Before using HijackThis Please Do the Following:

1. Set System and Hidden files and folders to show:

For XP:

1. Right-Click My Computer choose Explore, click on Tools, Folder Options.
2. Click the View tab.
3. Place a tick next to Display content of System folders, (answer OK to warnings)
4. Under Hidden files and folders, click Show hidden files and folders.
5. If you see a warning message, click Yes.
6. Click Apply.
7. Click OK.

For 98/2000/ME:

1. Double-click the My Computer icon
2. Click on the View menu, click Folder Options
3. Advanced Settings box, under the "Hidden files" folder, click Show all files.
4. If you see a warning message, click Yes.
5. Click Apply.
6. Click OK.

2. Disable System Restore to prevent re-infection.
(If you have/use it.) Don't forget to turn it back on when your PC is clean!

WinXP.

1. Click the Start button.
2. Right-click My Computer, and then click Properties.
3. On the System Restore tab, check Turn off System Restore or Turn off System Restore on all drives.

WinME.

1. Click Start > Settings > Control Panel.
2. Double-click the System icon.
3. If the System icon is not visible, click View all Control Panel options to display it.
4. On the Performance tab, click File System.
5. On the Troubleshooting tab check Disable System Restore.
6. Click OK. Click Yes, when you are prompted to restart Windows.

3. Download the following scanning software according to your Operating System and follow the installation and setup instructions.

All Users:

HijackThis

SUPERAntiSpyware

2000/XP/Vista Users:

AVG Anti-Spyware



4. Boot into Safe Mode, (continually tap the F8 key during bootup until either a beep sounds, or a menu pops up. Use your arrow keys to navigate to Safe Mode, and hit Enter.)


5. Now please run the following applications according to your Operating System in Safe Mode:

For XP/2000/Vista users:

AVG Scan: Double-click on the AVG icon on your desktop, then On the main screen select the icon "Update" then select the "Update now link".
Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab. Once in the Settings screen click on "Recommended actions" and then select "Quarantine".

Under "Reports" Select "Automatically generate report after every scan"
Un-Select "Only if threats were found"

Next, click the Scanner tab, choose Complete System Scan . When it has finished, click on Reports, select the newest report, and click on Save Report As. Click on the down arrow next to Reports and choose your Desktop to make finding the file easier when posting. Close out of AVG. Remain in Safe Mode.

Note: if during your scan AVG Anti-Spyware "crashes" or "hangs", please try scanning again. If AVG still hangs, click on Scanner, Settings. Uncheck Scan in NTFS Alternate Data Streams as this can cause problems in overly infected systems, then try running a new scan.

For All Users (2000/XP/Vista users, proceedure after AVG scan):

SUPERAntiSpyware Scan: Start the scanner, click "Scan your computer", mark the drives that you want to scan (in the left window). Select "Perform Complete Scan" (in the right window). Click "next".

The scanner will now start to scan. As soon as it has finished, you should mark everything that is found, and let the scanner fix it.

Restart your computer. After reboot, open the scanner again. Click "preferences"-> "stastics/logs". Mark the log. Click "View log", and save the contents of this report to somewhere convenient.


6.Clean up temporary and unneccesary files and folders:
Please download and then run CCleaner

Upon installation, make sure to deselect Yahoo toolbar before clicking on OK.
Once installed, make sure that all options are selected, including Advanced, answer OK to all warnings. Click on Analyze, then Run Cleaner. Repeat until either no further files appear needing to be cleaned, or the same files keep reappearing.

If you have files that cannot be cleaned. Please make a note of them to post back in your thread.


7. Boot into Normal Mode and run HijackThis! (All Users)
Locate the folder you have installed HJT into. Double-click on it to run, and choose Do a System Scan and Save a Log File. A notepad file will open, click on File, Save, and save this file to your Desktop for ease of posting.



When you post:

Please include all requested logs from this PreWork, as well as any uncleaned files.




Please include a detailed description of the problem you are having, be as specific as possible, and tell us any symptoms, scans you may have already done, other than PreWork, and also any hard or software that you may have installed prior to the odd behavior starting.






The PCHF Security Team

__________________

Please download AVG Anti-Spyware 7.5 (30 day free trial)

• Install AVG Anti-Spyware.
• Double-click the icon on the Desktop to launch AVG Anti-Spyware.
• Click on Scanner, Settings tab.
• Under How to Act? - Select Quarantine
• Under Reports - Choose Automatically generate report aftere every scan
• Under How to Scan? - Choose all available options
• Under Possibly Unwanted Software: - Choose all available options
• Under What to Scan? - Choose All files
• Click on Update on the toolbar, Then click on Start Update.

If you are having problems with the updater, you can use this link to manually update AVG Anti-Spyware:
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

When you have finished updating, EXIT AVG Anti-Spyware.

__________________

Download "SUPERAntiSpyware Free Edition" from this link:
SUPERAntiSpyware.com - Downloads

• Install SUPERAntiSpyware
• Double-click the icon on the Desktop to launch SUPERAntiSpyware.
• You will be on the Main Menu.
• Click "Check for Updates".
• Wait for the update to complete.

When you have finished updating, EXIT SUPERAntiSpyware.

__________________

Download HijackThis! 2.02. We urge everyone who are still using the outdated version ( 2.0 Beta or 1.99.1) to upgrade as soon as possible.

Either on your desktop, or in your Program Files, or the location that you keep your anti-malware software in. Create a new folder, name it, HijackThis, and move the zip file into that folder. Unzip the file, into the same folder. You should now see HijackThis.exe, in the folder along with the zip file.

It is important that you install HijackThis! (HJT) as directed in order to have access to restore capabilities.

Unless directed otherwise, HJT should be run in Normal Mode, it should also be run after all other fixes have been completed.

HijackThis is a very powerful program, and you should not arbitrarily fix anything listed, unless instructed to by a trained analyst.

__________________