Malware Removal Guide - Please Read Before Posting

Remember

• Important: Work the steps in order.
• If you don't understand a step stop and ask!
• Keep all questions/replies in the same thread.
• Continue to respond until given the all clear.
• Be patient: Malware removal can be just as time consuming and stressful for us as it is for you.
• Remember: Just because the symptoms may be gone does not promise that all of the malware is. It is strongly suggested to continue in posting all requested logs until given the all clear. You will then receive final cleanup steps specific to your PC, links to programs and advice to help you prevent infections in the future.
• Copy & Paste all logs unless otherwise requested.

If for some reason you cannot perform one of the steps, move on to the next step and make note of what happened when posting your logs.

Antivirus

• Make sure your antivirus is fully up to date with the latest virus signatures before continuing.
• Run a full scan and remove anything found.

• If you say yes to any of the following:
  • You do not have an antivirus installed.
  • You have an antivirus program or Security Suite that is expired.
  • You just don't like your current antivirus program and want something better.

• If the answer to any of the above is yes:
  • Download one of the free antivirus programs listed below.
    • Avast! Home Edition
    • AVG Free Edition
    • AntiVir Personal
  • Important: Uninstall any old or outdated antivirus program(s), including Security Suites before upgrading or replacing with a new one.
  • Install the new antivirus and make sure it is updated.
  • Do a full system scan and remove or quarantine everything found.

Important: You should only have one antivirus and one firewall installed at any time. If you have two or more of either installed then uninstall all but one now before continuing.

Internet connection problems

If you are having trouble connecting to the internet try running this WinSockFix utility to repair your connection.

• WinSockFix
• Winsock Repair Tutorial

Note: You may want to download WinSockFix now in case the removal process interferes with your Internet connection.

• Click on the Windows Start button and go to the Control Panel
• In the Control Panel, double-click the Add or Remove Programs icon.
  • Vista users see here for Add/Remove Programs location.
• When the Add or Remove Programs window has fully populated.
  • Check for any unknown or suspicious looking programs.
  • Do not uninstall anything you may be unsure of.
  • Post details of unknown or suspicious programs in your post and we will advise on which to uninstall.

For a list of Malware applications that can be found in Add or Remove Programs follow this link: Uninstall Malware via Add or Remove Programs

Step Two

Download CCleaner - Choose the Slim - No Toolbar version.

Alternate download link

• Double click on the ccsetup.exe file to start the installation of the program.
• Select your language and click OK, then Next.
• Read the license agreement and click I Agree.
• Click Next to use the default install location.
• Under Install Options, choose all the default settings
• Click Install then finish to complete installation.
• Double click the CCleaner shortcut on the desktop to start the program.
• On the Windows tab, under Internet Explorer, uncheck Cookies if you do not want them deleted. (If deleted, you will likely need to re-enter your passwords at all sites where a cookie is used to recognize you when you visit).
• If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.
• Click on the Options icon at the left side of the window, then click on Advanced
• Uncheck Only delete files in Windows Temp folders older than 48 hours.
• Click on the Cleaner icon on the left side of the window, then click Run Cleaner to run the program.
• Caution: Only use the Registry feature if you are very familiar with the registry.
• Always back up your registry before making any changes.
• Exit CCleaner after it has completed it's process.

Step Three

Download SUPERAntiSpyware.exe

Alternate download link 1
Alternate download link 2

• Double-click the icon on your desktop to run the installer.
• When asked to Update the program definitions, click Yes
• If you encounter any problems while downloading the updates, manually download and unzip them from here
• Next click the Preferences button.

• Under Start-Up Options uncheck Start SUPERAntiSpyware when Windows starts

• Click the Scanning Control tab.
• Under Scanner Options make sure only the following are checked:

• Close browsers before scanning
• Scan for tracking cookies
• Terminate memory threats before quarantining
• Scan Alternate Data Streams
  
• Please leave the others unchecked.
• Click the Close button to leave the Control Center screen.

• On the main screen click Scan your computer
• On the left check the box for the drive you are scanning.
• On the right choose Perform Complete Scan
• Click Next to start the scan. Please be patient while it scans your computer.
• After the scan is complete a summary box will appear. Click OK
• Make sure everything in the white box has a check next to it, then click Next
• It will quarantine what it found and if it asks if you want to reboot, click Yes
• To retrieve the removal information please do the following:

• After reboot, double-click the SUPERAntiSpyware icon on your desktop.
• Click Preferences. Click the Statistics/Logs tab.
• Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
• It will open in your default text editor (preferably Notepad).
• Save the notepad file to your desktop by clicking (in notepad) File > Save As...

• Save the log somewhere you can easily find it. (normally the desktop)
• Click close and close again to exit the program.
• Copy and Paste the log in your post.

