Hi gjeha,
You have what look to be a couple of the nastier baddies that are making the rounds. We'll try to get the bulk of them in one pass (though one baddie replaces legit files with malware and we'll have to reconstitute to good files to their proper locations - Hopefully the AVG run will delete the bad ones...).
***Please DISABLE SpybotSD's "Tea Timer" before doing the steps below!!!! Frankly, I would suggest uninstalling SpyBotSD completeley since you already have Spy Sweeper and Windows Defender in play.
If you are concerned about the "immunize" freature of Spybot, you'd be better off with Spyware Blaster....
Anyhoo, off we go . . .
You may want to print out these instructions for reference, since you will have to restart your computer during the fix.
Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe
Save it to your desktop and run it.
Click Next, then Install, make sure "Run fixit" is checked and click Finish.
The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal. When your system reboots, follow the prompts. Afterwards, HijackThis will launch (If Hijackthis does not launch then please start it yourself).
Please Scan with HJT, and check the boxes for the following items:
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{2630B416-A518-4BDB-B190-5D1B1E47261A}: NameServer = 85.255.115.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{8543C3D6-3471-4A1E-B878-B3F6EA1FDFEA}: NameServer = 85.255.115.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{C8CCAA54-A7DA-4179-A67E-1ADD59A5CA38}: NameServer = 85.255.115.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F451F064-8B7F-4900-BC46-082AFA82A1DE}: NameServer = 85.255.115.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\..\{F4C3B19A-7D4E-4E0A-8A9F-05112DEF4DBA}: NameServer = 85.255.115.107,85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.107 85.255.112.121
O17 - HKLM\System\CS1\Services\Tcpip\..\{2630B416-A518-4BDB-B190-5D1B1E47261A}: NameServer = 85.255.115.107,85.255.112.121
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.107 85.255.112.121
Be sure All Browser Windows are Closed and then Click Fix Checked.
NEXT:
Click Start > Run > type CMD > Enter
Type or Copy&Paste: ipconfig /flushdns > Press Enter
(Be sure to leave the space between the g and the / )
THEN:
Please Download ATF-Cleaner.exe by Atribune to your Desktop.
-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option (if you don’t want it to clean cookies, set it accordingly)
-- Click Empty Selected > OK > EXIT
This will flush TEMP files, etc... as well as clean the Java Cache.
NEXT:
-- Please download and Install AVG Anti-Spyware v7.5
THEN:
RightClick the AVG Anti-Spy Icon in your system tray and do the following:
-- Uncheck Resident Shield
-- Uncheck Automatic Updates
-- Uncheck Start with Windows
* You can reset the above to their defaults AFTER your machine has been deemed “clean,” if you so desire. For now, we need them disabled.
Click Run online update and allow it to run until you see the Update Successful message. If you are unable to do this, please let me know.
NOW, run a full scan:
-- Click on the Scanner button and choose the Settings Tab.
---> Under How to act?, click on Recommended action and choose Quarantine to set default action for detected malware.
--->Under Reports make sure Automatically generate report after every scan is selected and UNCHECK the Only if threats were found box.
-- Leave everything else at their default settings and Select the Scan tab and CLICK Complete System Scan to scan your machine.
-- Upon completion of the scan, Click Apply all actions to place any detected baddies in Quarantine.
-- AFTER clicking Apply all actions, Click on Save Report and select Save the report to your Desktop where you can find it easily.
Again, be sure to Apply All Actions Before saving the Log!!!!! So few people pay attention to this step that it is extremely frustrating!
THEN:
Please download FindAWF by noahdfear and save it to your Desktop.
-- Double click FindAWF.exe and follow the instructions.
-- When the tool has finished scanning, the results will be saved as awf.txt on your Desktop.
-- Please submit that log for me.
LASTLY: Please locate c:\fixwareout\report.txt and post it here along with awf.txt and the AVG Anti-Spyware Log and we'll go from there.
Best Luck :)
PP
