* Go here to download CCleaner.<\/p>\n
* Install CCleaner
* Launch CCleaner and look in the upper right corner and click on the “Options” button.
* Click “Advanced” and remove the check by “Only delete files in Windows temp folders older than 48 hours”.
* Click OK
* Do not run CCleaner yet. You will run it later in safe mode.<\/p>\n
* Go here and download Ad-Aware SE.<\/p>\n
* Install the program and launch it.
* First in the main window look in the bottom right corner and click on Check for updates now
* Click Connect and download the latest reference files.
* Do not run Adaware yet. Just download the updates and have it ready to run later in safe mode.<\/p>\n
* Click here for info on how to boot to safe mode if you don’t already know how.
* Now copy these instructions to notepad and save them to your desktop. You will need them to refer to in safe mode.
* Restart your computer into safe mode now. Perform the following steps in safe mode:
* Run Hijack This again and put a check by these. Close ALL windows except HijackThis and click “Fix checked”<\/p>\n
Add entries from the HJT log to be fixed here
* Open the smitRem folder, then double click the RunThis.bat file to start the tool. Follow the prompts on screen.
Wait for the tool to complete and disk cleanup to finish.
* Now launch Adaware:<\/p>\n
* From main window click Start then under Select a scan Mode tick Perform full system scan.
* Next deselect Search for negligible risk entries.
* Now to scan just click the Next button.
* When the scan is finished mark everything for removal and get rid of it.
* Right-click the window and choose select all from the drop down menu and click Next<\/p>\n
* Start Ccleaner and click Run Cleaner
* Go to Control Panel > Internet Options. Click on the Programs tab then click the “Reset Web Settings” button. Click Apply then OK.
* Next go to Control Panel > Display. Click on the “Desktop” tab then click the “Customize Desktop” button. Click on the “Web” tab. Under “Web Pages” you should see an entry checked called something like “Security info” or similar. If it is there, select that entry and click the “Delete” button. Click OK then Apply and OK.
* Restart back into Windows normally now.
* Run ActiveScan online virus scan here<\/p>\n
When the scan is finished, anything that it cannot clean have it delete it. Make a note of the file location of anything that cannot be deleted so you can delete it yourself.
– Save the results from the scan!<\/p>\n
Post a new HiJackThis log along with the results from ActiveScan
Attached Files smitRem.zip (42.2 KB, 12 views)<\/p>\n","protected":false},"excerpt":{"rendered":"
* Go here to download CCleaner. * Install CCleaner * Launch CCleaner and look in the upper right corner and click on the “Options” button. * Click “Advanced” and remove the check by “Only delete files in Windows temp folders older than 48 hours”. * Click OK * Do not run CCleaner yet. You will […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1,8],"tags":[],"_links":{"self":[{"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/985"}],"collection":[{"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=985"}],"version-history":[{"count":0,"href":"https:\/\/obieta.com\/index.php?rest_route=\/wp\/v2\/posts\/985\/revisions"}],"wp:attachment":[{"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=985"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=985"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/obieta.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=985"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}