Please help!

first find these 2 files, copy them and zip them up and send them to me at submit@thespykiller.co.uk
C:\WINDOWS\system\serve.exe
C:\WINDOWS\cihost.exe


Run hijackthis, tick these entries listed below and ONLY these entries, double check to make sure, then make sure all browser & email windows are closed and press fix checked

O2 - BHO: (no name) - {A6F42CAD-2559-48DF-AF30-89E480AF5DFA} - C:\WINDOWS\bho.dll
O4 - HKLM\..\Run: [Key2] C:\WINDOWS\system\serve.exe
O4 - HKLM\..\Run: [cihost.exe] C:\WINDOWS\cihost.exe
O4 - HKCU\..\Run: [cihost.exe] C:\WINDOWS\cihost.exe
O4 - Startup: Microsoft Data Helper.lnk = C:\WINDOWS\system32\cihost.exe

Reboot into safe mode by following instructions here: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406
then as some of the files or folders you need to delete may be hidden do this:
Open Windows Explorer & Go to Tools > Folder Options. Click on the View tab and make sure that "Show hidden files and folders" is checked. Also uncheck "Hide protected operating system files" and untick "hide extensions for known file types" . Now click "Apply to all folders"
Click "Apply" then "OK"

Delete these files

C:\WINDOWS\system\serve.exe
C:\WINDOWS\cihost.exe


then
Reboot normally &

Download and unzip or install these programs/applications if you haven't already got them. If you have them, then make sure they are updated and configured as described

AdAware 6 from http://www.lavasoft.de/support/download

Run ADAWARE

Before you scan with AdAware, check for updates of the reference file by using the "webupdate".
the current ref file should read at least 01R296 16.04.2004 or a higher number/later date

Then ........

Make sure the following settings are made and on -------"ON=GREEN"
From main window :Click "Start" then " Activate in-depth scan"

then......

click "Use custom scanning options>Customize" and have these options on: "Scan within archives" ,"Scan active processes","Scan registry", "Deep scan registry" ,"Scan my IE Favorites for banned URL" and "Scan my host-files"

then.........

go to settings(the gear on top of AdAware)>Tweak>Scanning engine and tick "Unload recognized processes during scanning" ...........then........"Cleaning engine" and "Let windows remove files in use at next reboot"

then...... click "proceed" to save your settings.

Now to scan it´s just to click the "Scan" button.

When scan is finished, mark everything for removal and get rid of it. (Right-click the window and choose"select all" from the drop down menu) then press next and then say yes to the prompt, do you want to remove all these entries.

reboot again

then it is vital that you go here, click Scan for updates in the main frame, and download and install all CRITICAL updates recommended.

then post a new hijackthis log to check what is left

 

Hi nick

unfortunately the files you sent me were the prefetch files from the prefetch folder not the actual .exe files so were no good

check you did delete the actual files themselves and post a new log so we can check if the sytem looks clean

has the hijacking stopped now

from your email you said you had trouble deleting the cihost file

if that is running in safe mode, that would be quite unusual and in which case do this

press CTRL + ALT + DEL once to bring up task manager and look on the processes tab for cihost.exe
click on it and press stop process, then using windows explorer delete it

if it isn't deleted yet before you do so, please do this , right click on it, select send to compressed folder, that makes a zipped copy of it and puts it in c:\windows, then attach that zipped folder to an email and send it to me please.

do the same for the serve.exe file from teh c:\windows\system as well please