Download Avenger by
Swandog46 and save it to somewhere convenient.
Unzip it (Guide
to unzipping files)
Copy this text:
Files to delete:
C:\WINDOWS\SYSTEM32\winbuh32.dll
Registry keys to delete:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Notify\winbuh32
Note: The above code was
created specifically for Pillow. DO NOT follow these directions as
they could damage the workings of your system. I bear no
responsibility if it damages your PC, with the exception to
Pillow.
Now, start The Avenger program by clicking on its icon.
Under Script file to execute choose Input
Script Manually.
Now click on the Magnifying Glass icon which will
open a new window titled View/edit script.
Paste the text into this window by pressing (Ctrl+V).
Click Done.
Now click on the Green Light to begin execution of
the script.
Answer Yes twice when prompted.
The Avenger will automatically do the following:
It will Restart your computer. (In cases where the code to execute
contains Drivers to Unload, The Avenger will
actually restart your system twice.)
On reboot, it will briefly open a black command window on your
desktop, this is normal.
After the restart, it creates a log file that should open with the
results of Avengers actions. This log file will be located at
C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you
asked it to delete, and will have zipped them and moved the zip
archives to C:\avenger\backup.zip.
In your next reply, please post back a new HijackThis log and the
contents of avenger.txt.
