Solved Restrictions [popups, etc - HJT log]

HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1349 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1378 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1380 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1381 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1383 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1386 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1433 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1474 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1560 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1562 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1661 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1704 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1789 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1890 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1959 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Groups\1985 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\Settings -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\GMT\gtd -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\Users -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\Gator\stat\Users\User1 -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\PDP -> Adware.Gator : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Gator.com\PDP\Install -> Adware.Gator : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38878 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38878\Objects -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38878\Objects\5 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38879 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38880 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38881 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38882 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38883 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38884 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38885 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38900 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38900\Objects -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38900\Objects\5 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38901 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38902 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38903 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Reports\38904 -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\INSTAFINK\Stat -> Adware.InstaFinder : Cleaned with backup (quarantined).
HKU\S-1-5-21-4041366246-1856808883-253838394-1007\Software\RX Toolbar -> Adware.RXToolbar : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Program Files\PestTrap\Uninstall.exe.vir -> Adware.Spysheriff : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Program Files\Ultimate Cleaner\IeSafe.exe.vir -> Adware.Udefender : Cleaned with backup (quarantined).
C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll -> Adware.Viewpoint : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\Application Data\WINANTIVIRUSPRO2006FREEINSTALL[1].0XE.vir -> Downloader.Agent.alr : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\HRCOPUL.0LL.vir -> Downloader.Busky.az : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\MXSUKXB.0LL.vir -> Downloader.Busky.r : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\WINDOWS\TEST.0TA.vir -> Downloader.Psyme.at : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\LOADED.0XE.vir -> Downloader.Small.ecy : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\BKEBYWEI.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\BPROXAED.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\EZEWZFLJ.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\LKAUCHZA.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\NJVJIQVG.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\OHADHQAI.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\PGFFLKAL.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\PXPBLCTU.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\qoobox\Quarantine\C\Documents and Settings\tom\VNBXDAEX.0XE.vir -> Not-A-Virus.Hoax.Win32.Renos.eo : Cleaned with backup (quarantined).
C:\Documents and Settings\tom\Cookies\tom@adrevolver[1].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@media.adrevolver[2].txt -> TrackingCookie.Adrevolver : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@advertising[1].txt -> TrackingCookie.Advertising : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@doubleclick[2].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@trafficmp[1].txt -> TrackingCookie.Trafficmp : Cleaned.
C:\Documents and Settings\tom\Cookies\tom@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned.
C:\qoobox\Quarantine\C\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS.0.vir -> Trojan.Qhost.my : Cleaned with backup (quarantined).


::Report end

 

Logs look great! How's the computer running now?

Lets do some tidying up. Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created.

Delete the following files and folder.

dss.exe
SmitfraudFix.exe
SmitfraudFix folder
C:\WINDOWS\nircmd.exe
C:\WINDOWS\SYSTEM32\dumphive.exe
C:\WINDOWS\SYSTEM32\Process.exe
C:\WINDOWS\SYSTEM32\SrchSTS.exe
C:\WINDOWS\SYSTEM32\swreg.exe
C:\WINDOWS\SYSTEM32\tmp.reg
C:\WINDOWS\SYSTEM32\VCCLSID.exe
C:\WINDOWS\SYSTEM32\WS2Fix.exe


Open AVG-AS and delete the quarantined items.
Open HijackThis to the Misc Tools section, select Backups and remove all backups.

Run ATF Cleaner again using the same options as before.

If you're satisfied that the computer is working properly, clear the System Restore points. They are infected.

Clear past system restore points and create a new one.
Right click My Computer and select Properties. On the System Restore tab, check the box to turn System Restore off. Click Apply. Now, uncheck the box and click Apply. Click OK, then OK to close the System Properties dialog.

Verify a new restore point was created.
Click Start>All Programs>Accessories>System Tools>System Restore
Select 'Restore my computer to an earlier time', then click next.
You should have a newly created System Checkpoint available. If so, click Cancel. If not, click Back and select 'Create a restore point' then click Next. Give the restore point a name and click next.


Please run antoher Kaspersky online scan to make sure we're done. Post the results here.

 

KASPERSKY ONLINE SCANNER REPORT
Friday, November 09, 2007 11:47:56 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 9/11/2007
Kaspersky Anti-Virus database records: 455226


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\

Scan Statistics
Total number of scanned objects 48501
Number of viruses found 2
Number of infected objects 6
Number of suspicious objects 0
Duration of the scan process 00:56:55

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\tom\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\tom\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\tom\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\tom\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\tom\Local Settings\History\History.IE5\MSHist012007110920071110\index.dat Object is locked skipped

C:\Documents and Settings\tom\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\tom\Local Settings\Temporary Internet Files\Content.IE5\UPBO1C72\UserStatusChange[1].html Object is locked skipped

C:\Documents and Settings\tom\ntuser.dat Object is locked skipped

C:\Documents and Settings\tom\ntuser.dat.LOG Object is locked skipped

C:\Downloads\busdriver_setup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped

C:\HJT\Trend Micro\HijackThis\backups\backup-20071028-151712-244-system.exe Infected: not-virus:Hoax.Win32.Renos.ll skipped

C:\HJT\Trend Micro\HijackThis\backups\backup-20071029-122518-624-system.exe Infected: not-virus:Hoax.Win32.Renos.ll skipped

C:\HJT\Trend Micro\HijackThis\backups\backup-20071029-122518-817-autorun.exe Infected: not-virus:Hoax.Win32.Renos.ll skipped

C:\HJT\Trend Micro\HijackThis\backups\backup-20071029-211703-535-autorun.exe Infected: not-virus:Hoax.Win32.Renos.ll skipped

C:\HJT\Trend Micro\HijackThis\backups\backup-20071029-211703-631-system.exe Infected: not-virus:Hoax.Win32.Renos.ll skipped

C:\Program Files\Common Files\Symantec Shared\Antispam\Log\Spam.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped

C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped

C:\Program Files\Virtual Assistant\SmartBridge\AlertFilter.log Object is locked skipped

C:\Program Files\Virtual Assistant\SmartBridge\log\httpclient.log Object is locked skipped

C:\Program Files\Virtual Assistant\SmartBridge\SmartBridge.log Object is locked skipped

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP333\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\TEMP\T30DebugLogFile.txt Object is locked skipped

C:\WINDOWS\WIADEBUG.LOG Object is locked skipped

C:\WINDOWS\WIASERVC.LOG Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

 

Looks good. Two things to note.

1. You missed clearing the HijackThis backups. There are infected objects stored there that need removed.

There are embedded malware files or installers in the following file. Recommend you delete it.

C:\Downloads\busdriver_setup-dm[1].exe

That should wrap things up. Everything working as it should now?

Geri has posted some very helpful information and recommendations regarding future protection in the following link.

http://www.windowsbbs.com/showthread.php?t=67958

Surf safe!

 

I'm having trouble deleting the backup files in hijackthis, everytime i delete them, i close it out and go back, the backup files reappear.

 

Make sure HijackThis is closed, then navigate to C:\HJT\Trend Micro\HijackThis\backups and delete everything in the folder.

 

Thank you very much, everything seems to be going normal.

 

Glad to hear it. You're very welcome ...... happy to have helped.