Welcome to DAL,
You are still showing some signs of CWS infection.
Do you have Grokster?
Go here to learn how to show hidden files/folders:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html#5
Download Clean.bat to your desktop(Save page as or Save as): for later use to clean out your TEMPORARY and PREFETCH files.
http://www.thatcomputerguy.us/downloads/clean.bat
Download the Intermute stand-alone version of
CWShredder from here:
cwshredder.net/bin/CWShredder.exe
Install it and check for updates then exit, we will use it later.
Download
About:Buster from here:
http://www.majorgeeks.com/download4289.html
Unzip it to its own
DESKTOP folder, right click open area on the desktop, click new, the new folder, name the folder Aboutbuster . It is
VITAL that it be unzipped.
Please open/run the program and
check for updates. After you update it exit.
Do not run the actual scan/fix until instructed below.
Disconnect from the internet---pull the plug very important
Now reboot into safe mode by
tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter.
Run hijackthis and click on scan button and put checks next to these:
O2 - BHO: Class - {FA3D5AF1-D568-4BFB-1A26-677DED81D60C} - C:\WINDOWS\system32\sdkaz.dll
O4 - HKLM\..\Run: [netbq32.exe] C:\WINDOWS\netbq32.exe
Nothing open but hijackthis and click on fix checked
Now reboot into safe mode by
tapping your F8 key upon restart and safe mode screen appears, select safe mode and press enter.
Run aboutbuster as many times as it takes to not find anything.
Run CWShredder and click on fix
Hunt for and delete if present:
C:\WINDOWS\
netbq32.exe
Now run that
clean batch file you created earlier, type in
'Y' a couple of times and
press enter at the prompts.
Then:
Go to Start > Run and type:
CLEANMGR.EXE and hit enter.
When prompted select the C: drive and click ok.
Check the boxes for:
Temporary Internet Files
Downloaded Program Files
Recycle Bin
Temporary Files
Click OK or Enter
Reboot
Make sure you are set to
normal startup. Click Start -> Run -> Type Msconfig -> Press Enter -> make sure Startup is set to Normal Start
Post a new HJT log for further review
