Solved secure port believed hijacked

johnsdp · 2011/05/15

========== Last 10 Event Log Errors ==========

[ Antivirus Events ]
Error - 11/14/2006 11:50:23 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 11/14/2006 11:52:25 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/6/2008 2:20:13 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/6/2008 8:09:48 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/6/2008 10:18:38 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 9:52:15 AM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 7:06:55 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 8:16:04 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/7/2008 10:15:30 PM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

Error - 4/8/2008 12:01:58 AM | Computer Name = TOSHIBA-USER | Source = avast! | ID = 33554522
Description =

[ Application Events ]
Error - 2/24/2010 12:03:47 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application wmplayer.exe, version 11.0.5721.5145, faulting
module mp4splitter.ax, version 1.0.0.32, fault address 0x00008286.

Error - 2/27/2010 12:34:12 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application moviemk.exe, version 2.1.4026.0, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0001ab0a.

Error - 2/27/2010 12:34:19 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module
dbghelp.dll, version 5.1.2600.2180, fault address 0x0001295d.

Error - 2/27/2010 12:35:07 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application moviemk.exe, version 2.1.4026.0, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0001ab0a.

Error - 2/27/2010 12:36:01 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application moviemk.exe, version 2.1.4026.0, faulting module
ntdll.dll, version 5.1.2600.3520, fault address 0x0001ab0a.

Error - 7/4/2010 9:04:06 PM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application tpsmain.exe, version 1.0.14.1, faulting module
tpsmain.exe, version 1.0.14.1, fault address 0x00002d1c.

Error - 12/21/2010 2:11:28 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application tpsmain.exe, version 1.0.14.1, faulting module
tpsmain.exe, version 1.0.14.1, fault address 0x00002d1c.

Error - 1/10/2011 2:05:52 AM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application vlc.exe, version 0.9.6.99, faulting module libvout_directx_plugin.dll,
version 0.0.0.0, fault address 0x0000690c.

Error - 2/2/2011 10:31:44 PM | Computer Name = TOSHIBA-USER | Source = Application Error | ID = 1000
Description = Faulting application plugin-container.exe, version 1.9.2.3989, faulting
module ntdll.dll, version 5.1.2600.3520, fault address 0x0000100b.

Error - 4/8/2011 10:23:01 AM | Computer Name = TOSHIBA-USER | Source = Microsoft Office 11 | ID = 2001
Description = Rejected Safe Mode action : Microsoft Office Excel.

[ System Events ]
Error - 5/15/2011 9:53:52 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL.
Reference
error message: The operation completed successfully. .

Error - 5/15/2011 9:53:52 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 5/15/2011 9:53:52 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your system. .

Error - 5/15/2011 9:53:52 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL.
Reference
error message: The operation completed successfully. .

Error - 5/15/2011 9:53:53 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 5/15/2011 9:53:53 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your system. .

Error - 5/15/2011 9:53:53 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL.
Reference
error message: The operation completed successfully. .

Error - 5/15/2011 9:53:53 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 5/15/2011 9:53:53 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your system. .

Error - 5/15/2011 9:53:53 PM | Computer Name = TOSHIBA-USER | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL.
Reference
error message: The operation completed successfully. .

< End of report >

Any suggestions on how to check the security of ports?
Or do you think it is hardware related?
http://www.n1wireless.com/product.cgi?product=66416&group=66401

