Try this.
===============
Now, let's open a command prompt by going to the start menu and then select 'Run'.
In the box that pops up type in 'cmd'. The command prompt will open.
OR
You can go to Start -> Programs -> Accessories -> Command Prompt. Unregister the dll(s) we're going to remove, by entering the following:
regsvr32 /u ipkg32.dll
regsvr32 /u d3hb32.dll
regsvr32 /u mfcgi.dll
It's ok, if these aren't found or 'error' out. If you want, just copy and paste the individual lines to the command prompt to save typing them in.
===============
Next, Open a command prompt by:
1. Clicking "Start", then "Run...".
2. Enter "cmd" (without the quotes).
3. Enter "services.msc" (without the quotes).
-
Now, locate and 'stop' the following services, if present:
Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) owner ... (C:\WINDOWS\msab.exe)
Look carefully, since the name of the service (above) can be anywhere in the entry; also be careful not to 'stop' any required system services. Once stopped, set this service to disabled.
===============
Run HiJackThis then:
1. Click "Open the Misc Tools Section"
2. Click "Open Process manager"
-
Next, while holding down the CTRL key, locate (if present) and click on (highlight) each of the following:
C:\WINDOWS\msab.exe
C:\WINDOWS\atlbg32.exe
Now double-check and make sure that only those item(s) above are highlighted, then click "Kill process". Now, click "Refresh", check again, and repeat this step if any remain.
===============
Still in HiJackThis, click "Scan", then check(tick) the following, if present:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\jywmx.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {6E151392-9E35-0663-4506-86EAAC399FEC} - C:\WINDOWS\ipkg32.dll
O2 - BHO: Class - {B1318C42-3375-85F2-0B8B-DD594A7686D3} - C:\WINDOWS\d3hb32.dll
O2 - BHO: Class - {B32D8461-B24C-D626-990B-16F9A99073D4} - C:\WINDOWS\system32\mfcgi.dll
O4 - HKLM\..\Run: [netyu.exe] C:\WINDOWS\system32\netyu.exe
O4 - HKLM\..\Run: [appap.exe] C:\WINDOWS\system32\appap.exe
O4 - HKLM\..\Run: [wintp.exe] C:\WINDOWS\system32\wintp.exe
O4 - HKLM\..\Run: [atlbg32.exe] C:\WINDOWS\atlbg32.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\msab.exe
Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
===============
Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:
files...
C:\WINDOWS\msab.exe
C:\WINDOWS\atlbg32.exe
C:\WINDOWS\system32\jywmx.dll
C:\WINDOWS\ipkg32.dll
C:\WINDOWS\d3hb32.dll
C:\WINDOWS\system32\mfcgi.dll
C:\WINDOWS\system32\netyu.exe
C:\WINDOWS\system32\appap.exe
C:\WINDOWS\system32\wintp.exe
-
Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in " Safe Mode ".
==
Run about:buster again after trying to update it.
-
Reboot.
===============
After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.
