Hi. First of all you need to update hijackthis to version 1.98.1 Run hijackthis & go to *Config\Misc Tools\Check for update on-line*. Remove 1.97 from the folder it is in & replace it with 1.98.1.
Download About:buster from http://malwarebytes.biz/AboutBuster.zip and unzip it to your desktop. Do not run yet.
Please go here for Wintools removal instructions.
When done please open Task Manager & end process on the following;
winlog.exe
winel.exe
ALGATEWAY.EXE
mfcsn32.exe
Then delete these files manually;
C:\WINDOWS\System32\winlog.exe
C:\WINDOWS\system32\winel.exe
C:\WINDOWS\System32\ALGATEWAY.EXE
C:\WINDOWS\mfcsn32.exe
Close all (browser) windows & rescan with hijackthis. When the scan is finished place a check in the box to the left of the following entries & click 'fix checked':
F2 - REG:system.ini: UserInit=C:\Windows\System32\wsaupdater.exe,
N2 - Netscape 6: user_pref("browser.startup.homepage", "http://www.pqsgygfubztbdglz.com/6VTa9fLZanhuDaMSZAjaTMcg9Bo7OPZC/i1MxMndAfQ.html");\nuser_pref("browser.startup.page", 1); (C:\Documents and Settings\Behzad Malekian\Application Data\Mozilla\Profiles\default\0wge8c5n.slt\prefs.js)
O2 - BHO: (no name) - {7EFD4A6B-37E1-C72F-2816-ABB5899646D5} - C:\WINDOWS\system32\javazt32.dll
Is this next one legitimate? If not, have HJT fix it.
O4 - HKLM\..\Run: [Dvd Dash] C:\PROGRA~1\SUPPOR~1\drvwarnhide.exe
O4 - HKLM\..\Run: [ManagerOnceMapiAcid] C:\Documents and Settings\All Users\Application Data\poll ace manager once\Movestyle.exe
O4 - HKLM\..\Run: [Application Layer Gateway] ALGATEWAY.EXE
O4 - HKLM\..\Run: [mfcsn32.exe] C:\WINDOWS\mfcsn32.exe
O4 - HKLM\..\Run: [Windows Login] winlog.exe
O4 - HKLM\..\RunServices: [Windows Login] winlog.exe
O4 - HKLM\..\RunServices: [WUPDATE16] wupdate16.exe
O4 - HKLM\..\RunServices: [virsscan] C:\WINDOWS\System32\WinT\scsaver.exe
O4 - HKLM\..\RunServices: [Virtual System Monitor] pmfdsd.exe
O4 - HKLM\..\RunOnce: [winel.exe] C:\WINDOWS\system32\winel.exe
O4 - HKLM\..\RunOnce: [addkx.exe] C:\WINDOWS\addkx.exe
O4 - HKLM\..\RunOnce: [iesk.exe] C:\WINDOWS\system32\iesk.exe
O4 - HKLM\..\RunOnce: [atlql.exe] C:\WINDOWS\atlql.exe
O4 - HKLM\..\RunOnce: [mfcmo.exe] C:\WINDOWS\mfcmo.exe
O4 - HKLM\..\RunOnce: [mfclh.exe] C:\WINDOWS\mfclh.exe
O4 - HKLM\..\RunOnce: [addtb32.exe] C:\WINDOWS\addtb32.exe
O4 - HKLM\..\RunOnce: [crmj.exe] C:\WINDOWS\system32\crmj.exe
O4 - HKLM\..\RunOnce: [ipos32.exe] C:\WINDOWS\system32\ipos32.exe
O4 - HKLM\..\RunOnce: [sdkwi.exe] C:\WINDOWS\sdkwi.exe
O4 - HKLM\..\RunOnce: [netwd32.exe] C:\WINDOWS\system32\netwd32.exe
O4 - HKLM\..\RunOnce: [apiyf32.exe] C:\WINDOWS\system32\apiyf32.exe
O4 - HKLM\..\RunOnce: [ipbh32.exe] C:\WINDOWS\ipbh32.exe
O4 - HKLM\..\RunOnce: [mfclx32.exe] C:\WINDOWS\mfclx32.exe
O4 - HKLM\..\RunOnce: [winwj.exe] C:\WINDOWS\system32\winwj.exe
O4 - HKLM\..\RunOnce: [ntqr.exe] C:\WINDOWS\system32\ntqr.exe
O4 - HKLM\..\RunOnce: [apple.exe] C:\WINDOWS\apple.exe
O4 - HKLM\..\RunOnce: [ntqb32.exe] C:\WINDOWS\ntqb32.exe
O4 - HKLM\..\RunOnce: [ntoi32.exe] C:\WINDOWS\ntoi32.exe
O4 - HKLM\..\RunOnce: [addoh32.exe] C:\WINDOWS\addoh32.exe
O4 - HKLM\..\RunOnce: [crus.exe] C:\WINDOWS\system32\crus.exe
O4 - HKLM\..\RunOnce: [atlti32.exe] C:\WINDOWS\atlti32.exe
O4 - HKLM\..\RunOnce: [mfcso32.exe] C:\WINDOWS\mfcso32.exe
O4 - HKLM\..\RunOnce: [atlpz32.exe] C:\WINDOWS\atlpz32.exe
O4 - HKLM\..\RunOnce: [ienu.exe] C:\WINDOWS\system32\ienu.exe
O4 - HKLM\..\RunOnce: [crvh.exe] C:\WINDOWS\crvh.exe
O4 - HKLM\..\RunOnce: [ipip32.exe] C:\WINDOWS\ipip32.exe
