[loophole]

Well either somethings interfering with the fix or those bad files are really hiding from us

Lets do this

Print these directions out

Update Ewido

Now disconnect from the internet

Right click the Spybot icon in the system tray and then click exit
Right click the Spywaredoctor icon in the system tray and then click exit
Right click the Microsoft antispyware in the system tray and click shutdown
Right click the Norton icon in the system tray and then click Disable Antivirus auto protect

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\about.htm
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Microsoft Updates] Botnet.exe
O4 - HKLM\..\Run: [u3rg3pU] setsam.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [CSV10P70] C:\Program Files\CSBB\CSv10P070.exe
O4 - HKLM\..\RunServices: [Microsoft Windows W32 Services] mssw32.exe
O4 - HKLM\..\RunServices: [Microsoft Updates] Botnet.exe
O4 - HKLM\..\RunServices: [start uploading] smsss.exe
O4 - HKCU\..\RunServices: [start uploading] smsss.exe
O16 - DPF: ppctlcab -
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} -
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -

Now close all windows other than HiJackThis, then click Fix Checked. Reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode

Now open Ewido
:

• Click on scanner
• Click on Complete System Scan and the scan will begin.
• You will be prompted to clean the first infection.
• Select "Perform action on all infections", then proceed.
• Once the scan has completed, there will be a button located on the bottom of the screen named Save report
• Click Save report.
• Save the report .txt file to your desktop or a location where you can find it easily.

Close ewido security suite.

After all that, please post back with how things went as well as a new Hijack log and the Ewido log

[Advertisements]

Double post

Edited by loophole, 25 October 2005 - 09:19 PM.

[loophole]

Double post

Edited by loophole, 25 October 2005 - 09:19 PM.