adinezza,
Hi and welcome to the Daniweb forums :).
-
Download CWShredder 2.14 from here. Run it and press the *fix,* not scan and allow it to clean the infection. Close all browser and explorer windows before hitting the fix button.
-
Download, unzip to your desktop About:Buster and run it, then:
1. Click "Update".
2. Click "Check For Update"
(If no new version is available, skip to step #4.)
3. Click "Download Update", and wait for it to be installed.
4. Click "Start".
(Wait for the initial ADS scan to complete.)
5. Click "Yes", to shutdown any IE session currently open.
(Wait for the about:blank scan to complete.)
6. Click "Ok", to scan once more.
7. Click "Yes", to shutdown any IE sessions currently open.
8. Click "Yes", to begin the second pass.
9. Click "Save log", and post this log back along with your new log.
10. Click "Exit".
11. Click "Exit".
12. "Reboot"..
===============
Go to www.trendmicro.com , and then:
1. Click "Free Online Scan".
2. Click "Scan now, it's free".
It'll take a few minutes to download (especially with a dialup connection), so be patient. When it's down:
1. Select all available drives.
2. Check(tick) "Auto Clean".
3. Click "Scan".
When it completes, post back the full filename of any files that cannot be cleaned or deleted.
===============
Run HiJackThis then:
1. Click "Open the Misc Tools Section"
2. Click "Open Process manager"
-
Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:
C:\WINDOWS\ietf32.exe
Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.
===============
Still in HiJackThis, click "Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\nzunt.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\nzunt.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\vtzzf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\vtzzf.dll/sp.html#37049
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\vtzzf.dll/sp.html#37049
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\nzunt.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\vtzzf.dll/sp.html#37049
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Owner\Application Data\Mozilla\Profiles\default\uatt62pk.slt\prefs.js)
O2 - BHO: Class - {63F52CE5-7ABE-5FF6-7DC7-80E58BFEF6F6} - C:\WINDOWS\system32\crdc32.dll
O2 - BHO: Class - {BB2E6852-7961-1E70-E3C8-8433F21B7649} - C:\WINDOWS\crni32.dll
O2 - BHO: Class - {CC5DFEE2-722A-5C44-8CC5-7BAD2AA546F5} - C:\WINDOWS\system32\apijw32.dll
O2 - BHO: Class - {F573A15E-4E08-2CE8-1F75-3F0D794E2E42} - C:\WINDOWS\system32\sdkpb32.dll
O4 - HKLM\..\Run: [javajp.exe] C:\WINDOWS\system32\javajp.exe
O4 - HKLM\..\Run: [javacq32.exe] C:\WINDOWS\system32\javacq32.exe
O4 - HKLM\..\Run: [nettf.exe] C:\WINDOWS\nettf.exe
O4 - HKLM\..\Run: [ietf32.exe] C:\WINDOWS\ietf32.exe
O4 - HKLM\..\RunOnce: [sdkzw.exe] C:\WINDOWS\system32\sdkzw.exe