O4 - HKLM\..\RunOnce: [crin.exe] C:\WINDOWS\system32\crin.exe
O4 - HKLM\..\RunOnce: [crbe.exe] C:\WINDOWS\crbe.exe
O4 - HKLM\..\RunOnce: [addgs.exe] C:\WINDOWS\addgs.exe
O4 - HKLM\..\RunOnce: [mfcnd.exe] C:\WINDOWS\system32\mfcnd.exe
O4 - HKLM\..\RunOnce: [apiun.exe] C:\WINDOWS\apiun.exe
O4 - HKLM\..\RunOnce: [winrn.exe] C:\WINDOWS\winrn.exe
O4 - HKLM\..\RunOnce: [apioz32.exe] C:\WINDOWS\system32\apioz32.exe
O4 - HKLM\..\RunOnce: [sdkea32.exe] C:\WINDOWS\system32\sdkea32.exe
O4 - HKLM\..\RunOnce: [mfcdf32.exe] C:\WINDOWS\system32\mfcdf32.exe
O4 - HKLM\..\RunOnce: [addza32.exe] C:\WINDOWS\addza32.exe
O4 - HKLM\..\RunOnce: [atllf32.exe] C:\WINDOWS\atllf32.exe
O4 - HKLM\..\RunOnce: [sdkql.exe] C:\WINDOWS\sdkql.exe
O4 - HKCU\..\RunOnce: [Application Layer Gateway] ALGATEWAY.EXE
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/f...etup1.0.0.8.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/04f7748dcf2f18...ip/RdxIE601.cab
O16 - DPF: {DDFFA75A-E81D-4454-89FC-B9FD0631E726} - http://www.bundleware.com/activeX/DS3/DS3.cab
Reboot into safe mode following the instructions here & navigate to & delete the following if found:
C:\Windows\System32\wsaupdater.exe-file
C:\PROGRA~1\SUPPOR~1-folder (If not legitimate)
C:\Documents and Settings\All Users\Application Data\poll ace manager once-folder
C:\WINDOWS\System32\WinT-folder
C:\WINDOWS\addkx.exe
C:\WINDOWS\system32\iesk.exe
C:\WINDOWS\atlql.exe
C:\WINDOWS\mfcmo.exe
C:\WINDOWS\mfclh.exe
C:\WINDOWS\addtb32.exe
C:\WINDOWS\system32\crmj.exe
C:\WINDOWS\system32\ipos32.exe
C:\WINDOWS\sdkwi.exe
C:\WINDOWS\system32\netwd32.exe
C:\WINDOWS\system32\apiyf32.exe
C:\WINDOWS\ipbh32.exe
C:\WINDOWS\mfclx32.exe
C:\WINDOWS\system32\winwj.exe
C:\WINDOWS\system32\ntqr.exe
C:\WINDOWS\apple.exe
C:\WINDOWS\ntqb32.exe
C:\WINDOWS\ntoi32.exe
C:\WINDOWS\addoh32.exe
C:\WINDOWS\system32\crus.exe
C:\WINDOWS\atlti32.exe
C:\WINDOWS\mfcso32.exe
C:\WINDOWS\atlpz32.exe
C:\WINDOWS\system32\ienu.exe
C:\WINDOWS\crvh.exe
C:\WINDOWS\ipip32.exe
C:\WINDOWS\system32\crin.exe
C:\WINDOWS\crbe.exe
C:\WINDOWS\addgs.exe
C:\WINDOWS\system32\mfcnd.exe
C:\WINDOWS\apiun.exe
C:\WINDOWS\winrn.exe
C:\WINDOWS\system32\apioz32.exe
C:\WINDOWS\system32\sdkea32.exe
C:\WINDOWS\system32\mfcdf32.exe
C:\WINDOWS\addza32.exe
C:\WINDOWS\atllf32.exe
C:\WINDOWS\sdkql.exe
In order to view these files you may have to select 'show hidden files/folders.' Instructions on how to here.
Still in safe mode, do the following;
Run About:buster, click OK, Start, and OK again to start the scan. Let it scan and fix everything it finds.
Still in safe mode, do a full system scan with Adaware. When the scan is finished select *next* & place a check in the boxes to the left of what is found & click *next* again. Let it delete those entries.
Reboot your computer in normal mode.
Can you download the following app.
VX2Finder
Reboot and stay off the internet until the entire procedure is complete.
1.) Run Vx2Finder click on the 'Click to find VX2.BetterInternet' button.
2.) Then click 'make log'.
3.) Highlight all the files and click the 'Delete these files' button.
4.) You will be left with notice about one to be deleted on reboot.
5.) Reboot
6.) Run VX2Finder again and click on these buttons in the right pane:
- user agent
- Guardian.reg
- restore policy
7.) Exit and reboot once more.
8.) Run VX2Finder again click on the 'Click to Find VX2.BetterInternet' Button.
9.) Click 'Make Log'
10.) Post the first log and the second log in your next thread with another hijackthis log.
