Cleaning house

Hey guys I was wondering if anybody would like to look at a Hijack This log? It is a friends computer and it is littered with junk, she's getting really crappy performance out of her computer. I have done all the steps in the tutorial and got rid of all the other critical threats. Thank You I appreciate the time and help. Just let me know when your ready.

 

If you have completed ALL the steps in the READ ME then procede.

• Download HijackThis 1.99.1

• Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

• Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the ZIP file.

• Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

• Run HijackThis and save your log file.

• Post your log as an ATTACHMENT to your next post. (Do NOT copy/paste the log into your post).

 

Thank you here it is.

 

First:
Download and run the following Removal Tool:

• W32.Gaobot Removal Tool

Second:
Please look in Add or Remove Programs for the following and Uninstall them if found:

Wild Tangent

Ebates

Web Rebates

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.



Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

senscfg.exe

Third:
Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R3 - URLSearchHook: (no name) - _{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)

O2 - BHO: (no name) - SOFTWARE - (no file)

O4 - HKLM\..\Run: [DDCM] "C:\Program Files\WildTangent\DDC\DDCManager\DDCMan.exe" -Background
O4 - HKLM\..\Run: [DDCActiveMenu] "C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe" -boot
O4 - HKLM\..\Run: [Video] explore.exe
O4 - HKLM\..\RunServices: [Video] explore.exe
O4 - HKCU\..\Run: [senscfg] C:\WINDOWS\System32\senscfg.exe

O9 - Extra button: Ebates - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)

Again, make sure All Browser Windows are Closed when you Click FIX.

Fourth:

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\Program Files\WildTangent ←–– Delete this whole folder if it exist!

C:\Program Files\NewDotNet ←–– Delete this whole folder if it exist!

C:\WINDOWS\System32\senscfg.exe


NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Now, for the entry below you will need to run Spybot, but before you do you need to go int Advanced Mode and uncheck ALL of the ignored items, then do a scan.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.


Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

I have done all of the steps you have provided. Here is the new log. Thank you.

 

Log looks good, Good Job!

Are you currently experiencing any further problems?