O4 - HKLM\..\RunOnce: [ntma.exe] C:\WINDOWS\ntma.exe
O4 - HKLM\..\RunOnce: [iefu32.exe] C:\WINDOWS\system32\iefu32.exe
O4 - HKLM\..\RunOnce: [ieui32.exe] C:\WINDOWS\system32\ieui32.exe
O4 - HKLM\..\RunOnce: [apilj32.exe] C:\WINDOWS\system32\apilj32.exe
O4 - HKLM\..\RunOnce: [mfcpj32.exe] C:\WINDOWS\mfcpj32.exe
O4 - HKLM\..\RunOnce: [addzh32.exe] C:\WINDOWS\system32\addzh32.exe
O4 - HKLM\..\RunOnce: [apirg32.exe] C:\WINDOWS\system32\apirg32.exe
O4 - HKLM\..\RunOnce: [javals.exe] C:\WINDOWS\javals.exe
O4 - HKLM\..\RunOnce: [atlgh32.exe] C:\WINDOWS\system32\atlgh32.exe
O4 - HKLM\..\RunOnce: [mfcop32.exe] C:\WINDOWS\mfcop32.exe
O4 - HKLM\..\RunOnce: [netaf32.exe] C:\WINDOWS\system32\netaf32.exe
O4 - HKLM\..\RunOnce: [sdkoq.exe] C:\WINDOWS\sdkoq.exe
O4 - HKLM\..\RunOnce: [ntxa32.exe] C:\WINDOWS\ntxa32.exe
O4 - HKLM\..\RunOnce: [sdkqf.exe] C:\WINDOWS\sdkqf.exe
O4 - HKLM\..\RunOnce: [ipun32.exe] C:\WINDOWS\ipun32.exe
O4 - HKLM\..\RunOnce: [d3ql.exe] C:\WINDOWS\system32\d3ql.exe
O4 - HKLM\..\RunOnce: [sdkux32.exe] C:\WINDOWS\system32\sdkux32.exe
O4 - HKLM\..\RunOnce: [apiry.exe] C:\WINDOWS\system32\apiry.exe
O4 - HKLM\..\RunOnce: [ipqe.exe] C:\WINDOWS\ipqe.exe
O4 - HKLM\..\RunOnce: [mfcgt.exe] C:\WINDOWS\mfcgt.exe
O4 - HKLM\..\RunOnce: [iexn32.exe] C:\WINDOWS\system32\iexn32.exe
O4 - HKLM\..\RunOnce: [atljw32.exe] C:\WINDOWS\system32\atljw32.exe
O4 - HKLM\..\RunOnce: [ieoz.exe] C:\WINDOWS\system32\ieoz.exe
O4 - HKLM\..\RunOnce: [netob.exe] C:\WINDOWS\netob.exe
O4 - HKLM\..\RunOnce: [syscd.exe] C:\WINDOWS\system32\syscd.exe
O4 - HKLM\..\RunOnce: [javamq.exe] C:\WINDOWS\javamq.exe
O4 - HKLM\..\RunOnce: [apirs32.exe] C:\WINDOWS\apirs32.exe
O4 - HKLM\..\RunOnce: [syswp32.exe] C:\WINDOWS\system32\syswp32.exe
O4 - HKLM\..\RunOnce: [ntde.exe] C:\WINDOWS\system32\ntde.exe
O4 - HKLM\..\RunOnce: [apitt.exe] C:\WINDOWS\system32\apitt.exe
O4 - HKLM\..\RunOnce: [appxf.exe] C:\WINDOWS\appxf.exe
O4 - HKLM\..\RunOnce: [netbc.exe] C:\WINDOWS\system32\netbc.exe
O4 - HKLM\..\RunOnce: [sysae.exe] C:\WINDOWS\system32\sysae.exe
O4 - HKLM\..\RunOnce: [wintn.exe] C:\WINDOWS\system32\wintn.exe
O4 - HKLM\..\RunOnce: [javalc32.exe] C:\WINDOWS\javalc32.exe
O4 - HKLM\..\RunOnce: [msbk.exe] C:\WINDOWS\msbk.exe
O4 - HKLM\..\RunOnce: [appfo32.exe] C:\WINDOWS\system32\appfo32.exe
O4 - HKLM\..\RunOnce: [syspo.exe] C:\WINDOWS\syspo.exe
O4 - HKLM\..\RunOnce: [javaif.exe] C:\WINDOWS\system32\javaif.exe
O4 - HKLM\..\RunOnce: [iper.exe] C:\WINDOWS\system32\iper.exe
O4 - HKLM\..\RunOnce: [d3bg32.exe] C:\WINDOWS\d3bg32.exe
O4 - HKLM\..\RunOnce: [winro32.exe] C:\WINDOWS\winro32.exe
O4 - HKLM\..\RunOnce: [ienz.exe] C:\WINDOWS\ienz.exe
O4 - HKLM\..\RunOnce: [winvd.exe] C:\WINDOWS\system32\winvd.exe
O4 - HKLM\..\RunOnce: [netzt.exe] C:\WINDOWS\netzt.exe
