[phreakmi]

Hello all, recently have noticed 88.80.7.66, a.doginhispen, and b.skitodayplease in my IE7 history, I have been reading on how to get rid of this problem with no success. I have downloaded FindAWF and have attached the file. I have read the other threads on how to get rid of this problem and it makes sense to me but I do not know where to go from here. If any one can help me I would greatly appreciate it.

Thanks so much

[Jason]

Right click on this link DelO15Domains.inf and choose Save As. Save it to your desktop. Right click on that file and choose Install. It will run immediately (you won't be able to see anything happen). You may delete it afterwards. NOTE: This script will delete any sites you may have added to the Trusted Sites. So if you want them back, you have to add them back to the Trusted Sites again.

Double-click FindAWF.exe to start the tool. Then, do the following
Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file:

"C:\Program Files\Microsoft ActiveSync\bak\wcescomm.exe"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\WINDOWS\bak\SM1BG.EXE"
"C:\WINDOWS\system32\bak\ctfmon.exe"
"C:\WINDOWS\system32\bak\NeroCheck.exe"
"C:\Program Files\ATI Technologies\ATI Control Panel\bak\atiptaxx.exe"
"C:\Program Files\Hp\HP Software Update\bak\HPWuSchd2.exe"
"C:\Program Files\HPQ\Default Settings\bak\cpqset.exe"
"C:\Program Files\HPQ\Quick Launch Buttons\bak\EabServr.exe"
"C:\Program Files\Synaptics\SynTP\bak\SynTPEnh.exe"
"C:\Program Files\Synaptics\SynTP\bak\SynTPLpr.exe"
"C:\Program Files\Synaptics\SynTP\bak\SynTPStart.exe"
"C:\WINDOWS\ime\IMJP8_1\bak\IMJPMIG.EXE"
"C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"
"C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe"
"C:\WINDOWS\system32\IME\TINTLGNT\bak\TINTSETP.EXE "
"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\bak\apdproxy.exe"

Close the .txt file and click Yes to save the changes.
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt in your next reply as an attachment.

Please note: Howard or evilfantasy will be along soon to make sure everything is fine.

Regards Jason

[Howard]

Hello and welcome to

I will be dealing with your problems from now on in this thread.

Follow Jason`s instructions and post the requested logfile.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

Thank you Jason for the quick reply sorry for my delayed one, and thank you Howard for taking over again I apologize for my delay in responding. I have attached the requested files.


Thanks so much! Ricki

[Howard]

Please double-click the FindAWF icon once again
This time we are going to remove some folders.


Use the following option: Press 3 then Enter to remove bak folders


A text file opens called: folders.txt
Click below the line and paste the following list of folders to be removed:

C:\WINDOWS\ime\IMJP8_1\bak
C:\Program Files\Adobe\Reader 8.0\Reader\bak
C:\Program Files\Java\jre1.6.0_03\bin\bak
C:\WINDOWS\system32\IME\TINTLGNT\bak
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\bak
C:\WINDOWS\bak
C:\Program Files\Microsoft ActiveSync\bak
C:\Program Files\QuickTime\bak
C:\WINDOWS\system32\bak
C:\Program Files\ATI Technologies\ATI Control Panel\bak
C:\Program Files\Hp\HP Software Update\bak
C:\Program Files\HPQ\Default Settings\bak
C:\Program Files\HPQ\Quick Launch Buttons\bak
C:\Program Files\Synaptics\SynTP\bak

Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

requested file attached

[Howard]

Ok, we still need to get rid of some files, so let`s do the following.

Double-click FindAWF.exe to start the tool. Then, do the following
Select "option #2 - Restore files from bak folders" by typing 2 and press Enter .
A text file will open up. Please copy/paste the following text from the quote box (all except the word QUOTE) into the text file.

"C:\WINDOWS\bak\bak\SM1BG.EXE"
"C:\WINDOWS\bak\bak\SM1BG.EXE"

Close the .txt file and click Yes to save the changes.
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt in your next reply as an attachment.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

[Howard]

Please double-click the FindAWF icon once again
This time we are going to remove some folders.


Use the following option: Press 3 then Enter to remove bak folders


A text file opens called: folders.txt
Click below the line and paste the following list of folders to be removed:

C:\WINDOWS\bak\bak
C:\WINDOWS\bak

Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

[Howard]

Ok mate, we need to remove some files manually.

You might want to copy and paste these instructions into a notepad file. Then you can have the file open in safe mode, so you can follow the instructions easier.

Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT). See how HERE.

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE.

Open your task manager, by holding down the ctrl and alt keys and pressing the delete key.

Click on the processes tab and end process for(if there).

SM1BG.EXE

Close task manager.

Locate and delete the following bold files and/or folders(if there).

C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\bak
C:\WINDOWS\DRIVERS\SM1\SM1bg.exe

Reboot into normal mode and rehide your protected OS files.

Run Smitfaudfix as per the instructions on the page.

Double-click FindAWF.exe to start the tool.
Select "option #1 - Scan for bak folders" by typing 1 and press Enter
When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt as an attachment.

Post a HJT log as per the instructions in this thread HERE as well as the awf.text log.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

here are the files

[Howard]

Both logs are now clean.

I`d like to run a final check for malware.

Download combofix.exe to your desktop. Double click combofix.exe & follow the prompts. A window will open with a warning. Type "1" (and Enter) to start the fix. When the scan completes it will open a text window. Please attach that log back here together with a fresh HJT log. Caution - do not touch your mouse/keyboard until the scan has completed. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop.

Combofix will automatically save the log file to C:\combofix.txt

Post the Combofix log and let me know if you`re still having problems.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

here are the files, i don't see any problems right now thanks for all your help

[Howard]

That all looks clean mate.

Click start/run and type combofix /u into the run box and hit the enter key. Note the space between combofix and forward slash. This will uninstall Combofix and all it`s folders etc.

Turn off system restore.(XP/ME only) See how HERE.

Now, turn system restore back on. This will have deleted all your old restore points and any nasties that are in them. It will also have created a new, clean restore point.

You may want to have a read of this thread HERE.

If you have any further virus/spyware problems, please post in this thread.

I`m now marking this thread as solved.

If you need this thread re-opened please contact a moderator or PM me.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[Howard]

Thread re-opened at OP`s request.

Regards Howard

[phreakmi]

ok so 88.80.7.66 has reappeared in my internet explorer history after only a few hours, do we start over from the beginning again or is a total system restoration inorder now?

[Howard]

Ok, try the following.

Download and run the ATF cleaner programme from HERE and save it to your desktop..

Boot into safe mode.

Double-click ATF-Cleaner.exe to run the program.

* Under Main choose: Select All
* Click the Empty Selected button.

If you use Firefox browser

* Click Firefox at the top and choose: Select All
* Click the Empty Selected button.
* NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

* Click Opera at the top and choose: Select All
* Click the Empty Selected button.
* NOTE: If you would like to keep your saved passwords, please click No at the prompt.
* Click Exit on the Main menu to close the program.

Let me know if that helps at all.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.

[phreakmi]

it has still popped back up in my history any other suggestions

[Howard]

Ok, lets try this mate.

Run SmitFraudfix again as per the instructions in my post #11.

Please post the SmitFraudfix log.

Clear your browsers history, then reboot your system and let me know if you`re still having problems.

Edit: If my instructions above don`t help, go and read THIS and follow the manual removal instructions exactly.

Let me know what works and what doesn`t, if anything.

Regards Howard

This thread is for the use of phreakmi only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our malware Removal forum.