another clueless spyware victim!

Please follow the steps below:


- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

You may have to disable Ad-aware and BROWSER HIJACK RETALIATOR 1.1.EXE (I do not know too much about this last program) before doing the below because they could stop the program from making the necessary fixes.

Download this file: SpSeHjfix109

Unzip it to your desktop or to a folder.

Boot into Safe Mode

Start SpSeHjfix, click on " Desinfecton starten" (the other button means close) then it will reboot and finish the cleaning.

Run SpSeHjfix one more time.

Reboot in Normal mode.

Run HijackThis again and post a new log. Also post the log from SpSeHjfix, the log should be on your desktop or the same folder as SpSeHjfix.

 

As I indicated in my previous message, the tools you already have installed may be making the cleanup difficult. You may need to uninstall or at a minium disable them as they appear to be blocking some fixes.


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS.000\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS.000\TEMP\se.dll


Now empty your Recycle Bin.


This next step may not work properly if you still have tools running to block these changes. You must allow these changes to occur.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.


Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

This about:blank hijacker may be the only remaining issue and you must get it removed. There will be times when you are going to need IE and this is not an item you want to leave hanging around.

There is possibly a hidden file hanging around that we need to remove. Run the steps below and also answer a question. Are you familar with booting to a DOS prompt and do you know how to run DOS commands to change directories and delete files? It's okay if you are not familiar with this, but I need to know so I can write up a procedure according to your knowledge level.

Please do the following:

Download: "StartDreck", from here: http://www.niksoft.at/download/startdreck.htm
Look to the bottom of that page and click the Download link. It should give your StartDreck217.zip

Unzip to its own folder and start the program,
Press 'Config'
Press 'Unmark All'
Check the following boxes only:
Registry -> Run Keys
System/drivers> Running processes
Press 'Ok'
Press 'Save' and select the location to save the log file
(default is the same folder as the application)

Please attach the log in this thread.

 

We are going to have to boot to an MS DOS prompt to working on fixing this problem.
You should print or write these instuctions down because you will be offline and not running Windows while doing this. Please read thru all of the steps first and ask any questions you may have before beginning. Make sure you understand all steps before starting

Click Start and select Shutdown and in the window that comes up choose the one that says Restart the computer in MD-DOS mode.

When it boots you will be at the command prompt (full screen) enter the below commands each followed by the enter key. Let me know if you have any problems or get any error messages during these steps (tell me the exact error message).

Now in command prompt window do the following:
cd C:\WINDOWS.000
attrib -s -h -r WININOT.BAK
del WININOT.BAK

cd C:\WINDOWS.000\SYSTEM
attrib -s -h -r FHCKNA.DLL
del FHCKNA.DLL

cd C:\WINDOWS.000\TEMP
attrib -s -h -r se.dll
del se.dll

win

After typing win and hitting enter your system will boot back to Windows. The very first thing you need to do after booting Windows is the following (make sure you do not run anything else):

Run HijackThis and select the following lines and then click FIX
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS.000\TEMP\se.dll/sp.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS.000\TEMP\se.dll/sp.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,HomeOldSP = about:blank
O2 - BHO: (no name) - {6EE2F663-C8A4-11D9-8E18-4445CE9F54BB} - C:\WINDOWS.000\SYSTEM\FHCKNA.DLL
O4 - HKLM\..\Run: [sp] rundll32 C:\WINDOWS.000\TEMP\SE.DLL,DllInstall
O15 - Trusted Zone: http://*.windowsupdate.com
O18 - Filter: text/html - {6EE2F662-C8A4-11D9-8E18-4445A1D3F120} - C:\WINDOWS.000\SYSTEM\FHCKNA.DLL
O18 - Filter: text/plain - {6EE2F662-C8A4-11D9-8E18-4445A1D3F120} - C:\WINDOWS.000\SYSTEM\FHCKNA.DLL



After clicking Fix, exit HJT.

Now we need to Reset Web Settings:
1) If you have an Internet Explorer icon on your Desktop, goto step 2. If not, skip to step 3.
2) Now right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK. Then skip step 3.
3) If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

Now reboot your PC again into normal mode and post a new HJT log. And tell us how things are working. And how all the steps went too.

 

You're welcome. Your log is clean. Now to help keep you clean you should make sure you have performed the equivalent of all the steps in the below thread:

How to Protect yourself from malware!