If we are to continue, it's important that you follow my instructions.
As for
BitTorrent: It is still installed. It is loading on startup:
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
It is not showing as a 'download manager' of which you have several. To uninstall please go to Add/remove Programs in the Control Panel and uninstall. Once done, use Windows Explorer to access the Programs and delete the BitTorrent folder.
As long as that is running in the background, it is useless to try and clean the malware.
The Shockwave Updater is still running. It looks like you did remove the entry but you didn't disable the updater. It's important that you do that until we can get rid of the continuing MyWebSearch infection. Entry will be removed in HJT. Follow the uninstall directions as given.
When the removal options is not checked in Malwarebytes, all the entries show as
No Action Taken as your original log did. Since Superantispyware has a similar option, I always ask the user to make sure that option gets checked also.
The AVG Security Toolbar is still on the system. Please download and run the removal tool
HERE.Note: You may have to reinstall AVG to uninstall it fully.
MyWebSearch is still on the system. You may notice the following:
Please do the following:
Reopen HJT to
'do system scan only'. Check the following entries if present:
C:\Program Files\Window Hide Tool\Window Hide Tool.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.mywebsearch.com/myweb...ptnrS=ZRxdm690YYGB&ptb=UXzg2_lPuVscMo6onw9KfA
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)>> AVG Security Toolbar
O4 - HKCU\..\Run: [Window Hide Tool] C:\Program Files\Window Hide Tool\Window Hide Tool.exe
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\Shockwave 11\SwHelper_1150600.exe -Update -1150600 -"Mozilla/5.0_(Windows;_U;_Windows_NT_5.1;_en-GB;_rv:1.9.1.6)_Gecko/20091201_Firefox/3.5.6_(.NET_CLR_3.5.30729)" -"http://www.neopets.com/games/dgs/play_shockwave.phtml?va=&game_id=349&nc_referer=&age=1&hiscore=&sp=0&questionSet=&r=8035173&width=600&height=440&quality=high
Close all Windows except Hijackthis and click on
"Fix Checked."
Boot into Safe Mode
- Restart your computer and start pressing the F8 key on your keyboard.
- Select the Safe Mode option when the Windows Advanced Options menu appears, and then press ENTER.
Uninstall the My Web Search option from Add/Remove Programs
1) Click on Start, Settings, Control Panel
2) Double click on Add/Remove Programs
3) Find "My Web Search" in the list of installed programs and click on Change/Remove to uninstall it.
4)You may also want to uninstall any of the following items associated with FunWebProducts.
[*] My Web Search (Smiley Central or FWP product as applicable)
[*] My Way Speedbar (Smiley Central or other FWP as applicable)
[*] My Way Speedbar (AOL and Yahoo Messengers) (beta users only)
[*] My Way Speedbar (Outlook, Outlook Express, and IncrediMail)
[*] Search Assistant - My Way
Include the following in the uninstalls:
[*] ZoneAlarm Spy Blocker
[*] Window Hide Tool
5) Use Windows explorer to open My Computer> Drive C> and double-click on the Program Files folder:
6) Right-click and delete the folders for:
[*]FunWebProducts
[*]MyWebSearch
[*] ZoneAlarm SpyBlocker
[*] Window Hide Tool
Reboot into Normal Mode.
Empty the Recycle Bin
Rescan with HijackThis and
paste new log in your next reply.
Summary:
Uninstall or disable BitTorrent.
Remove Shockwave Updater entry and Uninstall the program- for now.
Complete uninstall for AVG.
Complete the uninstalls
Completer the deleting of program folders.
Rescan with HJT- paste new log.
Help?
