3 replies to this topic

[Bobbi Flekman]

Hi adelong,

1. Download AboutBuster
   
   Unzip it to your desktop but don't run it yet we'll do that later on down in this list in SAFE MODE.
   
2. Print out these instructions so you have them handy as some of the steps need to be done in safe mode and you may not be able to go online. We need IE to remain closed throughout the process.
   
3. Make sure your PC is configured to show hidden files.How do I show hidden files?
   
4. Restart your computer in Safe Mode. How do I Safe Boot my computer?
   
5. Scan with Hijack This and put check the following:
   
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\ppaji.dll/sp.html#12047%
   R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\ppaji.dll/sp.html#12047%
   
   R3 - Default URLSearchHook is missing
   
   O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
   O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
   
   O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
   O4 - HKCU\..\Run: [33.tmp] C:\DOCUME~1\ANDREW~1.YOU\LOCALS~1\Temp\33.tmp.exe
   O4 - HKCU\..\Run: [34.tmp] C:\DOCUME~1\ANDREW~1.YOU\LOCALS~1\Temp\34.tmp.exe
   O4 - HKCU\..\Run: [3A.tmp] C:\DOCUME~1\ANDREW~1.YOU\LOCALS~1\Temp\3A.tmp.exe
   O4 - HKCU\..\Run: [33.tmp.exe] C:\DOCUME~1\ANDREW~1.YOU\LOCALS~1\Temp\33.tmp.exe
   O4 - HKCU\..\Run: [34.tmp.exe] C:\DOCUME~1\ANDREW~1.YOU\LOCALS~1\Temp\34.tmp.exe
   O4 - HKCU\..\Run: [3A.tmp.exe] C:\DOCUME~1\ANDREW~1.YOU\LOCALS~1\Temp\3A.tmp.exe
   
   Then close all windows, and browsers, except HijackThis. Tell HijackThis to "Fix checked".
   
6. Double click on the AboutBuster tool you downloaded earlier. Follow the instruction prompts to use the program and let it do two scans (it will ask). When finished, press the "Save log" button. I will want a copy of that log after all steps are completed here.
   
7. Scan with Adaware and let it remove any bad files found.
   
8. Clean out temporary and temporary internet files. Go to "Start" -> "Run" and type in the box: "cleanmgr". Let it scan your system for files to remove. Make sure these 3 are checked and then press "Ok" to remove:
   
   Temporary Files
   Temporary Internet Files
   Recycle Bin
   
9. Restart in normal mode.
   
10. NOTE: Two possibly three or four files may have been deleted from your computer by the hijacker and may need to be replaced.
    
    Control.exe
    Shell.dll
    SDHelper.dll (if you are using Spybot Search & Destroy)
    Hosts file (no extension)
    
    If control.exe, shell.dll or SDHelper is missing
    Go here: http://spywareinfo.c...n/winfiles.html and download the needed file.
    
    For a missing Hosts file:
    Download Hoster
    Press "Restore Original Hosts" and press "OK"
    Exit Program.
    Note: if you were using a custom Hosts file you will need to replace any of those entries yourself!
    
    If you have Spybot S&D installed and SDHelper.dll is missing, replace it here:
    http://www.spywarein...s.html#sdhelper and download SDHelper.dll. Copy the file to the folder containing your Spybot S&D program (normally C:\Program Files\Spybot - Search & Destroy)
    
11. Additional: Check your ActiveX security settings. They may have been changed by this CWS variant to allow ALL ActiveX!! If they have been changed, reset your ActiveX security settings in Internet Explorer as recommended.
    
    ActiveX controls and plug-ins:
    • Download signed ActiveX controls (Prompt)
    • Download unsigned ActiveX controls (Disable)
    • Initialize and script ActiveX controls not marked as safe (Disable)
    • Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
    • Script ActiveX controls marked safe for scripting (Prompt)
    
    Do an online scan at the following site. Let it remove any infected files found.
    Trend Micro (PC-Cillin) - Free On-line Scan

When you are all done, post the new HijackThis log and the AboutBuster log here for review.

[Bobbi Flekman]

Hi adelong,

Thanks to the server malfunction it took some time to get you an answer, but I'm back.

Please enable everything you have turned off in 'System Configuration Utility' (MSConfig.exe). This way your system will not hide any potential malware and hijackers. What I cannot see, I cannot fix!

Post a fresh log. Afterwards you can turn off everything you had turned off. Do NOT restart your computer while everything is turned on

Run HijackThis, click on "Scan" and check the boxes next to all these items.

O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

Then close all windows, and browsers, except HijackThis. Tell HijackThis to "Fix checked". Restart your computer and post a new log in this thread.

Control.exe and Shell.dll should be in the Windows\System32 folder.
You don't use Spybot Search & Destroy, so that isn't needed and if you used a Hosts file you'd know it.