When you're done with Spysweeper...
*** Is Windows firewall on?
*** Go Start>Control Panel>Add\Remove, and uninstall
Hotbar, and QdrPack1.
Print this post out, since you won't have an access to it, at some point.2. Close all windows, except for HijackThis.
3. Put a checkmark next to the following HijackThis entries (
some entries will be checkmarked to disable unnecessary startups; in those cases (marked with *), no actual program will be removed):
- O2 - BHO: WhgHelper Class - {00000000-0000-11D1-ABED-709549C10000} - C:\Program Files\WHG\Instant Help Application Update 1.2\IEHelper.dll
- *O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
- O4 - HKLM\..\Run: [HotbarOE] "C:\Program Files\Hotbar\bin\10.0.412.0\OEAddOn.exe"
- *O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
- *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
- *O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
- O4 - HKLM\..\Run: [0e651c44] "rundll32.exe" "C:\WINDOWS\system32\dnqhlxle.dll",b
- O4 - HKLM\..\RunServices: [Microsoft Taskhide Driver] taskhide.exe
- *O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
- *O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] J:\CAMEFR~1\COMCAS~1\COMCAS~1\data\Xtras\mssysmgr.exe
- O4 - HKCU\..\Run: [QdrPack15] "C:\Program Files\QdrPack\QdrPack15.exe"
- *O4 - HKCU\..\Run: [SUPERAntiSpyware] "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
- O4 - HKCU\..\RunServices: [Microsoft Taskhide Driver] taskhide.exe
- O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
- *O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
- O20 - Winlogon Notify: jkkHXNDV - jkkHXNDV.dll (file missing)4. Click on
Fix checked button.
5. Restart your computer in
Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)
6. Open
Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to
Show hidden files, and folders.
7. Delete following files/folders (
if present):
-
WHG, Hotbar, QdrPack folders from C:\Program Files
-
dnqhlxle.dll file from C:\WINDOWS\system32
- search computer for
taskhide.exe, and delete all instances
8. Restart in Normal Mode.
9. Post new HijackThis log.