1) download these files:
2)
Disable System Restore.
3) Install the Microsoft Antispyware Beta and update it, but don't scan yet.
4) Please follow this carefully:
- Click Start > Run > services.msc to fire up the Windows Services panel, it looks like this picture.
- Click the Status header until the Started ones are all on top.
- Slide open the Name and Description headers enough to show the names and descriptions, like in my picture.
- Get screenshots of those and post them somewhere, you can sign up at http://pics.bbzzdd.com if you need somewhere to host them. And post links to the pictures so I can scope them out, looking for rogue services here.
5) Also post a HijackThis logfile here, the text from it.
6) Install the Kaspersky Antivirus, set its real-time and on-demand scanners to Maximum, go to the Configure Updater panel and choose to update
from a local folder. Use the
update_x folder you got from Kaspersky's FTP site. Don't get hasty and launch a Kaspersky scan just yet.
7) Once I can look at your HijackThis log and your Services list and see if there's any bad services to kill, then you can note down what you'll want to kill and go on to the next stuff.
8)
Restart the computer in Safe Mode. Open Task Manager and try to kill all the processes one by one except for Explorer.exe. If you're not allowed, don't let it bug you, but try.
9) In Safe Mode, run HijackThis and kill whatever we decided needed killing.
10) In Safe Mode still, run an exhaustive Kaspersky antivirus scan and deal with anything it finds.
11) While you're in Safe Mode, you can also run AdAware and Spybot for good measure.
12) Whatever directory that search bar thing lives in, maybe C:\Program Files\SearchBar or whatever, make that exact folder again. Right-click it, choose Properties > Security, and remove all permissions by anyone. :evil:
13) Empty your C:\Windows\Prefetch directory completely and also your Temporary Internet Files.
14) Unplug your network cable or turn off your modem or WAP.
15) Right-click
My Computer, choose
Manage, go down to Local Users & Groups > Users, and right-click each user account and give it a strong password such as
Matts@AT to keep the spyware from pulling a no-brainer exploit of the Admin powers.
16) Reboot into Normal Mode and fire off a full-version Microsoft AntiSpyware scan. Deal with everything it finds, go down the list and make sure it's all set to Remove.
17) Do another HijackThis log and post it.
Hope you've got the patience for all that, it'll probably take you 6-8 hours
🙂 Otherwise, unplugging your network connection, reformatting the hard drive, and reinstalling Windows
carefully could be faster
🙂
