Hi and welcome to Daniweb forums
.
Can you please do the following.
===============
Can you disable
Windows Defender as it may interfere with the removal process. Please leave it disabled until your PC has been given the all clear.
- Open Windows Defender
- Click Tools
- Click General Settings
- Scroll down to Real Time Protection Options
- Uncheck Turn on Real Time Protection (recommended)
- After you uncheck this, click on the Save button
- Close Windows Defender
===============
Scan with
HijackThis and then place a check next to all the following, if present:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ctfmona] C:\Windows\system32\ctfmona.exe
O13 - Gopher Prefix:
Now, close
all instances of Internet Explorer and any other windows you have open except
HiJackThis, click "
Fix checked".
===============
Locate and
delete the following item(s), if present. Make sure you are able to
view system and hidden files/ folders:
files...
C:\Windows\system32\ctfmona.exe
-
Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're '
in use', try deleting them in
Safe Mode by doing the following:
- Restart your computer
- After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
- Instead of Windows loading as normal, a menu should appear.
Select the first option to run Windows in
Safe Mode hit enter.
-
Reboot.
===============
Download this file from one of the following links :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.techsupportforum.com/sectools/combofix.exe
1.
Make sure that Combofix is downloaded to and run from, your desktop.
2. Double click combofix.exe & follow the prompts.
3. When finished, ComboFix generates a pop up log which can also be found at
C:\ComboFix.txt. Post that log in your next reply, along with a new hijackthis log.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.