O4 - HKLM\..\RunOnce: [mfckx32.exe] C:\WINDOWS\system32\mfckx32.exe
O4 - HKLM\..\RunOnce: [apili.exe] C:\WINDOWS\apili.exe
O4 - HKLM\..\RunOnce: [apikn.exe] C:\WINDOWS\system32\apikn.exe
O4 - HKLM\..\RunOnce: [mfcsn.exe] C:\WINDOWS\mfcsn.exe
O4 - HKLM\..\RunOnce: [javaic32.exe] C:\WINDOWS\system32\javaic32.exe
O4 - HKLM\..\RunOnce: [msyj32.exe] C:\WINDOWS\system32\msyj32.exe
O4 - HKLM\..\RunOnce: [crtv.exe] C:\WINDOWS\system32\crtv.exe
O4 - HKLM\..\RunOnce: [netsl32.exe] C:\WINDOWS\system32\netsl32.exe
O4 - HKLM\..\RunOnce: [addqs32.exe] C:\WINDOWS\addqs32.exe
O4 - HKLM\..\RunOnce: [appqi.exe] C:\WINDOWS\appqi.exe
O4 - HKLM\..\RunOnce: [addzj.exe] C:\WINDOWS\system32\addzj.exe
O4 - HKLM\..\RunOnce: [javaff32.exe] C:\WINDOWS\javaff32.exe
O4 - HKLM\..\RunOnce: [ntir.exe] C:\WINDOWS\system32\ntir.exe
O4 - HKLM\..\RunOnce: [atlhh32.exe] C:\WINDOWS\system32\atlhh32.exe
O4 - HKLM\..\RunOnce: [sysxo.exe] C:\WINDOWS\sysxo.exe
O4 - HKLM\..\RunOnce: [sdkwe32.exe] C:\WINDOWS\system32\sdkwe32.exe
O4 - HKLM\..\RunOnce: [apiut32.exe] C:\WINDOWS\apiut32.exe
O4 - HKLM\..\RunOnce: [sdkqo.exe] C:\WINDOWS\sdkqo.exe
O4 - HKLM\..\RunOnce: [netub32.exe] C:\WINDOWS\netub32.exe
O4 - HKLM\..\RunOnce: [atljq32.exe] C:\WINDOWS\atljq32.exe
O4 - HKLM\..\RunOnce: [apijw32.exe] C:\WINDOWS\system32\apijw32.exe
O4 - HKLM\..\RunOnce: [apixt.exe] C:\WINDOWS\system32\apixt.exe
O4 - HKLM\..\RunOnce: [netdp.exe] C:\WINDOWS\system32\netdp.exe
O4 - HKLM\..\RunOnce: [ntqs.exe] C:\WINDOWS\ntqs.exe
O4 - HKLM\..\RunOnce: [apime.exe] C:\WINDOWS\system32\apime.exe
O4 - HKLM\..\RunOnce: [crjt32.exe] C:\WINDOWS\system32\crjt32.exe
O4 - HKLM\..\RunOnce: [ieaa.exe] C:\WINDOWS\system32\ieaa.exe
O4 - HKLM\..\RunOnce: [appee32.exe] C:\WINDOWS\system32\appee32.exe
O4 - HKLM\..\RunOnce: [winnf.exe] C:\WINDOWS\system32\winnf.exe
O4 - HKLM\..\RunOnce: [addtb32.exe] C:\WINDOWS\system32\addtb32.exe
O4 - HKLM\..\RunOnce: [winhy32.exe] C:\WINDOWS\winhy32.exe
O4 - HKLM\..\RunOnce: [javamv32.exe] C:\WINDOWS\system32\javamv32.exe
O4 - HKLM\..\RunOnce: [addhg32.exe] C:\WINDOWS\addhg32.exe
O4 - HKLM\..\RunOnce: [javaux.exe] C:\WINDOWS\system32\javaux.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\sdkzw.exe
Now, with all windows closed except HiJackThis, click "Fix checked".
===============
When your done, rescan your system and make sure the following isn't present:
N3 - Netscape ... 5CSBWeb_01.src (or) 5CSBWeb_02.src
If it is, then fix that entry again; sometimes it'll take more than one pass. The actual entry is ok, and won't be deleted, it's the java wrapper marked in red that needs to be removed.
===============
Locate and delete the following item(s), if present. Make sure your able to " view system and hidden files/ folders: "
folders...
C:\Program Files\PartyPoker
files...
