Need help with spyware

This problem happens quite often when a CWS infection has corrupted notepad. As Kodo said, look in the directory where you have HijackThis running from. The hijackthis.log file should be there. Follow Kodo's directions.

 

Did you look in the directory where hijackthis.exe is located?

Have you run CWShredder and clicked Fix?

Did you also run About:buster?

 

Yes, folder = directory. Go here and download the version of notepad.exe for your system. It also tells you where to download it to. See if that helps. Also if still necessary, try renaming hijackthis.exe to myhjt.exe and run that. See if you can scan and save a log that way.

 

Make sure viewing of hidden files is enabled.

That is most likely an AppInit_DLL file that we will need to fix.

1) go here and download Registrar lite and install it: http://www.majorgeeks.com/download469.html
2) Run it, copy and paste this line to reglite's address bar:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
3) Click the "go" tab
4) Find: "AppInit_Dlls" value on the right side panel.
5) DoubleClick on AppInit_Dlls and tell me exactly what you see in the Value field:

If you find the d3d.dll file do this:

- Run Registrar lite again but this time do the following:
- copy the following into the address bar or expand the same key by hand:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

- Rename the Folder Windows to NotWindows highlighted as a light blue (some people call it light purple) folder in the left hand pane of reglite.

- Double Click "AppInit_DLLs" again and clear the data value:
C:\WINDOWS\System32\d3d.dll < delete this line , 'Apply' and 'ok' to set.
- Rename the NotWindows folder back to its original name Windows
- This should make the file visible.
- Now use Windows Explorer to delete C:\WINDOWS\System32\d3d.dll
If you cannot delete it, try the above again from safe mode.


But you could also try running About:Buster in safe mode if that is not what you just tried.