win-eto hijacker

Major pain tring to rid of this file...any suggestions?!?

 

First, move Hijackthis to its own folder - C:\Program Files\HJT

Make sure System restore is Off and you have enabled the viewing of hidden files as per our Read me First Sticky Post at the top of the forum..

Then, scan with HijackThis and Check the Boxes for the Following:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://win-eto.com/hp.htm?id=9

O2 - BHO: (no name) - {467FAEB2-5F5B-4c81-BAE0-2A4752CA7F4E} - C:\WINDOWS\system32\W8C6S4~1.DLL

O20 - AppInit_DLLs: 6uv84ufko37im4.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll.dll

Make sure ALL Browser Windows are CLOSED. Then, Click FIX and then, while still in HijackThis, look in the lower right-hand box where it says “Other stuff,” and select CONFIG > MISC TOOLS > select DELETE A FILE ON REBOOT and where it says File Name, Enter (or navigate to the file in HijackThis pane) C:\WINDOWS\System32\6uv84ufko37im4.dll and click OPEN.
A message will ask you if you want to reboot now. Click YES and reboot into Safe Mode by tapping F8.

While in Safe mode, navigate to and DELETE:

C:\WINDOWS\system32\W8C6S4~1.DLL

Then, reboot to normal Windows and attach a fresh log and let's see if that does the trick!

PP