Hi,iant
we will be doing all of this from Safe Mode so please
have a look at all the items you need to download them
first then goto Safe Mode
First make sure you can view all hidden files and folders, use this link for help.
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Then Boot to safe mode: Instructions
here
Copy all my instructions into wordpad and save to your desktop. You can't have any open browser windows.
Go to Start->Run and type in services.msc and hit OK. Then look for
Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) and double click on it. Click on the Stop button and under Startup type, choose Disabled.
CAUTION: There is also a service named
Remote Procedure Call (RPC) Locator and one
called Remote Procedure Call (RPC) . These are the legitimate services. Do not stop those two.
Now Download the following
Please download the
Killbox.
Unzip it to the desktop but do NOT run it yet.
Cleanup!
About:Buster,
CWshredder,
Ad-aware, &
Spy-bot
* Updating Ad-aware:
Double-Click the Desktop Icon > Click 'Check For Updates Now' > Click 'Connect'
* Updating Spybot:
Double-Click the Desktop Icon > Click Update > Drop-Down Box UniDo(Europe) > Select Pure-Elite(USA) or EON (AU) > Click 'Search for Updates' > Click 'Download Updates'
Please Copy ALL My Notes Below Into Notepad and Save the File to Your Desktop. You Need to be Offline and In Safe Mode to Remove Everything in your Log
Now rebooot into safe mode (press f8 during reboot, select safe mode) and DON'T reconnect to the net. You MUST be in safe mode to remove the About
:Blank Bug on your system.
Run Hijackthis and place a check next to the following
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about
:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\tmybq.dll/sp.html#55135
R3 - Default URLSearchHook is missing
O2 - BHO: Class - {E4EDC898-7094-9C0B-426A-F49CDE0BAD64} - C:\WINDOWS\mscp32.dll
O4 - HKLM\..\Run: [winfk.exe] C:\WINDOWS\system32\winfk.exe
O4 - HKLM\..\RunOnce: [addtc32.exe] C:\WINDOWS\addtc32.exe
O4 - HKLM\..\RunOnce: [apixg.exe] C:\WINDOWS\system32\apixg.exe
O4 - HKLM\..\RunOnce: [netrk32.exe] C:\WINDOWS\netrk32.exe
O4 - HKLM\..\RunOnce: [crsz.exe] C:\WINDOWS\crsz.exe
O4 - HKLM\..\RunOnce: [sdkps32.exe] C:\WINDOWS\system32\sdkps32.exe
O4 - HKLM\..\RunOnce: [msxy32.exe] C:\WINDOWS\msxy32.exe
O4 - HKLM\..\RunOnce: [mssn32.exe] C:\WINDOWS\system32\mssn32.exe
O15 - Trusted IP range: 64.127.104.144
O15 - Trusted IP range: 64.127.104.144 (HKLM)
O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} -
http://66.117.37.13/gba1305.exe
O23 - Service: Remote Procedure Call (RPC) Helper ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\addtc32.exe" /s (file missing)
and click fix.
Remain in safe mode for the next part of the removal.
- First Run the Cleanit! Program
- Next, Unzip the About
:Buster Program to your desktop > Double-Click the Folder > Double-Click About
:Buster > Click 'OK' > Click 'Start' >
now the program will start to run, it will take a few minutes, once the program is complete go ahead and run the program again.
- Double-Click CWShredder and click 'Fix'
* Close CWShredder, open Ad-aware and make the following changes to the settings in Ad-aware.
o Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Scanning Engine:
check: "Unload recognized processes during scanning."
o Under Ad-aware 6 > Settings (Gear at the top) > Tweak > Cleaning Engine:
Check: "Let Windows remove files in use at next reboot."
Press 'Proceed'
Press 'Start'
* Select option 'Use Custom scanning options'
* Click 'Activate in-depth scan'
* Press 'Select drives\folders to scan' Select the active partition which is usually C:
Click 'Customize'
* Make sure the following are all are Checked:
o 'Scan Within Archives'
o 'Scan Active Processes'
o 'Scan Registry'
o 'Deep Scan Registry'
o 'Scan My IE Favorites For Banned URL'S
o 'Scan My Hosts File'
Click 'Proceed'
* Now press "Next" to let Ad-aware scan your drives.
* Once Ad-aware has completed its scan click 'Next' > Now Click 'Scan Summary' > Click All the Boxes with a Green Check Mark
* Now Click 'Next' and Finally Click 'OK'
Close Out Ad-aware
Open Spybot.
* Click 'Search & Destroy'
* Click 'Check for problems' (the program will now search your HDD)
* Make sure all finding are checked and click 'Fix Selected Problems'
Close SpyBot!
Once in Safe Mode, please run Killbox.
Select "
Delete on Reboot".
Open the text file with these instructions in it, and copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\mscp32.dll
C:\WINDOWS\system32\winfk.exe
C:\WINDOWS\addtc32.exe
C:\WINDOWS\system32\apixg.exe
C:\WINDOWS\netrk32.exe
C:\WINDOWS\crsz.exe
C:\WINDOWS\system32\sdkps32.exe
C:\WINDOWS\msxy32.exe
C:\WINDOWS\system32\mssn32.exe
Return to Killbox, go to the File menu, and choose "
Paste from Clipboard".
Click the red-and-white "
Delete File" button. Click "
Yes" at the Delete on Reboot prompt. Click "
No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.
Then do this here
click start->settings->control panel->internet options->programs tab->RESET WEB SETTINGS
That will change everything back to defaults (M$)......
Change your homepage and search engines to whatever you wish and reset your pc.
When it boots back up, open IE and see if the page stays the way that you set it.
& also this here
Make your Internet Explorer more secure - This can be done by following these simple instructions:
1. From within Internet Explorer click on the
Tools menu and then click on
Options.
2. Click once on the
Security tab
3. Click once on the
Internet icon so it becomes highlighted.
4. Click once on the
Custom Level button.
1. Change the
Download signed ActiveX controls to
Prompt
2. Change the
Download unsigned ActiveX controls to
Disable
3. Change the
Initialize and script ActiveX controls not marked as safe to
Disable
4. Change the
Installation of desktop items to
Prompt
5. Change the
Launching programs and files in an IFRAME to
Prompt
6. Change the
Navigate sub-frames across different domains to
Prompt
7. When all these settings have been made, click on the OK button.
8. If it prompts you as to whether or not you want to save the settings, press the
Yes button.
5. Next press the
Apply button and then the
OK to exit the Internet Properties page.
Reboot back into normal mode
Download the Hoster from here:
http://www.funkytoad.com/download/hoster.zip
Press 'Restore Original Hosts' and press 'OK'
Exit Program.
Once complete post a fresh Hijackthis log in your thread.
HGD
Re: Have I been hijacked?
Re: Have I been hijacked?
Re: Have I been hijacked?
Re: Have I been hijacked?
