Download
- Pocket Killbox
- ExplorerXP

Run HijackThis. Click the 'Do a system scan only' button. Place a checkmark in the box next to the following lines:

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  C:\WINDOWS\Temp\mv3wa9rr.TMP
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following:

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

Using Windows Explorer (right click the Start button and select Explore to open Windows Explorer) navigate to C:\ISeeYouXP and locate the following script:
ShowIT.bat

Double-click to run the batch.

REBOOT to .

Post the following logs:
ISeeYouXP.txt (C:\ISeeYouXP.txt)
HijackThis (C:\Program Files\HJT\hijackthis.log)

Make sure you tell me how things are working.

What extensions are installed on FireFox?

"Only those who fail greatly can ever achieve greatly" - Robert F. Kennedy
Microsoft Most Valuable Professional - Consumer Security (2007-2008)
Member - Alliance of Security Analysis Professionals - Since 2006
Linux Registered User # 363218

Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*).

Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry.

Now run Pocket Killbox:

Choose Tools -> Delete Temp Files and click Delete Selected Temp Files
Then after it deletes the files click the Exit (Save Settings) button.

NOTE: Pocket Killbox will only list the added files it is able to find on the system. So when you do the below, if some files do not show in the list after pasting them in, just continue..

Select:

• Delete on Reboot
• then Click on the All Files button.
• Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
  C:\WINDOWS\Downloaded Program Files\install.log
  C:\WINDOWS\Downloaded Program Files\unagiuninst.exe
  C:\WINDOWS\system32\perfc009.dat
  C:\WINDOWS\system32\perfh009.dat
  C:\WINDOWS\system32\drivers\wnmsav.dat
  C:\WINDOWS\system32\drivers\etc\NetAR.wlt
  C:\WINDOWS\system32\drivers\etc\NetFlt.cfg
  C:\WINDOWS\system32\drivers\etc\SmsFlt.cfg
  C:\WINDOWS\Temp\mv3wa9rr.TMP
• Return to Killbox, go to the File menu, and choose Paste from Clipboard.
• Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

Now boot into SAFE MODE

Open ExplorerXP navigate to and DELETE the following:

• Double-click ATF- Cleaner.exe to run the program.
  Under Main choose: Select All
• Click the Empty Selected button.
  

  If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  

  If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

NOTE: This will remove all files from the items that are checked so if you have some cookies you'd like to save. please move them to a different directory first.

Then, as an added precaution, Go to Start -> Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

Temporary Files
Temporary Internet Files
Recycle Bin

And Click OK.

REBOOT to .

Attach fresh logs for:
HijackThis
ISeeYouXP

"Only those who fail greatly can ever achieve greatly" - Robert F. Kennedy
Microsoft Most Valuable Professional - Consumer Security (2007-2008)
Member - Alliance of Security Analysis Professionals - Since 2006
Linux Registered User # 363218