Hey,Grakus
First no need to be sorry but lit me add this once you start
the fix don't stop go from start to end just take your time
Hello,Grakus & Welcome
First do this for me
Please change the location of HijackThis.exe.
Create a new folder in your C: Drive
Name it C:\HJT or HijackThis and move the HijackThis.exe file in it.
It's best for this tool NOT TO be located in your Desktop or in a TEMP folder.
This way you can undo any changes if something goes wrong
& now
First make sure you can view all hidden files and folders, use this link for help.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Copy all my instructions into wordpad and save to your desktop. You can't have any open browser windows.
Go to Start->Run and type in services.msc and hit OK. Then look for
Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) and double click on it. Click on the Stop button and under Startup type, choose Disabled.
Make sure to close any open browsers. Go into HijackThis->Config->Misc. Tools->Open process manager. Select the following and click Kill process for each one if they are still listed (they shouldn't be - but double check it):
C:\WINDOWS\crek32.exe
C:\WINDOWS\netvq32.exe
C:\WINDOWS\system32\netdm.dll
CAUTION: There is also a service named
Remote Procedure Call (RPC) Locator and one
called Remote Procedure Call (RPC) . These are the legitimate services. Do not stop those two.
Now Download the following
Cleanup!
About:Buster,
CWshredder,
Ad-aware, &
Spy-bot
* Updating Ad-aware:
Double-Click the Desktop Icon > Click 'Check For Updates Now' > Click 'Connect'
* Updating Spybot:
Double-Click the Desktop Icon > Click Update > Drop-Down Box UniDo(Europe) > Select Pure-Elite(USA) or EON (AU) > Click 'Search for Updates' > Click 'Download Updates'
Please Copy ALL My Notes Below Into Notepad and Save the File to Your Desktop. You Need to be Offline and In Safe Mode to Remove Everything in your Log
Now rebooot into safe mode (press f8 during reboot, select safe mode) and DON'T reconnect to the net. You MUST be in safe mode to remove the About
:Blank Bug on your system.
Run Hijackthis and place a check next to the following
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about
:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\riskl.dll/sp.html#12345
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {66059432-BCBA-0EE4-3589-73A184B410A7} - C:\WINDOWS\system32\netdm.dll
O4 - HKLM\..\Run: [crek32.exe] C:\WINDOWS\crek32.exe
O4 - HKLM\..\RunOnce: [netvq32.exe] C:\WINDOWS\netvq32.exe
O4 - Startup: PowerReg Scheduler.exe
As i had said before if this is your ISP???? don't fix them
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CS1\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\VxD\MSTCP: SearchList = qld.bigpond.net.au
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = qld.bigpond.net.au
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\ntzv.exe (file missing)
and click fix.
Remain in safe mode for the next part of the removal.
- First Run the Cleanit! Program
- Next, Unzip the About
:Buster Program to your desktop > Double-Click the Folder > Double-Click About
:Buster > Click 'OK' > Click 'Start' >
now the program will start to run, it will take a few minutes, once the program is complete go ahead and run the program again.
- Double-Click CWShredder and click 'Fix'
* Close CWShredder, open Ad-aware and make the following changes to the settings in Ad-aware.
o Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Scanning Engine:
check: "Unload recognized processes during scanning."
o Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Cleaning Engine:
Check: "Let Windows remove files in use at next reboot."
Press 'Proceed'
Press 'Start'
* Select option 'Use Custom scanning options'
* Click 'Activate in-depth scan'
* Press 'Select drives\folders to scan' Select the active partition which is usually C:
Click 'Customize'
* Make sure the following are all are Checked:
o 'Scan Within Archives'
o 'Scan Active Processes'
o 'Scan Registry'
o 'Deep Scan Registry'
o 'Scan My IE Favorites For Banned URL'S
o 'Scan My Hosts File'
Click 'Proceed'
* Now press "Next" to let Ad-aware scan your drives.
* Once Ad-aware has completed its scan click 'Next' > Now Click 'Scan Summary' > Click All the Boxes with a Green Check Mark
* Now Click 'Next' and Finally Click 'OK'
Close Out Ad-aware
Open Spybot.
* Click 'Search & Destroy'
* Click 'Check for problems' (the program will now search your HDD)
* Make sure all finding are checked and click 'Fix Selected Problems'
Close SpyBot!
Now Delete the following Files.
Files:
C:\WINDOWS\
ntzv.exe << This file
C:\WINDOWS\
netvq32.exe << This file
C:\WINDOWS\
crek32.exe << This file
C:\WINDOWS\system32\
netdm.dll << This file
Reboot back into normal mode
Download the Hoster from here:
http://www.funkytoad.com/download/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.
Once complete post a fresh Hijackthis log in your thread.
HGD
Re: Help with looking-for.cc spyware
03 AM, on 8/05/2005
