Spyware Removal

- Download HijackThis 1.99.1

- Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

- Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

- Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

- Run HijackThis and save your log file.

- Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).

 

Your Windows OS and IE versions are way out of date and present a major security risk. When we fix your current problems you MUST got to Windows Update and get your updates.


If you are using WinXP or WinMe, make sure you have system restore disabled (per the tutorial).
For all OS types, make sure viewing of hidden files is enabled (per the tutorial).

Please run HijackThis and click on the "Open the Misc Tools Section" button on the open page. Then select "Open process manager" on the left-hand side. Look for the following process (or processes) and one at a time kill them by selecting it and then click "Kill process". Then click yes.
C:\WINDOWS\System32\userinit32.exe
C:\WINDOWS\System32\slserver.exe

After killing all the above processes, click "Back".

Then please click "Scan" and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.ninemsn.com.au/0SEENAU/SAOS01
F2 - REG:system.ini: UserInit=userinit.exe,userinit32.exe
O4 - HKLM\..\Run: [wuangrd32] wuangrd32.exe
O4 - HKLM\..\Run: [snapple] snapple.exe
O4 - HKLM\..\Run: [NAV Auto Updates] slserver.exe
O4 - HKLM\..\Run: [etbrun] C:\windows\system32\elitebut32.exe
O4 - HKLM\..\RunServices: [wuangrd32] wuangrd32.exe
O4 - HKLM\..\RunServices: [snapple] snapple.exe
O4 - HKLM\..\RunServices: [NAV Auto Updates] slserver.exe
O4 - HKCU\..\Run: [snapple] snapple.exe
O4 - HKCU\..\Run: [wuangrd32] wuangrd32.exe
O4 - HKCU\..\Run: [NAV Auto Updates] slserver.exe
O4 - HKCU\..\RunServices: [wuangrd32] wuangrd32.exe
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe

After clicking Fix, exit HJT.

Boot into safe mode and use Windows Explorer to delete:
C:\WINDOWS\System32\userinit32.exe
C:\WINDOWS\System32\slserver.exe
C:\WINDOWS\System32\wuangrd32.exe
C:\WINDOWS\System32\snapple.exe
C:\windows\system32\elitebut32.exe <--- while looking for this file look for any others beginning with elite and delete them too. Sometimes there are up to 8 more of these files beginning with elite and ending in .exe.
C:\WINDOWS\System32\hwclock.exe

(the hwclock.exe process may require a special procedure to remove in our next set of messages).

If you get an error when deleting a file. Right click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again. Other wise open Task Manager and kill the process if running then delete the file.

Now run Ccleaner (installed while running the READ ME FIRST).
Now reboot in normal mode and post a new HJT log. And tell us how things are working.

 

Please verify the below settings and tell me if any were set differently:

Right Click Start.
Select Explore
Select the Tools menu and click Folder Options.
Select the View Tab.
Under the Hidden files and folders heading select Show hidden files and folders.
Uncheck the Hide extensions for known file types option.
Uncheck the Hide protected operating system files (recommended) option.
Click Apply.
Click OK.

 

Do you use Viewpoint? If not, fix the below line.
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=www.viewpoint.com

Other than that, your log is clean.

You now need to get your system updated! Please follow the steps in the below thread to help keep you safe. The first step in that thread is a link to Microsoft Update. If you do not want to install WinXP SP2, select Custom Install and choose all the Updates except WinXP SP2. These updates will be quite large. You really need to get up to at least XP SP1a at an absolute minimum.

How to Protect yourself from malware!

 

You're welcome. Happy to see you got this all fix and now you have updated!