I don't see it in the log, either !!
We can run a couple of things to see if we can draw it out !!
Show Hidden Files :
Click
Start
Open
My Computer
Select the
Tools menu and click
Folder Options
Select the
View Tab
Under the Hidden files and folders heading select
Show hidden files and folders
Uncheck the
Hide protected operating system files (recommended) option.
Click
Yes to confirm.
Click
OK
Download
ATF (Atribune Temp File) Cleaner© by Atribune
Download and Install
Ad-aware SE© by Lavasoft
NOTE: If you have a previous version of Ad-Aware installed, during the installation of the new version (1.06) you will be prompted to uninstall or keep the older version - be sure to
uninstall the previous version.
Close ALL windows except Ad-Aware SE.
Click on the
world icon at the top right of the Ad-Aware SE window and let AdAware SE update the reference list for the adware and malware.
Close
Adaware SE
Download and Install
Ewido Anti-Malware© by Ewido Networks
When installing, under
"Additional Options" uncheck :
"Install background guard"
"Install scan via menu"
Launch
Ewido, there should be an icon on your desktop double-click it.
The program will now go to the main screen
You will need to update Ewido to the latest definition files.
On the left hand side of the main screen click
Update
Then click on
Start Update
The update will start and a progress bar will show the updates being installed.
If you are having problems with the updater, you can use this link to manually update ewido.
Ewido Manual Updates
Close
Ewido when updates finish
Please disable
Microsoft Antispyware, as it may hinder the removal of some entries. You can re-enable it after you're clean.
Right click on the Microsoft AntiSpyware icon (looks like a target) and click on :
Security Agents Status (Enabled)
Disable Real-time Protection
To re enable it, you follow the same steps but click on
Enable Real-time Protection
Reboot to
Safe mode
Restart your computer and immediately begin tapping the
F8 key on your keyboard.
If done right a
Windows Advanced Options menu will appear.
Select the
Safe Mode option and press Enter
Run
ATF Cleaner
Double-click
ATF Cleaner.exe
Under
Main choose:
Select All
Click the
Empty Selected button.
Firefox :
Click
Firefox at the top and choose:
Select All
Click the
Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.
Opera :
Click
Opera at the top and choose:
Select All
Click the
Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.
Click
Exit on the Main menu to close the program.
For
Technical Support, double-click the e-mail address located at the bottom of each menu
Run
Ad-AwareSE
Click on the
Gear icon (second from the left at the top of the window) to access the preferences/settings window:
General Button :
Safety & Settings: Check (
Green) all three.
Tweak Button :
Cleaning Engine :
UNcheck "Always try to unload modules before deletion"
Click
Proceed
Click
"Scan Now" at left
Deselect :
"Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
Select
"Search for low-risk threats"
Select
"Perform full system scan"
Click
Next
If Ad-Aware SE finds bad entries, you will receive a list of what it found in the window
Click on
Next and check all the boxes in the window
Click
Next and
OK to remove
Close
AdawareSE
Run
Ewido Anti-Malware
Click on
scanner
Click on
Complete System Scan and the scan will begin.
When it finds the first infected item put a check next to
"Perform action on all infections", then choose [ b]"remove"[/b]
Once the scan has completed, there will be a button located on the bottom of the screen named
Save report
Click
Save report.
Save the
report.txt file to your desktop.
Close
Ewido Anti-Malware
Reboot to
Normal Mode
Please run
ONE of these
Online Virus Scans :
Run
TrendMicro Housecall
Note: you must use Internet Explorer, other browsers will not work.
Under
"Scan your PC", please click
Scan now. It's free!
Select your location and click the
Go button.
Click the
red magnifying glass button.
Select
Complete Scan.
Please be patient while Housecall downloads.
Please allow the ActiveX Control and when prompted click
install
Put a check next to
My Computer
Leave the following checked:
Scan for Spyware
Check security vulnerabilities
Click the
Next button.
It will download the latest scan engine and pattern files.
When the definitions have been downloaded, the scan will start.
After it's done scanning it will take you to the summary page.
Click the
Next button.
Click the drop-down to choose
delete or
remove on each bad guy found, if you receive a prompt click
OK
Click the
Next button to move onto the recovery (final) portion of the scan.
After everything has been removed, please click the
Show button on everything.
Highlight all the of text and press
CTRL +
C to copy the text.
Open Notepad, hit
Ctrl +
V to Paste
Save it to the desktop
OR
Kaspersky WebScanner
Click on
Kaspersky Online Scanner
You will be promted to install an ActiveX component from Kaspersky, Click
Yes.
The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on
NEXT
Now click on
Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click
OK
Now under select a target to scan:
Select
My Computer
Then the program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the
Save as Text button:
Save the file to your desktop.
Reboot, run HijackThis and post a fresh
HijackThis Log, the
Ewido Log, and the
Virus Scan Log here
