Clean Spyware From Your System

‡‡Please print out or copy this page to Notepad since you will can not
have any of browsers open while you are fixing this and try to follow it as
closely as possible taking it step by step.



‡‡Update your Antivirus program.



‡‡Please download Spybot Search and Destroy install it and update the program.







Code:


http://www.safer-networking.org/en/mirrors/index.html





‡‡Please download VundoFix.exe to your desktop. Ignore the AntiVirus warnings
and download it anyway because you need to run it. Wait on installation and
running.







Code:


http://www.atribune.org/ccount/click.php?id=4





‡‡Download CleanUp! and install it. Wait on installation and running.







Code:


http://www.stevengould.org/downloads/cleanup/CleanUp452.exe





‡‡Please download following program CWSHREDDER. Wait on installation and
running.







Code:


http://www.trendmicro.com/ftp/products/online-tools/cwshredder.exe





‡‡Download about:Buster and save it to your desktop. When it has finished
downloading, unzip the folder to your desktop as well. You should now be left
with an aboutbuster folder on your desktop.Wait on installation and running.







Code:


http://www.malwarebytes.org/AboutBuster.zip





‡‡I would suggest though that you download CCleaner. It is a great little
program that I use every time I close my browser to get rid of temporary files.
I usually just run the cleaner part every time I'm done with the browser.During
the install there will be check marks for checking for updates that part I do
not use and also to install a tool bar for yahoo or something. Make sure those
are unchecked unless you want another tool bar, It is a very safe program and
it is free.(CCleaner Quick Setup: Go to > Options > Advanced > Uncheck
"Only delete files in Windows Temp folders older than 48 hours" for
cleaning malware. files!)







Code:


http://www.ccleaner.com/



__________________________________________________ ___________

‡‡Now make sure no files are hidden. To do this:
For XP go to My Computer->Tools->Folder Options->View tab:
* Under the Hidden files and folders heading:
* select Show hidden files and folders.
For Vista go to the Control Panel->Appearance and Personalization
Under the Folder Options, click Show Hidden files and folders.
* Uncheck Hide protected operating system files (recommended) option.
* Click Yes to confirm and then click OK.
You may change the above options back after your log is clean.



‡‡Turn off system restore.

Steps to turn off System Restore for XP:
1. Click Start, right-click My Computer, and then click Properties.
2. In the System Properties dialog box, click the System Restore tab.
3. Click to select the Turn off System Restore check box. Or, click to select
the Turn off System Restore on all drives check box.
4. Click OK.
5. When you receive the following message, click Yes to confirm that you want
to turn off System Restore:
You have chosen to turn off System Restore. If you continue, all existing
restore points will be deleted, and you will not be able to track or undo
changes to your computer.
After a few moments, the System Properties dialog box closes.
Steps to turn off System Restore for Vista:
1. Control Panel -> System Maintenance -> Back Up and Restore Center
2. On the right column, click on "create a restore point or change
settings" (this requires administrator's password if set)
3. Uncheck all drives.
4. Click OK.
5. When you receive the following message, click Yes to confirm that you want
to turn off System Restore:
You have chosen to turn off System Restore. If you continue, all existing
restore points will be deleted, and you will not be able to track or undo
changes to your computer.
After a few moments, the System Properties dialog box closes.





‡‡Do all steps below in safe mode except for at the end when you generate a new
HiJackThis log.





‡‡Next, please reboot your computer in Safe Mode by doing the following:

1) Restart your computer

2) After hearing your computer beep once during startup, but before the Windows
icon appears, press F8 (Repeatedly).

3) Instead of Windows loading as normal, a menu should appear

4) Use the up arrow key to highlight Safe Mode and press Enter.





‡‡Please run HijackThis and click "Scan". Place checks next to the
following entries if still present in the code and close all browser and other
windows except for HijackThis, and click "Fix Checked".

Code:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =


Code:


http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2


O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - (no
file)
O2 - BHO: SXG Advisor - {76F30661-76C7-48CD-B18E-64F388AE030B} - C:\WINDOWS\dwrmntsdnq.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: edfqvrw - {D573EDD4-5DEA-4DF1-9D5A-329D6861EDC8} - C:\WINDOWS\edfqvrw.dll
O9 - Extra button: (no name) - {85e1f530-48f4-11d9-9629-08ff2ffc9f67} - (no
file)

---------- delete these if you have nothing to do with these IP addresses ----------

[100032, Shanghai, Peoples Rep of China IP address domain]
O17 - HKLM\System\CCS\Services\Tcpip\..\{2C3F5949-C4C6-4E04-BC66-2F04508FE5CE}:
NameServer = 202.96.209.133,202.96.209.5
[Internet Cell, Delhi, India IP address domain]
O17 - HKLM\System\CCS\Services\Tcpip\..\{D46D073B-6CFF-4D20-8DB0-2F8A08CC8AF3}:
NameServer = 218.248.240.135 218.248.240.208
[100032, Shanghai, Peoples Rep of China IP address domain]
O17 - HKLM\System\CS1\Services\Tcpip\..\{2C3F5949-C4C6-4E04-BC66-2F04508FE5CE}:
NameServer = 202.96.209.133,202.96.209.5
[100032, Shanghai, Peoples Rep of China IP address domain]
O17 - HKLM\System\CS2\Services\Tcpip\..\{2C3F5949-C4C6-4E04-BC66-2F04508FE5CE}:
NameServer = 202.96.209.133,202.96.209.5

------------------------------------------------------------------------------------

O21 - SSODL: bfrgnos - {D88F4CC7-D7BA-4C62-84CD-9EE4640A2D09} - C:\WINDOWS\bfrgnos.dll
O21 - SSODL: afxlspw - {CC458859-DDE6-48CF-85FF-5AE8615E996E} - C:\WINDOWS\afxlspw.dll





‡‡Run your Antivirus and do a full scan remember this is all in safe mode.



