help me get rid of derbiz please!!

can someone please help me get rid of this its been bugging me for ages?

 

Please look in Add/Remove Programs and uninstall EliteToolBar if it exist.

I notice that your Operating System is WAY out dated. After we get your system clean I suggest you go to Windows Updates and get updated. You need to install Service Pack 2 for security purposes and other reasons.

Also, I noticed you didnt do the online scans in the READ ME. So lets start by doing this because it appears you have the W32.Bezilom.Worm.

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After doing these online scans, reboot and post a fresh HJT log.

 

sorry hadn't read the read me, my mistake. done it all now tho heres my new hjt file

 

Just to be sure, Freeserver is your ISP, correct?

Please print out these instructions so that you can operate with All Browser Windows CLOSED.

Please make sure System Restore is OFF and the Viewing of Hidden Files & Folders is Enabled as per the tutorial.


Now, look in Task Manager (Ctrl-Alt-Del) for the following running processes and, if you see any of them, try to END them:

csms.exe

wp.exe

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://community.derbiz.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://hsremove.com/done.htm

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=http://www-cache.freeserve.com:8080;ftp=http://www-cache.freeserve.com:8080
If you are familiar with this entry, leave it!

O2 - BHO: (no name) - {ED103D9F-3070-4580-AB1E-E5C179C1AE41} - (no file)

O4 - HKLM\..\Run: [cmssSystemProcess] c:\windows\system32\csms.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitedza32.exe
O4 - HKLM\..\Run: [ASDPLUGIN] C:\WINDOWS\System32\uk_nm.exe -N
O4 - HKCU\..\Run: [WindowsFY] c:\wp.exe

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -%windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Microsoft AntiSpyware helper - {7555CD88-3AD0-442B-B79F-DE34497771D2} - (no file) (HKCU)
O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {7555CD88-3AD0-442B-B79F-DE34497771D2} - (no file) (HKCU)

O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - http://launch.gamespyarcade.com/software/launch/alaunch.cab

Again, make sure All Browser Windows are Closed when you Click FIX.

NOW:
Please boot into Safe Mode with the Viewing of Hidden Files & Folders Enabled and navigate to and DELETE the following if they should remain:

C:\WINDOWS\System32\csms.exe

C:\WINDOWS\System32\elitedza32.exe <--- also look for and delete other files beginning with elite and ending with exe. There could be as many as ten more.

C:\WINDOWS\System32\uk_nm.exe

C:\wp.exe

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:
Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Reboot to Normal Windows , Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

Good Luck!

 

thanks mate everything seems to be running ok now, ur instructions were spot on. heres my new log file

 

Reboot into Safe Mode

Now scan with HijackThis and Check the Boxes for the following:

O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitedza32.exe

Make sure All Browser Windows are Closed when you Click FIX.

NOW:
Navigate to and DELETE the following if they should remain:

C:\WINDOWS\System32\elitedza32.exe <--- also look for and delete other files beginning with elite and ending with exe. There could be as many as ten more.

NEXT:
Run CCleaner

Reboot to Normal Windows , Scan with HijackThis and attach the new log.