We will need a few tools.Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Download Ewido Security Suite We will need this later in safe mode
Be sure to update Ewido
Download killbox to your desktop from this link Killbox We will need it later in safe mode
Go to start>control panel> add/remove programs and uninstall these programs if found:
Purityscan
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":
O4 - HKCU\..\Run: [Auab] "C:\DOCUME~1\David\APPLIC~1\DOBE~1\services.exe" -vt yazr
O4 - HKCU\..\Run: [Gijj] C:\Program Files\Common Files\??sembly\m?config.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\scanregw.dll C:\WINDOWS\system32\wucrtupd.dll
Exit Hijack This but remian in safe mode.
Double-click on Killbox.exe to run it.
Put a tick by Standard File Kill.
In the "Full Path of File to Delete" box, copy and paste each of the following lines one at a time.
C:\DOCUME~1\David\APPLIC~1\DOBE~1\services.exe
C:\Program Files\Common Files\??sembly\m?config.exe
C:\WINDOWS\system32\scanregw.dll
C:\WINDOWS\system32\wucrtupd.dll
C:\Program Files\Common Files\{00F07CD3-08A3-1033-1021-050721050001}\Update.exe
Click on the button that has the red circle with the X in the middle after you enter each file.
It will ask for confimation to delete the file.
Click Yes.
Continue with that procedure until you have pasted all of these in the "Paste Full Path of File to Delete" box.
Navigate to and delete the folders if found:
C:\Program Files\Common Files\{00F07CD3-08A3-1033-1021-050721050001}
C:\DOCUME~1\David\APPLIC~1\DOBE~1
C:\Program Files\Common Files\??sembly
(the "??" characters will most likely look like "as" but could be any character.
Run Ewido from safe mode and let it delete all that it finds.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.
Post a new Hijack This log please.
