- Install Ewido Anti-Malware
- Double-click the icon on Desktop to launch Ewido
You will need to update Ewido to the latest definition files.
- On the top of the main screen click Shield
- Click the word active to change it to inactive
- On the top of the main screen click Update.
- Then click on Start Update. The update will start and a progress bar will show the updates being installed.
Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only
Go to Start - Control Panel - Add-Remove Programs
Remove the following if found or any variation:
Safety Bar
Please print out or copy this page to Notepad as you will be in Safe Mode and unable to refer to this page.
Run Hijackthis and place a check beside each of the following. Close all other browser windows except HJT.
Click fix checked.
O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Program Files\Safety Bar\Safety Bar.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\ntvdm.dll
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - C:\WINDOWS\system32\urroxtl.dll (file missing)
Reboot into Safe Mode by tapping F8 after the BIOS has loaded.
The Windows Advanced Options Menu appears.
Ensure that the Safe mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Delete the following files or folders (delete item in bold). Please do not be concerned if
any of the items are not found as they may have been automatically removed by actions I had
you take earlier in the cleaning process.
Open Folder Options in Controlpanel >view and check your settings:
Select
Show hidden files and folders
Display the contents of system folders
Uncheck: Hide protected operating system files
Delete:
Files:
C:\WINDOWS\system32\ntvdm.dll
Folders:
C:\Program Files\Safety Bar\Safety Bar.dll
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Run full scan with Ewido
- Click Scanner
- Click on the Scan tab
- Click Complete System Scan to begin scanning.
- When the scan is complete click Recommended Action and change it to Quarantine
- Then click Apply all actions
Once finished, click the Save report button, then click Save Report As. This will create a text file.
Make sure you know where to find this file again (like on the Desktop).
Close ewido security suite.
Note: DO NOT USE the computer while Ewido is scanning. If Explorer or the Control Panel are opened some malware types will reinfect your system or will not be cleaned properly.
Then reboot normally.
Post fresh log from hijackthis and log from Ewido and tell how things are running
Please start your own thread by clicking the new topic button. Do NOT post your problem in someone elses thread.
|