1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Browsers open offscreen

Discussion in 'Malware and Virus Removal Archive' started by Karenb, 2010/09/26.

Page 2 of 2
  1. 2010/09/26
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra 'Tools' menuitem : AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - Reg Error: Value error. File not found
[2010/09/26 21:45:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\AVG8
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[2010/09/26 20:57:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2009/11/16 22:22:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2009/11/17 00:38:01 | 000,000,258 | ---- | M] () -- C:\WINDOWS\Tasks\ISP signup reminder 1.job


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 "DisableMonitoring" =-


:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =====================================================

    Last scans....

    Download Security Check from HERE, and save it to your Desktop.

    * Double-click SecurityCheck.exe
    * Follow the onscreen instructions inside of the black box.
    * A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    =======================================================

    Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.

    ========================================================

    Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • IMPORTANT! UN-check Remove found threats
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
     
    broni,
    #21
  2. 2010/09/27
    Karenb

    Karenb Inactive Thread Starter

    Joined:
    2006/05/18
    Messages:
    126
    Likes Received:
    0
    Broni...I will post the logfiles later this morning. It is after 1:00 a.m. here and the Eset scan is only on 23%. I am beat and going to bed.

    Thanks...
    Karen
     
    Karenb,
    #22


  3. to hide this advert.

  4. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No problem :)
     
    broni,
    #23
  5. 2010/09/27
    Karenb

    Karenb Inactive Thread Starter

    Joined:
    2006/05/18
    Messages:
    126
    Likes Received:
    0
    After the ESet scan I sure see what has caused her all the problems. I told her she ever puts that stuff back in her computer I am going to throw it out the window!

    Here is the otl scan...
    All processes killed
    ========== OTL ==========
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FDD3B846-8D59-4ffb-8758-209B6AD74ACC}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
    Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4982D40A-C53B-4615-B15B-B5B5E98D167C}\ deleted successfully.
    C:\Documents and Settings\Owner\Application Data\AVG8 folder moved successfully.
    C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
    C:\WINDOWS\System32\SET5C6.tmp deleted successfully.
    C:\WINDOWS\System32\SET6C0.tmp deleted successfully.
    C:\WINDOWS\System32\SET6C4.tmp deleted successfully.
    C:\WINDOWS\System32\SET6CC.tmp deleted successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update\prepare\temp folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update\prepare folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update\backup folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\update folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Temp folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\scanlogs folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Log\IDP\log folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Log\IDP folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Log folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue\TEMP folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue\OUT folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue\ACTIVE folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc\Queue folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc\Log folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\emc folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Dumps folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\CfgAll folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\Cfg folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\AvgApi folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\AvgAm folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9\admincli folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\avg9 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome\BH00 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
    C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
    C:\WINDOWS\Tasks\ISP signup reminder 1.job moved successfully.
    ========== SERVICES/DRIVERS ==========
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall\\DisableMonitoring deleted successfully.
    ========== FILES ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 32768 bytes

    User: LocalService
    ->Temp folder emptied: 65536 bytes
    ->Temporary Internet Files folder emptied: 32902 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: Owner
    ->Temp folder emptied: 318730508 bytes
    ->Temporary Internet Files folder emptied: 118363 bytes
    ->Java cache emptied: 50748698 bytes
    ->FireFox cache emptied: 46228078 bytes
    ->Flash cache emptied: 43505 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 5352 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 397.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    User: Owner
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.14.1 log created on 09262010_234119

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Owner\Local Settings\Temp\~DF5916.tmp moved successfully.
    File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!
    File\Folder C:\WINDOWS\temp\ZLT0082c.TMP not found!

    Registry entries deleted on Reboot...

    ------------------------------------------------------------------------------------
    Security Check logfiles...

    Results of screen317's Security Check version 0.99.5
    Windows XP Service Pack 2
    Out of date service pack!!
    Internet Explorer 6 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:
    Windows Firewall Disabled!
    avast! Free Antivirus
    ZoneAlarm
    ```````````````````````````````
    Anti-malware/Other Utilities Check:
    Malwarebytes' Anti-Malware
    HijackThis 2.0.2
    Java(TM) 6 Update 21
    Adobe Flash Player 10.0.42.34
    Adobe Reader 6.0
    Out of date Adobe Reader installed!
    Mozilla Firefox (3.6.3) Firefox Out of Date!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent
    Alwil Software Avast5 AvastSvc.exe
    Alwil Software Avast5 avastUI.exe
    Zone Labs ZoneAlarm zlclient.exe
    ````````````````````````````````
    DNS Vulnerability Check:
    GREAT! (Not vulnerable to DNS cache poisoning)

    ``````````End of Log````````````


    ------------------------------------------------------------------------------------

    The Eset Scan log...