broni · 2011/05/15

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
IE - HKU\S-1-5-21-1935131824-3669761680-3639548161-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings:  "ProxyOverride" = <local>
O3 - HKLM\..\Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - No CLSID value found.
O3 - HKU\S-1-5-21-1935131824-3669761680-3639548161-1003\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O15 - HKU\S-1-5-21-1935131824-3669761680-3639548161-1003\..Trusted Domains: state.wi.us ([ptaweb] https in Trusted sites)
O15 - HKU\S-1-5-21-1935131824-3669761680-3639548161-1003\..Trusted Domains: turbotax.com ([]https in Trusted sites)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Reg Error: Key error.)
O33 - MountPoints2\{93795d80-0ce3-11dd-b954-0011f573f451}\Shell - " " = AutoRun
O33 - MountPoints2\{93795d80-0ce3-11dd-b954-0011f573f451}\Shell\AutoRun - " " = Auto&Play
O33 - MountPoints2\{93795d80-0ce3-11dd-b954-0011f573f451}\Shell\AutoRun\command - " " = E:\LaunchU3.exe -a
O33 - MountPoints2\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\Shell - " " = AutoRun
O33 - MountPoints2\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\Shell\AutoRun - " " = Auto&Play
O33 - MountPoints2\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\Shell\AutoRun\command - " " = E:\DigitalPhotoViewer.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Owner\My Documents\*.tmp files -> C:\Documents and Settings\Owner\My Documents\*.tmp -> ]
[2005/05/13 23:22:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
@Alternate Data Stream - 88 bytes -> C:\WINDOWS\sat_screensaver_30mb.scr:SummaryInformation
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:66E02052


:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
=====================================================

Last scans...

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

johnsdp · 2011/05/16

Run Fix OTL:
All processes killed
========== OTL ==========
HKU\S-1-5-21-1935131824-3669761680-3639548161-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{BA52B914-B692-46c4-B683-905236F6F655} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BA52B914-B692-46c4-B683-905236F6F655}\ not found.
Registry value HKEY_USERS\S-1-5-21-1935131824-3669761680-3639548161-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry key HKEY_USERS\S-1-5-21-1935131824-3669761680-3639548161-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\state.wi.us\ptaweb\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1935131824-3669761680-3639548161-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\turbotax.com\ deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{93795d80-0ce3-11dd-b954-0011f573f451}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93795d80-0ce3-11dd-b954-0011f573f451}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{93795d80-0ce3-11dd-b954-0011f573f451}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93795d80-0ce3-11dd-b954-0011f573f451}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{93795d80-0ce3-11dd-b954-0011f573f451}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{93795d80-0ce3-11dd-b954-0011f573f451}\ not found.
File E:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc8b38b0-0d61-11e0-bfb5-0011f573f451}\ not found.
File E:\DigitalPhotoViewer.exe not found.
C:\WINDOWS\System32\CONFIG.TMP deleted successfully.
C:\Documents and Settings\Owner\My Documents\~WRD0001.tmp deleted successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9Plus folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell\AOL9 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\UserShell folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome\BH00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\Welcome folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
ADS C:\WINDOWS\sat_screensaver_30mb.scr:SummaryInformation deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:66E02052 deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 300 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Owner
->Temp folder emptied: 1558776 bytes
->Temporary Internet Files folder emptied: 33036 bytes
->Java cache emptied: 11819481 bytes
->FireFox cache emptied: 56634948 bytes
->Flash cache emptied: 611 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 65791 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 67.00 mb

[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

User: Owner
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 05162011_093350

