First go to start>control panel>add/remove programs>look for UnSpyPC and uninstall if found.
Please download Fixwareout from this link
http://swandog46.geekstogo.com/Fixwareout.exe
or
http://downloads.subratam.org/Fixwareout.exe
Save it to your desktop don't run it yet
Please download kilbox from this link Killbox to you desktop don't run it yet
Please ccleaner a temp file cleanup tool from this link http://www.ccleaner.com/ccdownload.asp to your desktop don't run it yet.
Download smitremfix from this link
http://noahdfear.geekstogo.com/ to your desktop.Open the file and it will extract itself to a new folder called SmitRem.don't run it yet
Download Ewido Security Suite then set it up this way Ewido Setup Instructions don't run it yet
Once everything is downloaded click on fixwareout to run it. Click next, then Install, then make sure "Run fixit" is checked and click finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.A copy of the log is located at C:\fixwareout\report.txt
When your system reboots, follow the prompts. Afterwards, Hijack This will launch. Place a check to the left of the following items and press “fix checked”:
R3 - URLSearchHook: (no name) - {F57F6078-8C05-54D6-6B3E-8F5E8D45CCEE} - lpt.dll (file missing)
O4 - HKLM\..\Run: [iehelper] StatusCheck.exe
O4 - HKLM\..\Run: [ExchangeMaster] sbin.exe
O4 - HKLM\..\Run: [dmbhk.exe] C:\WINDOWS\system32\dmbhk.exe
O4 - HKLM\..\Run: [dmbhk.exe] C:\WINDOWS\system32\dmbhk.exe
O4 - HKCU\..\Run: [UnSpyPC] "C:\Program Files\UnSpyPC\UnSpyPC.exe"
O4 - HKCU\..\Run: [killall] Serviceprocess.exe
O4 - HKCU\..\Run: [keybdll] SysEntry.exe
O4 - HKCU\..\Run: [WTFCTF] SpyElim.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{562C16EE-6489-4583-ADAD-4E9A2C4AF9C1}: NameServer = 85.255.116.166,85.255.112.224
O17 - HKLM\System\CCS\Services\Tcpip\..\{6C1D8774-F78E-4BDB-B773-9CDDEE45CDFD}: NameServer = 85.255.116.166,85.255.112.224
O17 - HKLM\System\CCS\Services\Tcpip\..\{932D1C41-DC63-409C-9EFA-07FA3F0273D2}: NameServer = 85.255.116.166,85.255.112.224
Try to access the internet If you have a connection problem after removing the 017's do this:
Go to Start > Control Panel, and choose Network Connections. Then right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically. Click OK twice, and restart your computer.
Now reboot into safe mode with the directions here then open the SmitRem folder. Find the RunThis.bat and click it. Make sure all other open windows and programs are closed. If you haven't done this, then the program will remind you.Follow the onscreen direction and let smitremfix run, then disk clean will run(take a few minutes.
While still in safe mode run Ewido and when the scan has completed, Ewido will create a report.txt file. Click the "Save Report" button on the bottom of the screen and save the log to your desktop in case you need it later.
While still in safe mode run ccleaner
Please reboot into normal mode and post the ewido log the fixwareout log and a HT log we will still have some work to do..