C:\WINDOWS\ietf32.exe
C:\WINDOWS\nzunt.dll
C:\WINDOWS\vtzzf.dll
C:\WINDOWS\system32\crdc32.dll
C:\WINDOWS\crni32.dll
C:\WINDOWS\system32\apijw32.dll
C:\WINDOWS\system32\sdkpb32.dll
C:\WINDOWS\system32\javajp.exe
C:\WINDOWS\system32\javacq32.exe
C:\WINDOWS\nettf.exe
C:\WINDOWS\system32\sdkzw.exe
C:\WINDOWS\ntma.exe
C:\WINDOWS\system32\iefu32.exe
C:\WINDOWS\system32\ieui32.exe
C:\WINDOWS\system32\apilj32.exe
C:\WINDOWS\mfcpj32.exe
C:\WINDOWS\system32\addzh32.exe
C:\WINDOWS\system32\apirg32.exe
C:\WINDOWS\javals.exe
C:\WINDOWS\system32\atlgh32.exe
C:\WINDOWS\mfcop32.exe
C:\WINDOWS\system32\netaf32.exe
C:\WINDOWS\sdkoq.exe
C:\WINDOWS\ntxa32.exe
C:\WINDOWS\sdkqf.exe
C:\WINDOWS\ipun32.exe
C:\WINDOWS\system32\d3ql.exe
C:\WINDOWS\system32\sdkux32.exe
C:\WINDOWS\system32\apiry.exe
C:\WINDOWS\ipqe.exe
C:\WINDOWS\mfcgt.exe
C:\WINDOWS\system32\iexn32.exe
C:\WINDOWS\system32\atljw32.exe
C:\WINDOWS\system32\ieoz.exe
C:\WINDOWS\netob.exe
C:\WINDOWS\system32\syscd.exe
C:\WINDOWS\javamq.exe
C:\WINDOWS\apirs32.exe
C:\WINDOWS\system32\syswp32.exe
C:\WINDOWS\system32\ntde.exe
C:\WINDOWS\system32\apitt.exe
C:\WINDOWS\appxf.exe
C:\WINDOWS\system32\netbc.exe
C:\WINDOWS\system32\sysae.exe
C:\WINDOWS\system32\wintn.exe
C:\WINDOWS\javalc32.exe
C:\WINDOWS\msbk.exe
C:\WINDOWS\system32\appfo32.exe
C:\WINDOWS\syspo.exe
C:\WINDOWS\system32\javaif.exe
C:\WINDOWS\system32\iper.exe
C:\WINDOWS\d3bg32.exe
C:\WINDOWS\winro32.exe
C:\WINDOWS\ienz.exe
C:\WINDOWS\system32\winvd.exe
C:\WINDOWS\netzt.exe
C:\WINDOWS\system32\mfckx32.exe
C:\WINDOWS\apili.exe
C:\WINDOWS\system32\apikn.exe
C:\WINDOWS\mfcsn.exe
C:\WINDOWS\system32\javaic32.exe
C:\WINDOWS\system32\msyj32.exe
C:\WINDOWS\system32\crtv.exe
C:\WINDOWS\system32\netsl32.exe
C:\WINDOWS\addqs32.exe
C:\WINDOWS\appqi.exe
C:\WINDOWS\system32\addzj.exe
C:\WINDOWS\javaff32.exe
C:\WINDOWS\system32\ntir.exe
C:\WINDOWS\system32\atlhh32.exe
C:\WINDOWS\sysxo.exe
C:\WINDOWS\system32\sdkwe32.exe
C:\WINDOWS\apiut32.exe
C:\WINDOWS\sdkqo.exe
C:\WINDOWS\netub32.exe
C:\WINDOWS\atljq32.exe
C:\WINDOWS\system32\apijw32.exe
C:\WINDOWS\system32\apixt.exe
C:\WINDOWS\system32\netdp.exe
C:\WINDOWS\ntqs.exe
C:\WINDOWS\system32\apime.exe
C:\WINDOWS\system32\crjt32.exe
C:\WINDOWS\system32\ieaa.exe
C:\WINDOWS\system32\appee32.exe
C:\WINDOWS\system32\winnf.exe
C:\WINDOWS\system32\addtb32.exe
C:\WINDOWS\winhy32.exe
C:\WINDOWS\system32\javamv32.exe
C:\WINDOWS\addhg32.exe
C:\WINDOWS\system32\javaux.exe
-
Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in " Safe Mode ".
-
Reboot.
===============
After rebooting your PC, rescan with hijackthis and post a new log.
Let me know how things are now.
-
You may want to uninstall Aluria from your PC as they have teamed up with a well known Adware company, WhenU. Read the following if you wish; http://www.dslreports.com/forum/remark,11723816~mode=flat
