Complete novice needs help with trojans/adware

Welcome to Majorgeeks!

Please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

• Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support
• Make sure you check version numbers and get all updates.
• Very Important: Make sure you tell us the results from running the tutorial...was anything found? Were you unable to complete any of the scans?...Were you unable to download any of the tools?...Did you do the on-line scans as suggested? etc.

• After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis
​

• When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)
  • Bitdefender
  • Panda Scan
  • HijackThis

.

 

Next time (if there is a next time) save the Bitdefender log as the directions indicate so that the formatting is correct. The file that is save is supposed to be an HTML file saved with a .txt file extension. You save raw text which loses the formatting making it harder to read.

You have a Wareout infection!

Look in Add/Remove programs for UnSpyPC and uninstall if found.

Please download FixWareout from one of these sites:
http://downloads.subratam.org/Fixwareout.exe
http://swandog46.geekstogo.com/Fixwareout.exe

• Save it to your desktop and then run it by double clicking on it. It creates a folder named c:\fixwareout.
• Click Next, then Install.
• Then make sure Run fixit is checked (this runs C:\fixwareout\fixit.bat). And then click Finish.
• The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so.
• Your system may take longer than usual to load; this is normal.
• When your system reboots, follow the prompts. Afterwards, HijackThis will launch. Please click Scan, and check the following items if they still exist:

O1 - Hosts: localhost 127.0.0.1
O4 - HKLM\..\Run: [hgqhp.exe] C:\WINDOWS\system32\hgqhp.exe
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O17 - HKLM\System\CCS\Services\Tcpip\..\{01EF200D-39B4-4B1E-BEBE-CADB01658E03}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{1C9D26B5-773A-456E-8435-EDF4525FC4FE}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CCS\Services\Tcpip\..\{F3F08DB7-48A9-4DB3-A17A-91AC007E5349}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CS2\Services\Tcpip\..\{01EF200D-39B4-4B1E-BEBE-CADB01658E03}: NameServer = 85.255.113.118,85.255.112.100
O17 - HKLM\System\CS3\Services\Tcpip\..\{01EF200D-39B4-4B1E-BEBE-CADB01658E03}: NameServer = 85.255.113.118,85.255.112.100

After clicking Fix Checked, close HijackThis, and click OK to proceed.

At the end of the fix, reboot into safe mode and use Windows Explorer to double check for the below files and delete if found:
C:\Documents and Settings\Melissa Harris\Local Settings\Temporary Internet Files\Content.IE5\8123C5A3\sp2-cydoor-728[1].swf
C:\WINDOWS\SYSTEM32\key.~
C:\WINDOWS\uniq
C:\WINDOWS\drsmartloadb1.dat
C:\WINDOWS\Help\SPAlert.chm
C:\WINDOWS\Temp\_avast4_\unp118297469.tmp
C:\WINDOWS\system32\hgqhp.exe
C:\Program Files\UnSpyPC <--- delete the whole folder if found

Now reboot into normal mode and please attach the contents of the logfile C:\fixwareout\report.txt

There could be additional cleanup to do from Wareout and it the log will let us know.

Also attach a new HijackThis log.

 

Looks good! How is it running?

You have to get a firewall installed which will be part of our next steps if everything is working okay now.

 

Everything you need is covered in the below!

If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!