    C:\My Backup -- 16-11-09 1952\RECYCLER\S-1-5-21-4071864824-1357622917-3888091258-1003\Dc30.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    C:\My Backup -- 16-11-09 1952\RECYCLER\S-1-5-21-4071864824-1357622917-3888091258-1003\Dc36.au a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    C:\My Backup -- 26-03-09 2306\WINDOWS\system32\egumuvut.ini Win32/Adware.Virtumonde.NEO application
    C:\My Backup -- 26-03-09 2306\WINDOWS\system32\owipofel.ini Win32/Adware.Virtumonde.NEO application
    C:\My Backup -- 26-03-09 2306\WINDOWS\system32\udanivis.ini Win32/Adware.Virtumonde.NEO application
    C:\My Backup -- 26-03-09 2306\WINDOWS\system32\umozugul.ini Win32/Adware.Virtumonde.NEO application
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP152\A0048497.exe a variant of Win32/Adware.Gamevance.AB application
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP152\A0048498.exe a variant of Win32/Adware.Gamevance.AB application
    J:\-muzik.-\more muzik\Rasheeda - Dat Type Of Gurl.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\-muzik.-\more muzik\shawty said david banner lil.mp3 WMA/TrojanDownloader.GetCodec.C trojan
    J:\-muzik.-\more muzik\tynisha keli.mp3 WMA/TrojanDownloader.GetCodec.C trojan
    J:\-muzik.-\more muzik\Vivian Green - 24 Hour Blue (Just One Of Those Days).mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\-muzik.-\more muzik\whatever you like remix trina 192kb.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\MARCH 2OO9!\My Music\Gucci Mane - Black Tee feat Jody Breeze.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\MARCH 2OO9!\My Music\j.o.d.y b.r.e.e.z.e.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\MARCH 2OO9!\My Music\shorty da kid - ratchet pt. 2 [hi-fi].mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\MARCH 2OO9!\My Music\what you know soulja boy.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\bmc boyz-i love you.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\chris brown nothin.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\ludy - she can get it .mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\Rasheeda - Dat Type Of Gurl.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\02 Track 2.wma WMA/TrojanDownloader.Wimad.L trojan
    J:\2009!\muzik\wow\03 Track 3 (trackboyz).wma WMA/TrojanDownloader.Wimad.D trojan
    J:\2009!\muzik\wow\03 Track 3.wma WMA/TrojanDownloader.Wimad.D trojan
    J:\2009!\muzik\wow\04 Track 4 (trackboyz).wma Win32/Adware.180Solutions application
    J:\2009!\muzik\wow\let me big sexy.mp3 WMA/TrojanDownloader.GetCodec.C trojan
    J:\2009!\muzik\wow\uhmmm\03 Track 3 (trackboyz).wma WMA/TrojanDownloader.Wimad.D trojan
    J:\2009!\muzik\wow\uhmmm\04 Track 4 (trackboyz).wma Win32/Adware.180Solutions application
    J:\2009!\muzik\wow\uhmmm\bmc boyz-i love you.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\chris brown nothin.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\Gucci Mane - Black Tee feat Jody Breeze.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\j.o.d.y b.r.e.e.z.e.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\let me big sexy.mp3 WMA/TrojanDownloader.GetCodec.C trojan
    J:\2009!\muzik\wow\uhmmm\ludy - she can get it .mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\Rasheeda - Dat Type Of Gurl.wma a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\shawty said david banner lil.mp3 WMA/TrojanDownloader.GetCodec.C trojan
    J:\2009!\muzik\wow\uhmmm\shorty da kid - ratchet pt. 2 [hi-fi].mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\tynisha keli.mp3 WMA/TrojanDownloader.GetCodec.C trojan
    J:\2009!\muzik\wow\uhmmm\Vivian Green - 24 Hour Blue (Just One Of Those Days).mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\what you know soulja boy.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
    J:\2009!\muzik\wow\uhmmm\whatever you like remix trina 192kb.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan
     
    Karenb,
    #24
  6. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You're absolutely right :)

    Please, update Firefox.

