Hi Tracy,
Your not alone this is still causing alot of problems for
people, you will have to use afew different programs to
kill this.
I'll try make it as easy as possible but if you have any
problems just let me know ,
It might help if you copy these instructions to notepad
and save it on your desktop as you may not be able to
access this site while you are running the fixes.
Download these programs first :
Download the new version of NailFix (From racooper)
---------------------------------------------------
http://www.noidea.us/easyfile/file.php?
download=20050711214630636
save to desktop or c:/drive , DO NOT run it yet
Ewido Security Suite :
----------------------
Please download, install, and update the free version of
Ewido trojan scanner:
http://www.ewido.net/en/download/
When installing, under "Additional Options"
uncheck "Install background guard" and "Install scan via
context menu".
From the main ewido screen, click on update in the left
menu, then click the Start update button.
After the update finishes (the status bar at the bottom
will display "Update successful")
Exit Ewido. DO NOT scan yet.
Download Ccleaner
------------------
http://www.ccleaner.com/ccdownload.asp
Download and install, but do not run it yet.
Next Step is to boot into safe mode :
------------------------------------
Reboot into Safe Mode.
Restart your computer and keep tapping the F8 key on your
keyboard.
When you see the option screen, then choose safe mode
from the list,
Once in Safe Mode,
please double-click on nailfix.exe. Click "Next" in the
setup, then make sure "Run Nailfix" is checked and
click "Finish". Your desktop and icons will disappear and
reappear, and a window should open and close very
quickly --- this is normal.
Next, Run Ewido.
Click on the Scanner button in the left menu, then click
on Complete System Scan. This scan can take quite a while
to run.
If ewido finds anything, it will pop up a notification.
If its clearly described as malware(Trojan,Spyware etc..)
have ewido remove the entry,
If you are unsure of an entry, select "none" for the time
being. you can then post the log it produces later and I
can let you know if ewido needs to be run again.
When the scan finishes, click on "Save Report". This will
create a text file. Save to desktop incase its needed
later.
When ewido has finished, next clear the prefetch folder
goto start menu then run and type :
prefetch
delete the contents of this folder (left click and
highlight the files by holding the left mouse button and
covering all the files,then right click and choose delete)
Next run Ccleaner and choose 'Run Cleaner' run it twice
to make sure its clear,then use the 'issues' button and
scan for errors,Fix any that are detected.
Reboot and see hows things look if you are clean you will
need to clear the system restore incase any restore
points have been made since you were infected,Post back
if you need help on that.
If the problems is still there then we might need to
use 'Hijack This' to manually fix the entries but try the
above first and let us know how you get on
Good Luck
Andy
