Can´t Remove coolWWWSeach.WCADW and Sitfraud-c

No worries about you english as it's fine


but do please follow our standard cleaning procedures which are necessary for us to provide you support. Also there are steps included for installing, running, and posting HijackThis logs as attachments.

- Run ALL the steps in this Sticky thread READ & RUN ME FIRST Before Asking for Support

Make sure you check version numbers and get all updates.

After doing ALL of the above you still have a problem make sure you have booted to normal mode and run the steps in the below link to properly use HijackThis and attach a log:

Downloading, Installing, and Running HijackThis


When you return to make your next post, make sure you attach the following logs and that you have run these scans in the following order too (these scans are covered in steps 6 & 7 of the READ & RUN ME sticky)

• Bitdefender
• Panda Scan
• HijackThis

.

 

• Please download the below file from one of the two links:

http://download.bleepingcomputer.com/sUBs/combofix.exe

​

http://www.techsupportforum.com/sectools/combofix.exe

​

• Double click combofix.exe & follow the prompts.
• When finished, it will produce a log for you. Attach that log in your next reply

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

 

Please download & run Blacklight Beta

• Hit I accept. It will take you to download page.
• Download blbeta.exe and save it to the Desktop.
• Once saved... double click blbeta.exe to install the program.
• Click accept agreement and Click scan
  This app too may fire off a warning from antivirus. Let the driver load.
  Wait for it to finish.
• If it displays any items...don't do anything with them yet. Just hit exit (close)
• It will drop a log on Desktop that starts with fsbl....big number

Please attach the Blacklight log file!

Also attach a new HJT log.

 

Please run this Virtumonde aka Trojan Vundo Removal and attach the VundoFix log.

Now download Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
O4 - HKLM\..\Run: [ÿ_zskUTOMSYNB] C:\WINDOWS\system32\_zskwrkni04FSH]VHG\BNYSMOTU.exe
O4 - HKLM\..\RunServices: [ÿ_zskUTOMSYNB] C:\WINDOWS\system32\_zskwrkni04FSH]VHG\BNYSMOTU.exe
O4 - HKCU\..\Run: [shell] "C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders\ibm00001.exe"
O4 - HKCU\..\Run: [ÿ_zskUTOMSYNB] C:\WINDOWS\system32\_zskwrkni04FSH]VHG\BNYSMOTU.exe
O21 - SSODL: wHCYBQOip - {50807967-FA2A-D3CD-8BB0-647E71D63F85} - C:\WINDOWS\system32\zcctb.dll


Copy the bold text below to notepad. Save it as fixme.reg to your desktop.
Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot. Note some of the files listed below may not exist but we need to check for them anyway.
C:\WINDOWS\system32\_zskwrkni04FSH]VHG\BNYSMOTU.exe
C:\WINDOWS\\system32\_zskwrkni04FSH]VHG
C:\Arquivos de programas\Arquivos comuns\Microsoft Shared\Web Folders\ibm00001.exe
c:\WINDOWS\system32\lzx32.sys

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now attach a new HJT log and tell me how the steps went.
Make sure you tell me how things are working now!

 

Make sure you have rebooted in Normal Mode (do not open any other processes)

Run Pocket Killbox:
Choose Tools > Delete Temp Files and click OK.

Run Killbox.exe. Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion…say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

C:\WINDOWS\system32\zcctb.dll


If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

After reboot. Run HijackThis and select the following lines (if it still exists) but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:

O21 - SSODL: wHCYBQOip - {50807967-FA2A-D3CD-8BB0-647E71D63F85} - C:\WINDOWS\system32\zcctb.dll

Now exit HijackThis and reboot one more time into normal mode.

Now attach a new HJT log and tell me how the steps went.

Make sure you tell me how things are working now!

 

You're harddisk just died without previous signs of possible failure???? It does not even spin up now?