best and permanant way to get rid of "180 search assistant/zango" .?

Question

everyday i remove it, and bam! it's back the next time i turn on the computer. it slows down my comp, and adds favorites and destop icons. is there a way i can get rid of permanantly so it WONT come back again? at least, for a really really long time. thnx.

Answer 1

Click Start > Run and type in Services.msc
Click OK
In the Sevices box, click the Extended tab.
Scroll down to:
Regedite
Right click on it and select Properties
Click Stop to stop the service, then change the Startup Type to: Disabled
Click Apply.

Run SpySweeper and check for updates, after you get any available updates close SpySweeper.

Please download, installand update the free version of Ewido trojan scanner:
When installing, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".
When you run ewido for the first time, you will get a warning "Database could not be found!". Click OK. We will fix this in a moment.
From the main ewido screen, click on update in the left menu, then click the Start update button.
After the update finishes (the status bar at the bottom will display "Update successful"), close Ewido, do not run a scan yet.
Please download CCleaner, install it but do not run it yet.


Run HijackThis and place checks beside each of the following:
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [wfwall1.exe] C:\WINDOWS\system32\wfwall1.exe
O4 - HKLM\..\Run: [SkyAffiliate.exe] C:\WINDOWS\system32\SkyAffiliate.exe
O4 - HKLM\..\Run: [exp] C:\WINDOWS\system32\wfwall1.exe
O4 - HKLM\..\Run: [F ma] C:\windows\mrjj.exe
O4 - HKLM\..\Run: [wfshwj] C:\WINNT\wfshwj.exe
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: {ff348b6e-fd21-11d4-a3f0-00c04fa32518} -
O20 - Winlogon Notify: msctl32.dll - C:\WINDOWS\system32\msctl32.dll (file missing)
O23 - Service: Regedite - Unknown owner - C:\RECYCLER\S-1-5-21-1451520353-1173833938-1539857752-503\aux\prn\file\svrany.exe

After you check these items, close all browsers and windows, except for HijackThis, then click on the Fix Checked button on HijackThis.


Next:
Reconfigure Windows XP to show hidden files:
Click Start. Open My Computer.
Select the Tools menu and click Folder Options. Select the View Tab.

Under the Hidden files and folders heading select "Show hidden files and folders".
Uncheck the "Hide protected operating system files (recommended)" option.
Uncheck the "Hide file extensions for known file types" option.
Click Yes to confirm. Click OK.


Boot into Safe Mode:

Restart your computer and immediately begin tapping the F8 key on your keyboard.
If done right a Windows Advanced Options menu will appear. Select the Safe Mode option and press Enter.
For more detailed instructions please see this link: How do I boot into "Safe" mode?


Next use Windows Explorer to navigate to these locations and delete the files in bold:
C:\WINDOWS\system32\wfwall1.exe
C:\WINDOWS\system32\SkyAffiliate.exe
C:\WINDOWS\system32\1.exe
C:\windows\mrjj.exe
C:\WINNT\wfshwj.exe

Empty your Recycle Bin.


Run Ewido, click on the Scanner button in the left menu, then click on the Start button. This scan can take quite a while to run, so time to go get a drink and a snack....

If ewido finds anything, it will pop up a notification. You can select "clean" and check the boxes "Perform action with all infections" and "Create encrypted backup" before clicking on OK.
When the scan finishes, click on "Save Report". This will create a text file. Please then paste the contents of the text file to this thread.

Run SpySweeper, click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
Click on Sweep and allow it to fully scan your system.
When the sweep has finished, click Remove. Click Select All and then Next
From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.
Exit Spy Sweeper.

Reboot in Normal mode