cellerado and other popups ..help

Welcome to Major Geeks!

Before we can get started on any malware removal, we need to cleanup all of your overuse of antispyware and antivirus programs. Some of them are ven programs that should not be used at all. You also violated one of the first instructions in the READ & RUN ME that said make sure you only have one antivirus install.

You need to decide whether you want to keep Norton 360 or Windows Oncare Live and then uninstall the other.

Uninstall the below now:
SpyHunter
SpywareBot

Now answer a few questions.

1. Do you use AOL Spyware Protection?
2. Is your copy of Spyware Doctor 5.5 a paid version or free trial? If free, uninstall it now.

You also have the below installed, see my comments and questions in purple:

• BT Yahoo! Applications - does this also include popup blocking, antispyware and antivirus?
• Windows Defender
• X-Cleaner Deluxe - is this a paid version or free trial? If free, uninstall it now.
• XoftSpySE - is this a paid version or free trial? If free, uninstall it now.
• Zero Popup (remove only) - I thought I also saw signs of Stopzilla. You should only use one popup blocker.

After you address the above. Do the below.

Download HostsXpert and then follow the below steps.

• Unzip HostsXpert.zip
  [*]It will create a folder named HostsXpert in whatever folder you extract it to.
  [*]Run HostsXpert.exe by double clicking on it.
  [*]click the Make Writeable? button.
  [*]click Restore Microsoft's Hosts File and then click OK.
  [*]Click the X to exit the program

Run this Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.


Now we need to use ComboFix to remove a bunch of malware files.

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):

Code:

File::
C:\Documents and Settings\Julie\Local Settings\Application Data\jxsxestuht.dat
C:\Documents and Settings\Julie\Local Settings\Application Data\jxsxestuht.exe
C:\Documents and Settings\Julie\Local Settings\Application Data\jxsxestuht_nav.dat
C:\Documents and Settings\Julie\Local Settings\Application Data\jxsxestuht_navps.dat
C:\WINDOWS\Temp\Win1A.tmp
C:\WINDOWS\Temp\si1.tmp
C:\WINDOWS\Temp\si2.tmp
C:\WINDOWS\Temp\si3.tmp
 
Folder::
C:\!KillBox
 
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RealTray"=-
"QuickTime Task"=-

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.


Also delete all files and subfolders in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp
C:\Documents and Settings\Julie\Local Settings\Temp

Now run Ccleaner!

Now run the C:\MGtools\GetLogs.bat file by double clicking on it.

Then attach the below logs:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!