SUPERAntiSpyware is FREEWARE, however you may want to upgrade to the Pro version which features highly advanced real-time protection, scheduled scans, automatic updating and much more. Compare SUPERAntiSpyware Free vs Professional

SUPERAntiSpyware Pro reduced price from $29.95 to $23.96 for using our link! Click here!

Note: Although we have renamed HijackThis to sniper, we will still refer to it as HijackThis or HJT.

Step Eight

Posting the logs

• You are now ready to post the logs.
• Just posting the logs in some instances is not enough information for us.
• Give details including malware names and locations if available.
• Let us know what you've already done to fix the malware (if anything).
• Copy & Paste the logs directly into the thread unless specifically requested to attach them.
• Keep all questions/replies in the same thread.

Logs needed

1. SUPERAntiSpyware log
2. Malwarebytes' Anti-Malware log
3. HijackThis log

Post the logs in the Virus, Spyware & Security Forum

• Once you have posted, please be sure to Subscribe to your thread.
• Check this by going to Thread Tools (at the top of the thread) > Subscribe to this Thread

• On the notification page make sure it is set to Instant notification by email
• Then click Add Subscription so that you are notified when you receive a reply.

Computer Juice does not support illegal activity. We do not support the use of any pirated or otherwise illegal software including Windows itself. If you install the cracked software, you are running executable files from unknown sources. You are in effect giving unknown sources access to information on your hard disk and potentially giving complete control over the operation of your computer.

C-J Malware Removal Posting Guidelines

In order to submit the required logs you will need to be a logged into the forums with a registered account. Registration and use of the forums is free.
To register, you will need to specify a user name and password, and a valid email address.
The administrator may have configured the forum to send you the final part of the registration process by email, so ensure that the email address you provide is valid and working.
See the Computer-Juice FAQ for full details on membership.

• All advice given by anyone here, is taken at risk. While best efforts are made to assist in removing infections safely, the unexpected can happen. Computer-Juice is ultimately not responsible for any damage.
• Anyone who is willing to help in removal can. But we will NOT tolerate ANY inaccurate advice given. The post will be deleted. Multiple offenses will result in a public warning within the thread or a private message. If the warnings are not taken seriously you may be subject to a temporary or permanent ban form Computer-Juice.
• Members posting in help threads should only post help topics. Any post deemed as unnecessary or containing faulty information will be deleted.
• Suggestions are welcome but "Drive by help" will not be tolerated. Include details. Malware removal can stretch into many hours over a few days depending on the time constraints of the OP, and the helper. If you don't know if you have the time to see the fix all of the way through, then don't even start to help!
• There is always risk involved in installing and removing any software. Even a fix that over time has shown to be reliable, can present problems to a few.
• Please do NOT turn off System Restore trying to remove an infection. Doing so would only serve to destroy a known working restore point and won't remove the malware. An infected restore point is better then NO restore point!
• If you start topics at multiple sites for the problem you will be requested to either close out the other help thread(s), or your post with us will be locked. Malware removal can be time consuming and multiple sources of information will only confuse the process. Please don't do it.
• Tell us what problem(s) you are having, and please be specific.
• Do not abbreviate or use chat/text talk. If we misinterpret what is being said the results could be a damaged Operating System.
• Let us know what (if anything) you've already done to fix the problem(s).
• If you do not understand a step, simply ask for information. We will offer any advice necessary to help you.
• Do not post a request for help in someone else's thread. This can lead to confusion, and your post will be deleted with a message to start your own thread.
• Please do not pm/email logs, or fixes, all assistance is to be provided in the forums.
• HijackThis doesn't scan the entire system and is only used for undetected or hard to remove entries. It is not antivirus or antispyware. Therefore we can not ensure a computer is malware free just by seeing a HijackThis log.
• Please do not start more than one topic for the same computer, for the same infection. It will either be removed, or merged with your original thread.
• Following advice and fixes given in other threads is risky. Your symptoms may only appear to be similar. Ignoring this warning and using someone else's fix instructions could lead to serious problems with your operating system.
• Please do not attach infected files!
• Please do not link to infected sites.
• Copy and paste logs into your threads.
• Please don't post a picture to show the problem, the logs will be enough.
• If a screen shot is needed we will request one.
• Do not post screen shots of error messages, type the error message out IN FULL.
• If a screen shot is needed we will request one.
• All posts are to be posted in the forum default black font.
• Once a post is submitted please do not edit it. We would rather see a new post made mentioning the corrections. In many instances we will be reading the post while it is being edited and not know the information has changed. A new post will alert us to the changes.
• At the end of a cleanup please make sure you follow through with any final log requested, and read the links provided. Even if it appears to you that your computer is back to normal operation, we would rather not see you back in a few weeks because the follow up instructions were not applied.
• For rules on posting in all forums see Forum Rules! - Please Read Before Posting!

