Expert: Brian Benosky - 5/2/2009

Question
QUESTION: My internet is not working and everytime I try to open it i get this message: ['Traceback (most recent call last):\n',' File"c:\\pyagcore\\pyagcore/_init_py", line 3, in <module>\n','import error: No module named shell\n'] Skype still works and i get signal, but the internet nor MSN messanger open up. What do I do?

ANSWER: Hi Andre

This error is caused by the kiwee toolbar, which is a malware program.  Try the following:
1:Pres ctrl+alt+delete on your keyboard.
2:If you have Vista, select open task manager.If you have XP then it should already be open.
3:Click on Processes in the top of the task manager
4:Scroll down until you find kwtbaim.exe.
5:Right Click on kwtbaim.exe and click open file location in the drop down menu. This will open the Kiwee folder.
6:Now, go back to your task manager, and click on kwtbaim.exe, it should be highlighted.  Look for the end process button on the lower left hand corner of task manager.
7:kwtbaim.exe should now be stopped so you can open the internet.

Once the internet is working, follow these instructions:

Please download Malwarebytes' Anti-Malware to your desktop from here:

http://www.besttechie.net/tools/mbam-setup.exe

Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to
o Update Malwarebytes' Anti-Malware
* then click Finish.
* If an update is found, it will download and install the latest version.
*Run a Full Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.  Save that log and reboot.

Download and install HijackThis:

http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Make sure you close EVERY open window and ALL browser windows. The only thing that should be open is the HijackThis program.
Double-click on the file you just downloaded.
Click on the "Install" button.
Upon install, HijackThis should open for you.
Should it not open, go to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe
Choose 'Do a system scan and save a log file'.
Copy the text file which opens in Notepad and paste it in your follow-up, along with the Malwarebytes log.
* Do not fix any entries in HijackThis, as they may be harmless.

Brian

---------- FOLLOW-UP ----------

QUESTION: I stopped the process and the file is gone now, but I still cannot get onto my internet. Also when I was trying to delete it, a message kept popping up which said that I did not have permission to delete it, but it is gone anyways.

Answer
Hi Andre

You will need to download the files I mentioned previously to a CD or thumb drive, then transfer them to the desktop of the infected computer.  I would like for you to first download and transfer a program called ComboFix, which may help to restore your internet connection.  Then hopefully you can download the other programs directly.

Download ComboFix and save to your CD or thumb drive from here:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

  Note: Remember it is important that the file is transferred directly to your desktop.
  Close any open browsers.
  Double click on combofix.exe and follow the prompts.
  If asked to install Recovery Console, please allow it.
  Note: Do not mouseclick combofix's window while it's running.
  That may cause the program to freeze/hang.
  When it's finished it will produce a log.
  Save that log file.
  Download and run the other programs.  Once completed, post me the ComboFix log, the Malwarebytes' log and the HJT log.

Brian