bi : Cleaned with backup
C:\WINDOWS\zgqlt.dll -> Hijacker.Small : Cleaned with backup
C:\WINDOWS\_default.pif:gskhv -> Downloader.Agent.td : Cleaned with backup
C:\WINDOWS\_default.pif:qzyeb -> Downloader.Agent.td : Cleaned with backup
::Report End
Logfile of HijackThis v1.99.1
Scan saved at 2:16:34 PM, on 1/29/2006
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\PNY Attaché\shwicon.exe
C:\Program Files\support.com\bin\tgcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\winstall.exe
C:\Program Files\Java\jre1.5.0\bin\jucheck.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Owner\Local Settings\Temp\Temporary Directory 3 for hijackthis_199.zip\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
http://hotmail.com/R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Class - {39C12040-B007-948F-8512-9589CFE9D7A7} - C:\WINDOWS\iphj.dll (file missing)
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\PROGRA~1\NETSCA~1\NETSCA~1\pbhelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Class - {EE8A3706-6D4D-B06F-E872-F9AB067DC94F} - C:\WINDOWS\appqs.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ShowIcon_PNY_PNY Attaché] "C:\Program Files\PNY Attaché\shwicon.exe" -t"PNY\PNY Attaché"
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [tgcmd] "C:\Program Files\support.com\bin\tgcmd.exe" /server
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [sdkpd32.exe] C:\WINDOWS\sdkpd32.exe
O4 - HKLM\..\Run: [2A.tmp] C:\DOCUME~1\Owner\LOCALS~1\Temp\2A.tmp.exe
O4 - HKLM\..\Run: [msdr32.exe] C:\WINDOWS\system32\msdr32.exe
O4 - HKLM\..\Run: [javaff32.exe] C:\WINDOWS\javaff32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [sysgm.exe] C:\WINDOWS\system32\sysgm.exe
O4 - HKLM\..\Run: [mswt32.exe] C:\WINDOWS\mswt32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} -
http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} -
http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} -
http://online.comcast.net/help/ (file missing)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyPoker.net\partypokernet.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} -
http://appldnld.m7z....iTunesSetup.exeO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by20fd.bay20....es/MsnPUpld.cabO16 - DPF: {F5D98C43-DB16-11CF-8ECA-0000C0FD59C7} (ActiveCGM Control) -
http://www.webmap.ni...s/ACGM/Acgm.cabO20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Netscape Update Service (NCUpdateSvc) - Netscape Communications Corporation - C:\Program Files\Netscape Internet Service\ncupdatesvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - c:\Program Files\Intel\NCS\Sync\NetSvc.exe
I couldn't find the shredder log that I saved. THanks for all your help.
This topic is locked
Sign In
Create Account