Regards C-J Staff

Download, Install, and Update AVG Anti-Spyware Free

Please download AVG Anti-Spyware Free to your desktop.

• After the download is complete, double-click on the install file to launch the installation process.
• Follow the prompts and be sure that Launch AVG Anti-Spyware Free is checked.
• Once the AVG Anti-Spyware Free main program screen has opened, click on Update now.
• You will see an update progress bar, followed by an Update Succesful message when updating is complete.
• After the database is installed, Click Scanner | Settings
• Under How to act?
• Select Recommended Actions and choose Quarantine to set the default action for detected malware
• Under the Reports section:
• Select Automatically generate report after every scan
• De-select Only if threats were found

Perform AVG Anti-Spyware scan in safe mode and save the scan report

• Restart the computer
• Watch the screen while it is black. After the BIOS memory check is done, start tapping the F8 key
• If done correctly, the Windows Advanced Options Menu will appear.
• Select Safe Mode from the options menu.
• login with using your usual account name

Continue in normal boot mode only if this method does not work

Perform the AVG Anti-Spyware scan

• Select the Scanner icon at the top
• Click the Scan tab
• Select Complete System Scan.
• Make sure that Set all elements to: shows Quarantine (1)
• If not click on the link and choose Quarantine from the popup menu. (2)
• At the bottom of the window click on the Apply all Actions button. (3)
  

• When done, click the Save Scan Report button. (4)
• Click the Save Report as button.
• Save the report to your desktop. (or where you can easily find it)
• Please save the log as a text (.txt) file.
• Copy and paste the log in your post.

By default, the scan report is saved to a reports sub-folder within the AVG Anti-Spyware 7.5 folder:

C:\Program Files\AVG Anti-Spyware 7.5\Reports\
Or in:
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Quarantine

C:\Users\<user name>\AppData\Roaming\Grisoft\AVG Antispyware 7.5\Reports\

• Now close AVG Anti-Spyware and reboot your system back into Normal Mode

.
Step 1: Download Ad-Aware Free

Download Ad-Aware Free from Lavasoft at the following link: Lavasoft Ad-Aware Free

• Double-click on the installation file and a guide screen should start.
• Follow the prompts to install the software and when it asks if you would like to do a Standard or Advanced Installation, select the Standard
• Continue following the prompts until the program has finished installing.

Ad-Aware should open upon completion of installation.
If not then double-click the Ad-Aware Icon from the desktop.

Step 2: Running Ad-Aware Free

When the program starts for the first time, it will prompt you to enter your registration information. We are using the free version of Ad-Aware 2007 so simply press the Cancel button.

Ad-Aware Free will now open and you will be at a screen similar to the one below.

Step 3: Updating Ad-aware

• Click on the Update button (Figure 1).
• Ad-Awa will now check for new malware definitions and program updates.
• If an update or program update is found you will see a prompt, click on the Yes button and let it download the update.
• Now click on the OK button to go back to the Ad-Aware status screen.

Step 4: Configure the scan settings

• Click on the Settings tab (see Figure 1) in the left navigation bar.
• Next click on the Scanning tab (Figure 2) to see the scan options.

• Under the Scanning tab (Figure 2) please do the following.

• Put checkmarks next to the following settings:

• Unload malicious processes and modules
• Remove malicious LSPs
• Scan Alternate Data Streams (ADS)
• Scan Tracking Cookies
• Scan for MRUs
• Deep Archive Scan
• Unload Modules
• Unload browsers while scanning
• Let Windows remove files at startup
• Deactivate Ad-watch
• Re-analyze scan result

• We also suggest you set the Ignore infection with TAI lower than: to 3.
• When done click the Save button (Figure 2) to save the settings.

Step 5: Scan the computer

• To begin the scan you should click on the Scan tab (Figure 2) in the left navigation bar.
• This will bring you to a screen where you can select the type of scan you would like to perform.
• You should select the Full Scan option (Figure 3) and then press the Scan button (Figure 3) found in the lower right hand corner of the screen.
• Ad-Aware will now scan your computer for malware.

Step 6: Scan Results

• Select items to remove or quarantine
• Put a checkmark in the box next to each item or right-click on the screen and click the Select All Objects option.
• When all the items are selected, you should click on the Remove or Quarantine button (Figure 4) depending on the action you would like to take.
  • Either Remove or Quarantine ALL items.
  • Taking no action is pointless and the scan will just need to be ran again.
• Note: You should then click on the Privacy Objects tab in the scan results and remove all the items that are considered privacy risks.
• You can not add privacy risk items to the quarantine, you can only remove them. Select the items and when you are finished selecting them, click on the Remove button.