‡‡Run Spybot Search and Destroy and do a full scan remember this is all in safe
mode.



‡‡Open Cleanup! by double-clicking the icon on your desktop (or from the Start >
All Programs menu). Set the program up as follows:

*Click "Options..."

*Move the arrow down to "Custom CleanUp!"

*Only Check the following for now:

-Empty Recycle Bins

-Delete Cookies

-Delete Prefetch Files

-Clean up All Users

*Uncheck the following:

-Delete Newsgroup cache

-Delete Newsgroup Subscriptions

*Press the Temporary Files Tab and check.

-Scan drives for files matching

Click OK

Press the CleanUp! button to start the program. Reboot/logoff when prompted.

Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does
not make backups. If you have any documents or programs that are saved in any
Temporary Folders, please make a backup or MOVE THEM out of the Temp folder
before running CleanUp! If you have a 64 bit Operating System do NOT run
Cleanup and let me know as we will use another utility.



‡‡Install and run CWSHREDDER

Close all browser windows, open cwshredder.exe then click "Fix" and
let it run.



‡‡Double-click on the AbouBuster.exe icon.

Click Begin scan. Close when completed.

It is advised that you run the AbouBuster twice in a row to make sure you get
all the infections.

__________________________________________________ ___________

NOTE For AboutBuster: If you recieve the error"Run-time error '339': Component
'comctl32.ocx' or one of its dependencies not correctly registered: a file is
missing or invalid".
Click Start, Run, and enter:
Code:
regsvr32 C:\windows\system32\COMCTL32.OCX

Then click OK.

If that does not fix the error message with about:buster, try the following:

1. Download and install COMCTL32.OCX:
2. Download COMCTL32.OCX






Code:


http://downtown.vc/index.php?page=main&id=ea89e2058&name=COMCTL32.OCX



* Back up your current copy of COMCTL32.OCX and copy the new version to the
same file location. This file should be located in c:\windows\system32.
* Click on the "Start" button and then click on "Run".
* Copy and paste the following into the box:
Code:
regsvr32 \windows\system32\COMCTL32.OCX

* You should see a message saying "DllRegisterServer ... succeeded".



__________________________________________________ ___________



‡‡Double-click VundoFix.exe to run it(Do this a few times until nothing shows
up).



‡‡Then install CCleaner but note it installs the Yahoo Toolbar as an option
which IS check marked by default during the installation. IF you do NOT want it,
REMOVE the checkmark when provided with the option.

Before first use, select Options > Advanced and UNCHECK Only delete files in
Windows Temp folder older than 48 hours

Then select the items you wish to clean up.



In the Windows Tab:





* Clean all entries in the "Internet Explorer" section except Cookies.

* Clean all the entries in the "Windows Explorer" section.

* Clean all entries in the "System" section.

* Clean all entries in the "Advanced" section.

* Clean any others that you choose.





In the Applications Tab:





* Clean all except cookies in the Firefox/Mozilla section if you use it.

* Clean all in the Opera section if you use it.

* Clean Sun Java in the Internet Section.

* Clean any others that you choose.





Click the "Run Cleaner" button.

A pop-up box will appear advising this process will permanently delete files
from your system.

Click "OK" and it will scan and clean your system.

Click the "Issues" button.

Click the "Scan For Issues" button.

Click the "Fix Selected Issues" button.

Click the "Fix All Selected Issues" button.

Click "OK"

Click "Close" when done.





‡‡Reboot into Normal Mode. Turn System Restore back on and create a restore
point.

Steps to turn on System Restore For XP:
1. Click Start, right-click My Computer, and then click Properties.
2. In the System Properties dialog box, click the System Restore tab.
3. Click to clear the Turn off System Restore check box. Or, click the Turn off
System Restore on all drives check box.
4. Click OK.

After a few moments, the System Properties dialog box closes.

To create a new restore point, click on Start – All Programs – Accessories –
System Tools and then select System Restore.

In the System Restore wizard, select Create a restore point and click the Next
button.

Type a name for your new restore point then click on Create.

To create a Restore point for Vista:
1.Control Panel – System Maintenance – Back Up and Restore Center. On the right
column, click on "Create A Restore Point Or Change Settings" (This
requires Administrator's password if set.) Put a check on the drive your OS is
on. Then click on the Create button. Type in a name and then click OK.



‡‡Do another scan with HiJackThis in normal windows mode and post your new log
file here for final verification. Make sure it is a new log file.