    ===============================================================

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button

    ===============================================================

    Run OTL
    • Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following

      Code:
      :OTL

:Services

:Reg

:Files
C:\My Backup -- 16-11-09 1952\RECYCLER\S-1-5-21-4071864824-1357622917-3888091258-1003\Dc30.au 
C:\My Backup -- 16-11-09 1952\RECYCLER\S-1-5-21-4071864824-1357622917-3888091258-1003\Dc36.au
C:\My Backup -- 26-03-09 2306\WINDOWS\system32\egumuvut.ini 
C:\My Backup -- 26-03-09 2306\WINDOWS\system32\owipofel.ini 
C:\My Backup -- 26-03-09 2306\WINDOWS\system32\udanivis.ini 
C:\My Backup -- 26-03-09 2306\WINDOWS\system32\umozugul.ini
J:\-muzik.-\more muzik
J:\MARCH 2OO9!\My Music
J:\2009!\muzik


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
    • Then click the [color= "#FF0000"]Run Fix[/color] button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ================================================================

    Your computer is clean :)

    1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

    Run OTL

    • Under the Custom Scans/Fixes box at the bottom, paste in the following:

    Code:
    :OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • Post resulting log.

    2. Now, we'll remove all tools, we used during our cleaning process

    Clean up with OTL:

    • Double-click OTL.exe to start the program.
    • Close all other programs apart from OTL as this step will require a reboot
    • On the OTL main screen, press the CLEANUP button
    • Say Yes to the prompt and then allow the program to reboot your computer.

    If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

    3. Make sure, Windows Updates are current (including Service Pack 3 and at least version 7 of Internet Explorer)

    4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

    5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

    7. Run Temporary File Cleaner (TFC) weekly.

    8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

    9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
    The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

    10. Run defrag at your convenience.

    11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    12. Please, let me know, how is your computer doing.
     
    broni,
    #25
  7. 2010/09/27
    Karenb

    Karenb Inactive Thread Starter

    Joined:
    2006/05/18
    Messages:
    126
    Likes Received:
    0
    Okay...I have to take my husband to a Retina Specialist in a few minutes so as soon as we get back this afternoon I will finish doing what you say and post what you need. Thank you so much for your help. Next time I think it would be less time consuming just to strangle her! (shh I never said that). Get back to you as soon as I can.

    Karen
     
    Karenb,
    #26
  8. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    loooool
     
    broni,
    #27
  9. 2010/09/27
    Karenb

    Karenb Inactive Thread Starter

    Joined:
    2006/05/18
    Messages:
    126
    Likes Received:
    0
    Whew! I didn't think I would ever get done. Here are the last 2 OTL logfiles you wanted posted...

    All processes killed
    ========== OTL ==========
    File rity] not found.
    File ptytemp] not found.
    File ptyflash] not found.
    File boot] not found.

    OTL by OldTimer - Version 3.2.14.1 log created on 09272010_182643

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
    ------------------------------------------------------------------------------------

    And the 2nd one...

    All processes killed
    ========== OTL ==========
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: LocalService
    ->Temp folder emptied: 65984 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: Owner
    ->Temp folder emptied: 59993359 bytes
    ->Temporary Internet Files folder emptied: 930813 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 18797081 bytes
    ->Flash cache emptied: 434 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 8292 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 76.00 mb


    [EMPTYFLASH]

    User: Administrator

    User: All Users

    User: Default User

    User: LocalService

    User: NetworkService

    User: Owner
    ->Flash cache emptied: 0 bytes

    Total Flash Files Cleaned = 0.00 mb

    Restore points cleared and new OTL Restore Point set!

    OTL by OldTimer - Version 3.2.14.1 log created on 09272010_183434

    Files\Folders moved on Reboot...
    C:\Documents and Settings\Owner\Local Settings\Temp\~DFC147.tmp moved successfully.
    File\Folder C:\WINDOWS\temp\_avast5_\Webshlock.txt not found!
    File\Folder C:\WINDOWS\temp\ZLT06729.TMP not found!

    Registry entries deleted on Reboot...
    ------------------------------------------------------------------------------------

    I upgraded IE,Adobe,Service Pack 3. I downloaded everything you said too. So I think I got it covered.
     
    Karenb,
    #28
  10. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good :)
    If all cool...

    Good luck and have that rope ready, if something will happen again :)
     
    broni,
    #29
  11. 2010/09/27
    Karenb

    Karenb Inactive Thread Starter

    Joined:
    2006/05/18
    Messages:
    126
    Likes Received:
    0
    Thank you and thank you for your wonderful and patient help. I so so appreciate it. That rope will be kept close. I gave her strict orders so we will see. You have a wonderful night..

    Karen
     
    Karenb,
    #30
  12. 2010/09/27
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Same to you :)
     
    broni,
    #31
Page 2 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...