Go to start> control panel> add/remove programs and uninstall these programs if found:
SaveNow
FunWebProducts
Zango
Zango Toolbar
MyWebSearch.
Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode
Download and install Ewido Security Suite We will need this later in safe mode
Be sure to update Ewido
Please download Fixwareout from this link
http://swandog46.geekstogo.com/Fixwareout.exe
or
http://downloads.subratam.org/Fixwareout.exe
Save it to your desktop and run it. Click next, then Install, then make sure "Run fixit" is checked and click finish. The fix will begin; follow the prompts. You will be asked to reboot your computer; please do so. Your system may take longer than usual to load; this is normal.Post a copy at the log located at C:\fixwareout\report.txt
Next, please reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.
Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":
O2 - BHO: Zango Search Assistant Helper /fleok=1D8A83A5C5EC137B98AC75760EA83FA5EF80752B94E3D77E5975422D3DC2 - {56F1D444-11BF-4879-A12B-79CF0177F038} - c:\program files\zango\zangohook.dll (file missing)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Zango Toolbar - {EA0D26BD-9029-431A-86E0-83152D67828A} - C:\Program Files\Zango Programs\Zango Toolbar\ZangoTB.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15.cabO16
- DPF: {DECEAAA2-370A-49BB-9362-68C3A58DDC62} (SAIX) - http://static.zangocash.com/cab/Seekmo/ie/bridge-c24.cab?fd7767a287b2d2f76c0a95f8bda2e136957473c550bfb81e49252734af6867d26a66ecec618633058da45cb1addd0a4167fc5f33e0c071476677bb6fc6:190950799eb876e613008c54b810aed3O16
- DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) - file://D:\games\WebDriverFullInstall.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0EEC5600-C4AA-42B6-BE98-B959B8709672}: NameServer = 85.255.115.2,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{332B6311-714A-4F4C-8C61-C59E3C8097A5}: NameServer = 85.255.115.2,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{39CBD5CB-98AC-4AD3-BC7C-8060E1817B7C}: NameServer = 85.255.115.2,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\..\{3A06CB28-FBB0-4572-8BD5-B2340ACBB64D}: NameServer = 85.255.115.2,85.255.112.6
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.2 85.255.112.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{0EEC5600-C4AA-42B6-BE98-B959B8709672}: NameServer = 85.255.115.2,85.255.112.6
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.2 85.255.112.6
Exit Hijack This but remain in safe mode
Run Ewido from safe mode, sure all windows are closed the click "Scanner", then click on the Scan tab. Click Complete System Scan to begin scanning. When the scan is complete click Recommended Action and change it to Quarantine. Then click Apply all actions.
Once the scan has finished, click the Save report button, then click Save Report As. This will create a text file. Make sure you know where to find this file again.
.
Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
Post a new Hijack This log and the Ewido scan please.
Not often but sometimes these directions need to be followed to get back online after removing "Wareout" as you were infected with.
After restart, if you have any connection problems, do this:
Please go to Start -> Control Panel, and choose Network Connections. Then right click on your default connection, usually Local Area Connection or Dial-up Connection if you are using Dial-up, and left click on properties. Double-click on the Internet Protocol (TCP/IP) item and select the radio button that says Obtain DNS servers automatically. Click OK twice, and restart your computer.
Before you restart the computer.
Go to Start > Run and type in cmd
Click OK.
This will open a commad prompt.
Type or copy and paste the following line in the command window:
ipconfig /flushdns
Hit Enter
Exit the command window
