Open NotePad, and copy the contents of the below "Code" box:-
cd %windir%
attrib -s -r -h svchost.exe
del svchost.exe
cd system32
attrib -s -r -h combop.exe
attrib -s -r -h flsmngr.dll
attrib -s -r -h intel32.exe
del combop.exe
del flsmngr.dll
del intel32.exeGo to File Menu >Save As, and save the file with the name Test.bat and exit from NotePad.
Download Ewido and install it. Then run, you will receive a warning message saying "Database not found", click "OK" for this. Next in the main screen, click "Update" and click "Start Update". After the update process, exit from Ewido.
Download CWShredder and AboutBuster . Download CleanUp! and install it, do not run it now.
Make Windows to show all files:-
Go to Start > My Computer.
Go to Tools menu, click Folder Options (Folder Option will be in View Menu in Win98).
Uncheck Hide protected operating system files.
Then, click to select the option Show hidden files and folders.
Click Apply and then click OK to exit.
Reboot in Safe Mode:-
Restart (or switch ON) the PC.
Then, keep tapping the F8 Key.
From the menu that will be displayed, out of which choose Safe Mode and press Enter.
Run HijackThis and click Do only a System scan.
Then put a check mark infront of below listed entries:-
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,SearchURL = http://top-find4u.com/sp.htm
O4 - HKLM\..\Run: [combop.exe] combop.exe
O4 - HKLM\..\Run: [intel32.exe] C:\WINDOWS\system32\intel32.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\flsmngr.dll
O23 - Service: Power Manager (PowerManager) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
Close all other open programs except Hijackthis and click the button Fix Checked in HijackThis.
Next, run CWShredder and click "Fix". After this, run AboutBuster and click "Begin Removal".
Next, go to Start > Programs > Command Prompt and type the below mentioned command and press ENTER.
netsh winsock reset
Next, double-Click on the file Test.bat, a small DOS type window should open and close immediately.
Run CleanUp!, click "Options" button, move the "Quick Setup" slider to "Thorough CleanUp!" and click "Yes" for the warning message and exit from Options. Click "CleanUp!" to start cleaning. After cleaning, click "Close", and choose "No" to avoid the restarting of PC.
Finally Ewido, click on the "Scanner" button in the left menu, then click on the "Start" button.
If ewido finds anything, it will pop up a notification. You can select "Clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
Reboot to normal mode, run HijackThis again, and post a fresh log. Along with this, post whether CWShredder and AboutBuster detected anything or not.