• When you are done with this process, click on the Finish button (Figure 4) to go to the Scan Summary screen which contains an overview of the infections found and what action you performed on them.

Optional: How to remove the Ad-Aware Service

Note: Ad-Aware2008 (or any other year) users. Substitute Ad-Aware2008.exe where this guide says Ad-Aware2007.exe.

To disable the unnecessary Ad-Aware Service from running follow this procedure.

To stop Ad-Aware running as a Service.

• Go Start > Run. type in:
  • services.msc
  • Find the Ad-Aware Service and set it to Manual
• Go to Start > Run type in:
  • Notepad.exe and press Enter
• Copy and paste the below quoted text into Notepad:

• In Notepad go to File > Save As...
• Name it start_adaware.bat <<Be sure it is saved as a Text file
• Choose the save location as
  • C:\Program Files\Lavasoft\Ad-Aware 2007
• Double click the start_adaware.bat file to run it.
  • It should look like this
  • 
• Ad-Aware will open, close it.
• Ad-Aware will no longer run as a Service.

Although this has never caused a problem on hundreds of computers the unexpected can happen.
Take care in working this procedure carefully.
We are not responsible for mistakes.
.

.
Download Spybot-S&D

• Double click on the downloaded file to run the installation.

During installation:

• Leave all settings at default except TeaTimer (make sure you uncheck the option during installation)
• Teatimer can be a resource hog and also block the removal of some problems malware.
  • If you already have TeaTimer enabled, see the bottom of this post on how to disable it.
• Do the recommended registry backup.
• During the install agree to search for updates now to install any updates.
• Agree to Immunize the system.
• Make sure you leave the SDhelper (IE bad download blocker) checked to install.

After installation:

• Always check for updated before running a scan.
• If you get the bad checksum error when trying to update, just choose a different server location.
• Also look for the Immunize feature in Spybot and use it.
  • First, in the left column click on the Immunize icon and it will check to see what needs to be immunize.
  • After it completes, leave the default settings and click on the green plus sign at the top that says Immunize.
• Close ALLbrowser windows.
• Now click the Search & Destroy icon. (upper left)
  
• Then on the top menu click the Check for problems button to start the scan.
  
  • Be patient, this can take a while to run.
    
  • Progress will be shown in the status bar at the bottom of the window.
    
  • Do not run any other scans while Spybot is running.
• When the scan completes make sure you select everything and then click Fix selected problems on the top menu bar.

NOTE: Anytime you install updates for Spybot, check for new Immunizations by following the above steps.

How to disable Spybots' TeaTimer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.

• Please disable TeaTimer until your computer is clean.
• TeaTimer can be re-activated once your logs are clean.

First:

• Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
• Choose Exit Spybot S&D Resident

Second:

• Open Spybot S&D
• Click Mode, check Advanced Mode
• Go To Left Panel, Click Tools, then also in left panel, click Resident
• If your firewall raises a question, say OK
• Uncheck the box labeled Resident TeaTimer and OK any prompts.
• Use File, Exit to terminate Spybot
• Reboot your machine for the changes to take effect.

Third:

With both Tea timer and SpyBot closed.
Download ResetTeaTimer.zip

• Unzip the file.
• Double click ResetTeaTimer.bat to remove all entries set by SpyBot's TeaTimer.
• Once finished running, you can delete it. It will not be needed again.

Note: If TeaTimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

Using add/remove programs does a good job of uninstalling programs. Only it does not completely remove all traces of what it uninstalls. There are often empty folders as well as empty Registry Keys.

Revo Uninstaller doesn't just uninstall programs from your computer it completely removes all traces. Not only from the programs file folders but also from the Registry. Leaving much less clutter then most programs built in uninstaller alone can.

• Download Revo Uninstaller
• Double click the installation file on the desktop to run the installer.
• Let it install to the default location.

• You should now have a new Icon on the Desktop.

• Double click the new Revo Uninstaller Icon on the desktop to start the program.

• If there are any program file folders left over you will be presented with a list to be removed.

• Again look at ALL of the entries to ensure they are related to the uninstall.
• Click Select All > Delete to remove the entries.
• Click Finish to go back to the uninstall list.

You are now ready start completely uninstalling programs from your computer.

There are also more advanced features in Revo Uninstaller such as the Hunter Mode, Autorun Manager, Windows Tools and Junk Files Cleaner.

Read more about them at the VS Revo Group Uninstaller Help Pages

Download the Unlocker Installer and save it to the Desktop.

Double click the installer to begin the installation process.

Choose the language and click OK

From the following screens keep choosing Next until you reach the following screen to Choose Components






Unlocker is useful with the following errors: