Hey angelbabe 
Just unzip to Desktop.
Leave the programs.
Please print out the remainder of these directions, as you'll have to proceed in Safe Mode. Now, disconnect to the net.
Go to Taskmanager ctrl+alt+del Processes, find:
APILE32.EXE
NTES32.EXE
ADDCX.EXE
APPIT.EXE
Rightclick on them-end proces
Start-run, type:regedit
Find- HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
check for a key called-HOMEOldsp, if present- delete it.
And if you have some files in searchpage/searchbar which end with …\sp delete them
Go to Edit in registry and type - HOMEOldsp. Click-Find Next, delete it-if present.
Use F3 for search more, if you find more- delete them.
Same procedure with-About:blank
Close Registry.
Reboot to Safe Mode - F8
Scan with HijackThis , close all other windows and browsers, and place a checkmark next to these items, and fix:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\orcto.dll/sp.html#28129
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\orcto.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\orcto.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\orcto.dll/sp.html#28129
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\orcto.dll/sp.html#28129
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\orcto.dll/sp.html#28129
R3 - Default URLSearchHook is missing
O4 - HKLM\..\RunServices: [APILE32.EXE] C:\WINDOWS\SYSTEM\APILE32.EXE
O4 - HKLM\..\RunServices: [NTES32.EXE] C:\WINDOWS\NTES32.EXE
O4 - HKLM\..\RunServices: [ADDCX.EXE] C:\WINDOWS\ADDCX.EXE
O4 - HKLM\..\RunServices: [APPIT.EXE] C:\WINDOWS\SYSTEM\APPIT.EXE
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM\Shdocvw.dll
find and delete these files:
C:\WINDOWS\orcto.dll
C:\WINDOWS\SYSTEM\APILE32.EXE
C:\WINDOWS\NTES32.EXE
C:\WINDOWS\ADDCX.EXE
C:\WINDOWS\SYSTEM\APPIT.EXE
They are not legal files!
Double click the AboutBuster.exe file. Click OK, then click Start, then click OK.
This will scan your computer for the bad files and delete them. Save the report it creates (copy and paste it into notepad and save as a .txt file).
Run Ccleaner, put a checkmark to Temporary internet files, cookies.
Empty Recycle Bin.
Start-Run Type: %temp% delete all files
Now run the Scanner, you downloaded from Microworld.
Activate all in settings
Reboot,this should be your first reboot! Run Adware
post new log, with AboutBuster log
---------------------------------------------------------------------------
Touch
Proud member of:
| 
There were about 400 files affected
All but 4 have been put in vault. In my HJT log i found four entries where AVG has said the virus/s are. 
This is the most stubborn trojan i have come across. In hindsight, I should have known something was wrong because my homepage kept on changing to about:blank and i also got Only the Best popups. 
|