Help, Im stuck

Hi,

I have some sort of browser hijacker that I cant seem to fix.

I have run thru all the steps shown on the other page, except when I run the search and destroy program it always freezes my computer ( I saw that there was a bug in the program and followed those steps fix it also)

Any help would be appreciated

my log is attached

-Aa

 

Download Pocket KillBox
(Don't run it yet)


Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.

Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

d3ch32.exe

atlpi.exe

iexplore.exe <--- You MUST close ALL browsers while running this fix!


Next, Click Start > Run > type services.msc and Click OK

Locate Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) and RightClick on it to bring up the Service Properties Window.
First: Stop the service by clicking the Stop Button.
Next: Disable it by changing the Startup Type to Disabled and click Apply

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\rjces.dll/sp.html#63796

R3 - Default URLSearchHook is missing

O2 - BHO: Class - {C692D7A9-4CB6-C211-2912-C399ED6C9248} - C:\WINDOWS\system32\ieef32.dll

O4 - HKLM\..\Run: [windn32.exe] C:\WINDOWS\windn32.exe
O4 - HKLM\..\Run: [d3ch32.exe] C:\WINDOWS\d3ch32.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O23 - Service: Workstation NetLogon Service ( 11Fßä#·ºÄÖ`I) - Unknown owner - C:\WINDOWS\system32\atlpi.exe
(This may or may not be here)

Again, make sure All Browser Windows are Closed when you Click FIX.


Next: Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Next, you will be entering items into Pocket KillBox. Please select the “Delete on Reboot” Option. Copy&Paste each of the file names listed below into the box one by one, making sure Delete on Reboot is Checked for each entry. Click the Red X for each entry, but DO NOT Allow your machine to be rebooted until the last item has been entered:

** Note: For any of the .dll files, check the Unregister .dll Before Deleting box as well. If this option is not enabled, don't worry about it.

C:\WINDOWS\windn32.exe
C:\WINDOWS\d3ch32.exe
C:\WINDOWS\system32\atlpi.exe
C:\WINDOWS\system32\rjces.dll
C:\WINDOWS\system32\ieef32.dll

• If you get an error message about Pending Operations, just reboot your computer manually.

After you have rebooted, procede with the below steps...

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

After you have completed this entire post, please reboot once more and attach a fresh HJT log from normal mode.

Let me know of any problems you had during this fix and let me know how things are running.

 

Thank you, for the help!!, I have followed the instructions you gave and the HJT log is attached

P.S. I plan on beating that mini golf score ~

-Aa

 

Good Luck!


Please see the below thread on how to install and run Spy Sweeper.

Running Spy Sweeper...

 

I ran spysweeper and hijackthis and the logs are attached


Thanks

 

Please see the below thread on how to install and run Ewido Security Suite.

Running Ewido Security Suite ...