Please print or copy and paste these instructions into Notepad and save them on your desktop.
Ok these instructions are long and somewhat complicated. If you need help with any of the steps, please ask!
If both user accounts are infected with the same problems mentioned in your last post. Please stay with
one user account until it is clean, then we'll move on tho the other account!
These are the tools needed of the fix.
Registrar Lite
CWShredder
Ad-Aware SE Personal Edition version 1.05/
1. Download, install and run Registrar Lite.
2. Once it is installed, please double click on the icon that should now be on your desktop. If an icon is not there, then check under the programs section of your Start Menu.
3. Once registrar lite is opened, copy and paste the below line, into the address field of Registrar Lite.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
and press the enter key on your keyboard.
4. You will now be presented with new information in the bottom right and left sections and on the right section and the key called AppInit_DLLs should be highlighted. Double-click on the AppInit_DLLs key and write down the text found in the value field. This is the file that is causing the problem. It is possible that there is no file name in the AppInit_DLLs listed in the key when you double-click on it. Please continue with these steps anyways.
5. Exit Registrar Lite
6. Please make sure that you can view all hidden files.
Click Start.
Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden Files and Folders heading select Show Hidden Files and Folders.
Uncheck hide extensions for known file types.
Uncheck the Hide Protected Operating System Files option.
Click Yes to confirm.
Click OK.
7. Create a new folder on your hard drive called c:\regbackup.
8. Run Registrar Lite again
9. Copy and paste:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
into the address field and press enter on your keyboard. On the left side of the screen the Windows key should be selected and highlighted purple.
10. With the Windows key highlighted click on the File menu, and then click on export.
11. Enter winkey.reg in the name field and change the Save as Type to Regedit4 standard .reg files (*.reg)
12. Change the Save in: dropdown menu to c:\regbackup
13. Then press the Save button
14. With the Windows key highlighted again click on the File menu, and then click on export.
15. Enter Winkey.hiv in the name field and change the Save as Type to Regedt32/WinApi hive files (*.hiv,*.dat, *.*)
16. Change the Save in: dropdown menu to c:\regbackup
17. Then press the Save button
18. When both backups are successfully saved, right-click on the highlighted Windows key and click on the rename option. Rename the Windows key to Windows1.
19. With Windows1 highlighted, look in the right section and double-click on AppInit_DLLs and clear the text in the Value field. That is the dll you have seen previously in Step 4. If a file name does not exist there, then just press the OK button.
20. Rename Windows1 back to Windows and exit the Registrar Lite.
21. Reboot your computer.
22. When you are back at your desktop, navigate to the c:\regback folder. Double-click on the winkey.reg file. When it prompt if you would like to import/merge the data press the Yes button
23. Run Registrar Lite again
24. Copy and paste:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
into the address field and press enter on your keyboard. On the left side of the screen the Windows key should be selected and highlighted purple.
25. While the Windows key is selected (highlighted purple/blue) in the left window, click on File and them Import.
26. Browse to c:\regback and select the winkey.hiv file that we created earlier and press the Open button. Then press the OK button.
27. Now double-click on the AppInit_DLLs key in the right section of the windows and clear the text in the Value field. If their is no DLL listed there, then just press OK.
28. Exit Registrar Lite
29. Now download Cwshredder from the link above.
30. After you download the program, unzip it into the directory c:\cwshredder. Make sure all browser windows are closed and double-click on the cwshredder.exe to start the program.
31. Next click on the FIX button, not the Scan Only button, let it scan your computer. When it is done, exit the program.
32. Next, using Internet Explorer, run both of these two online virus scans:
http://housecall.antivirus.com/
http://www.pandasoftware.com/activescan/
33. Please download and install the latest version of Ad-Aware from the link above.
34. When you run the program make sure you update it and then scan with it and fix any problems it finds.
35. Exit the program when you have fixed it everything it finds.
36. Finally, check to see if the file found in Step 4 still exists on your computer. If it does, delete it.
Please post a fresh HijackThis log.
Credit goes to Grinler for the fix!
Tom
Del.icio.us
Digg
Google
Spurl
Blink
Furl
Simpy
Y! MyWeb
Ad-aware 6 + 8 things
Linear Mode
