Ok now we can continue and fix this mess for you!!
Ok you can get the file you need
cwsuninst.txt )rename it as cwsuninst.reg)
Boot into Safe Mode:
Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.
Note if this doesn't work you may need to follow the intructions
here
To get back to normal mode just restart the computer as you normally would.
Don't do that yet Stay in safe mode..
Stop and disable the offending service:
Using the Start button click on | Run | type
services.msc | OK
Scroll down the list until you find the service called (Network Security Service).
Double-click on it and under the General tab click Stop to stop the service.
Change the Startup Type to Disabled.
Click Apply and then OK and close any open windows.
End the service process:
Press the Ctrl + Alt + Delete keys simultaneously to open the Task Manager.
Under the Processes tab find c:\windows\system32\crof32.exe
Click End Process.
File | Exit Task Manager
Now Be sure that there are no browser windows running and scan again with hijackthis place a check by each of the following entries and click on fix..
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = res://C:\WINDOWS\system32\qpwrp.dll/sp.html#96676
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = about:blank
O2 - BHO: (no name) - {9C207CFF-DF60-AB9F-5237-9572CDA6C7E7} - C:\WINDOWS\system32\d3co32.dll
O4 - HKLM\..\Run: C:\WINDOWS\syswn32.exe
O4 - HKLM\..\Run: c:\program files\180solutions\sais.exe
O4 - HKLM\..\Run: "C:\Program Files\Web_Rebates\WebRebates0.exe
O4 - HKCU\..\Run: C:\PROGRA~1\COMMON~1\tsa\tsm2.exe
Now click on "My Computer and navigate to C:\WINDOWS\system32 and delete the following files in bold
qpwrp.dll
d3co32.dl
Now navigate to c:\Program files and delete the folder
Web_Rebates and the files within that folder especially
WebRebates0.exe
Now navigate to the sub folder within "program files" called "Common Files and delet the folder
tsa and all files within. especially
tsm2.exe
Now run the CWSuninst.reg file click yes when it wants to add contents to the registry..
Browse to where you saved AboutBuster and run AboutBuster.exe.
Click OK at the directions prompt.
Click Start and then OK to allow AboutBuster to scan for Alternate Data Streams.
Click Yes to allow it to shutdown explorer.exe.
It will begin to your computer for malicious files. If it asks if you would like to do a second pass, allow it to do so.
When it has finished, click Save Log. Make sure you save it as I need a copy of it.
Now lets clean out your temp files Click on start then run and type
cleanmgr and click on OK
Let it scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
Press OK to remove them.
Restart your computer and now we will restore some files this infection may have deleted..
Restart your computer normally to return to normal mode.
You will likely need control.exe - Visit
this page.
Since you are running Windows XP copy it to C:\WINDOWS\system32.
HOSTS - Download the Hoster.
Unzip Hoster to a convenient folder such as C:\Hoster.
Run Hoster.exe, click Restore Original Hosts and then click OK.
Click the X to exit the program
Run the TrendMicro Housecall online virus scan. Let it fix what it finds
Post a new hijackthis log as well as the aboutbuster log..
Let us know of any other problems you had..
TANSTAAFL!!
