help with massively infected pc

We cannot be here all the time and it is a weekend. Please be patient.

One thing you must learn though is to post once and then wait for any answer. Each time you post another message you are hurting yourself. You send yourself to the bottom of our work queue each time you post. We work from oldest to newest order. When you bump your thread by adding unnecessary messages or to post intermediate incomplete information rather than waiting until your scans are complete, you loose your place and make it take even longer to get an answer. The moral.....don't bump and when you actually have all necessary information to post. For example, if you are running 3 scans, don't post messages saying you are running them and don't post after each scan. When you complete all 3 scans, then post all logs and any other information.

 

First look in Add/Remove programs for the below and uninstall if found:
clocksync
ieplugin
comet


Start by downloading - Pocket KillBox

Extract it to its own folder somewhere that you will be able to locate it later.


Run HijackThis and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILEOi+Vh7AfA98Gm4Me69ZMbubcD3RW7BXlKjvf62dkU/xKkmynlALeNxSfJnRLpv/IdAfrrapS6dvpxCxuHlSJuz6rFiHLu6uFBJroOJ1qq6fJeDYAWbDA7+hRLoa5RnjVVA0JH1UJdaDkzmJ4FDgQZgcQcG8S0GBJDLvHcQVZunuJE2Y24qH7lNWCMBO/k26IIEpR20fcH2o7J37oioEKbYTSXsnE7VVcBzHQ=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://as.weatherstudio.com/dp/search?x=wKX1ILEOi+UdWpSlz2q9Dzn13Emww/YwX5bEaI0bVldvMFEtvt0B12Emb8jlI/MU735wZ4yvS4ZPqIhLMuEUtxFSUybInnVTXafBLtt0Oo523cdLd5CcRVyuW4ZGi4LYwE5YM+VYk28MctcXJ7am6Q==
R3 - URLSearchHook: (no name) - - (no file)
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [OSS] C:\windows\system32\rlvknlg.exe -boot
O4 - HKLM\..\Run: [BO1HelperStartUp] C:\PROGRA~1\BUTTER~1\BO1HEL~1.EXE /partner BO1
O4 - HKCU\..\Run: [ClockSync] "C:\Program Files\ClockSync\Sync.exe" /q
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZCxdm591YYUS
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://207.188.7.150/300fcaae9b1a22715f05/netzip/RdxIE2.cab
O16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} - http://www.sidestep.com/get/k42037/sb02a.cab
O16 - DPF: {EF98AF7B-1F54-4079-91BC-3996DEABA45A} (Sinstaller Class) - http://www.cursorcafe.com/app_cc/bin/cursorcafe.cab
O16 - DPF: {FFFF0017-0001-101A-A3C9-08002B2F49FB} - http://www.desktoplife.net/23d25380.exe
O18 - Protocol: CDS300 - {AD43AA67-6860-4531-AC8A-0E68F9CF023E} - F:\CDS300\__CDS2.dll (file missing)

After clicking Fix, exit HJT.

Copy the bold text below to notepad. Save it as fixme.reg to your desktop. Be sure the "Save as" type is set to "all files" Once you have saved it double click it and allow it to merge with the registry.

Now run Pocket Killbox by doubleclicking on killbox.exe
Choose Tools > Delete Temp Files and click Delete Selected Temp Files.
Then after it deletes the files click the Exit (Save Settings) button.
NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue.

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\Program Files\Uninstall My Web Search.dll
F:\CDS300\__CDS2.dll
C:\windows\system32\rlvknlg.exe
C:\WINDOWS\pornaccess.exe
C:\WINDOWS\NDNuninstall6_90.exe
c:\windows\system32\rk.bin
c:\windows\downloaded program files\HDPlugin1101.dll
c:\windows\inf\biini.inf
c:\windows\ss3unstl.exe

• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If Killbox does not reboot just reboot your PC yourself.

After reboot locat the below folders and delete if found:
C:\Program Files\ClockSync
c:\program files\MyWay
C:\Program Files\My Web Search

Also delete all files in the below folders except ones from the current date (Windows will not let you delete the files from the current day).
C:\WINDOWS\Temp\
C:\Documents and Settings\Vince\Local Settings\TEMP


Now attach a new HJT log and tell me how the steps went.

Also download the lastest version of ShowNew (changed since you last downloaded it) and attach a new log from ShowNew.

Make sure you tell me how things are working now!

 

Looks a lot better. How is everything running?

Just have HijackThis fix the below line:

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

Do you know what the below is for?
O4 - HKLM\..\Run: [*acplay] C:\WINDOWS\repair\acplay.exe

Get properties info on the acplay.exe file.

 

Okay so how is everything running?

You really do not want to have both Windows Defender and SuperAntiSpyware installed at the same time. If you do not plan on buying SuperAntiSpyware to get full capability then you should uninstall it and keep Windows Defender. If you are going to buy it, then uninstall Windows Defender (but only if you buy it. The free version is not a full feature application.).

Now run Pocket Killbox and from the File menu select Cleanup and Delete all Backups.

If you are not having any other malware problems, it is time to go back to step 1 of the READ & RUN ME to Disable System Restore which will flush your Restore Points. Then reboot and enable System Restore to create a new clean Restore Point.

After that, you should work thru the below link:

How to Protect yourself from malware!

 

Attach a log from Spybot! It probably is just finding a miscellansous registry key!