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

johnsdp · 2011/05/16

Check up log:
Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 2
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
avast! Free Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Java(TM) 6 Update 25
Java(TM) 6 Update 3
Java(TM) 6 Update 7
Out of date Java installed!
Adobe Flash Player 10.2.152.32
Adobe Reader 9.3 MUI
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.17)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Alwil Software Avast5 AvastSvc.exe
ALWILS~1 Avast5 avastUI.exe
``````````End of Log````````````

johnsdp · 2011/05/16

The temp file cleaner did not find anything to fix.
Eset Scan ran for 40 minutes and said it detected no threats so there was no report or log created.
Dan

broni · 2011/05/16

We'll need to remember to install SP3, but Eset first.

Also....

Uninstall:
Java(TM) 6 Update 3
Java(TM) 6 Update 7

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or any other garbage.

broni · 2011/05/16

I didn't see this:

The temp file cleaner did not find anything to fix.
Eset Scan ran for 40 minutes and said it detected no threats so there was no report or log created.
Click to expand...

Proceed with steps from my previous reply.

Then....

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code:
:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[CLEARALLRESTOREPOINTS]
[Reboot]
Then click the Run Fix button at the top

Let the program run unhindered, reboot the PC when it is done

Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.

Close all other programs apart from OTL as this step will require a reboot

On the OTL main screen, press the CLEANUP button

Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure, Windows Updates are current (including Service Pack 3 installation!)

4. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

6. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

7. Run Temporary File Cleaner (TFC) weekly.

8. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

9. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

10. Run defrag at your convenience.

11. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

12. Please, let me know, how your computer is doing.

johnsdp · 2011/05/16

Hold on a second, I went to the adobe reader update and I thought I saw that is was going to use 3G (gigs?) to install. I went ahead and it needed to restart firefox and I said okay. When it restarted firefox, Avast wanted to sand box C:\program files\NOS\bin\getPlusPlus_Adobe.exe
I canceled the Adobe Reader update. Is there a vulnerability using the version I have or updating later? Should I run TFC again?
And would you really put SP 3 on this old machine, I thought it slowed the performance.
I did download it a while ago but can not find it now, did you see where it was?
The Adobe update downloaded an updater and wanted to run that.
Do you recommend Foxit instead? will it open PDFs from within Firefox?
Thanks,
Dan

broni · 2011/05/16

I definitely recommend FoxIt instead of Acrobat.
As I said above, it does very same thing, but it's smaller and safer.

And would you really put SP 3 on this old machine, I thought it slowed the performance.
Click to expand...

Yes, it's all about security, nothing else.
Download: http://technet.microsoft.com/en-us/windows/bb794714

johnsdp · 2011/05/16

Okay, should I remove Adobe first, along with the Firefox adobe reader add-on?
Also, Is Avast as good as Eset? I have had good luck with it on many machines.

broni · 2011/05/16

You can uninstall:
Adobe AIR
Adobe Reader

Do NOT uninstall:
Adobe Flash Player 10 Plugin
Adobe Flash Player 10 ActiveX

Avast is a very good program. Using it myself.

Any other issues?

johnsdp · 2011/05/16

Any other issues?[/QUOTE said:

Do we uninstall Recovery Console?
Is there a better way to get SP3 (300+ megs?)
I use a temp file cleaner called ATF Cleaner. Is TFC.exe the same? ATF has a firefox tab.
The original problem still exists as I cannot connect to the streaming quotes at Scottrade while using the cellular modem.
Do you have any links on how to secure my cell modem plugged into my wifi router?
Thanks for the help again.
Dan
Click to expand...

broni · 2011/05/16

Do we uninstall Recovery Console?
Click to expand...

No. It's an important troubleshooting tool, which should be present on every XP computer.

Is there a better way to get SP3 (300+ megs?)
Click to expand...

Not really. If your connection is too slow, you can ask a friend with a broadband to get it for you.

ATF is an excellent tool.

The original problem still exists as I cannot connect to the streaming quotes at Scottrade while using the cellular modem.
Click to expand...

In this forum, we make sure, your computer is free of malware and your computer is clean
Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
You'll get more attention.
At the same time, you have an argument, you can present to your ISP.
They can't blame it on any infection anymore.

johnsdp · 2011/05/16

"broni said: ↑

At the same time, you have an argument, you can present to your ISP.
They can't blame it on any infection anymore.
Click to expand...

excellent point.
I will post on the hardware forum on how to protect my wifi router.
Thanks broni, take the rest of the night off!
Dan

broni · 2011/05/16

You're very welcome

Good luck and stay safe

Log in or Sign up

Solved secure port believed hijacked

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

johnsdp Well-Known Member Thread Starter

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved secure port believed hijacked

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

johnsdp Well-Known Member Thread Starter

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

johnsdp Well-Known Member Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches