Help with removing Wildmedia

Begin by following all the steps in this Sticky thread < READ ME FIRST: Basic Spyware, Trojan And Virus Removal >

If you already have any of the programs linked in the tutorial please double check your version to make sure you have the latest one and that you have any/all updates for the programs.

NOTE: In order to resolve the issues you are having it is very important that you at least try to perform all the steps as outlined. If you have any difficulty please post back letting us know what steps you have completed, what you found while doing the scans if anything and details about any problems you have encountered in completing the steps. The more details you can provide the better.

 

Please run these:
http://www.memorywatcher.com/uninst.exe
http://www.windowsecurity.com/trojanscan/

And the get HijackThis version 1.98.2 and post a log as a text attachment.
A tutorial and guidelines for HijackThis log postings is here: http://forums.majorgeeks.com/showthread.php?t=38752

 

What is your expected home page?

Bring up Task Manager by hitting CTRL-ALT-DEL and select processes.
Look for the below process and if found End them:
3lICbm.exe
9wyvDi.exe
soap.exe
KHost.exe
Run HijackThis and have it fix the following 7 lines:
O4 - HKLM\..\Run: [9wyvDi] C:\documents and settings\owner\local settings\temp\9wyvDi.exe
O4 - HKLM\..\Run: [kdx] C:\WINDOWS\kdx\KHost.exe
O4 - HKLM\..\Run: [3lICbm] C:\documents and settings\owner\local settings\temp\3lICbm.exe
O4 - HKLM\..\Run: [3lICbm.exe] C:\documents and settings\owner\local settings\temp\3lICbm.exe
O4 - HKCU\..\Run: [System Soap Pro] C:\PROGRA~1\SYSTEM~1\soap.exe min
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {F54C1137-5E34-4B95-95A5-BA56D4D8D743} (Secure Delivery) - http://www.gamespot.com/KDX22/download/kdx.cab

Enable viewing of hidden files and folders: http://forums.majorgeeks.com/showthread.php?t=37650

Reboot in safe mode: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406

Now delete the below files:
C:\documents and settings\owner\local settings\temp\3lICbm.exe
C:\documents and settings\owner\local settings\temp\9wyvDi.exe
C:\PROGRA~1\SYSTEM~1\soap.exe <--- you will have to expand the names. I know PROGRA~1 is Program Files but I do not know what SYSTEM~1 expands to.

Now reboot in normal mode and tell me how thing are working. Post a new HJT log attachment too.

 

You log looks good now. Are you still having problems?

 

You're Welcome!