1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

HELP - Spyware alert!

Discussion in 'Malware and Virus Removal Archive' started by Deejay1975, 2007/03/02.

Thread Status:
Not open for further replies.
  1. 2007/03/02
    Deejay1975

    Deejay1975 Inactive Thread Starter

    Joined:
    2006/12/15
    Messages:
    20
    Likes Received:
    0
    Logfile of HijackThis v1.99.1
    Scan saved at 9:37:26 PM, on 3/1/2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Internet Security\isamntr.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Internet Security\isamini.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Directory 1 for HijackThis.zip\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.skysports.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Internet Security\isadd.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Internet Security\iesplugin.dll
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: didynamia - {8329660f-e248-4872-98cc-fb9c4fec7ba8} - (no file)
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
     
    Deejay1975,
    #1
  2. 2007/03/02
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,896
    Likes Received:
    389
    Deejay1975

    Before our resident expert(s) take a look ....

    Please move Hijackthis to a folder on your hard drive, say C:\HJT - the Desktop or a temporary folder is not a suitable location for the backup made by HJT when entries are fixed.

    Post back with a new log and details of your problem - a 'bald' HJT log leaves one guessing :)
     
    PeteC,
    #2


  3. to hide this advert.

  4. 2007/03/03
    Deejay1975

    Deejay1975 Inactive Thread Starter

    Joined:
    2006/12/15
    Messages:
    20
    Likes Received:
    0
    Logfile of HijackThis v1.99.1
    Scan saved at 10:54:07 AM, on 3/3/2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Internet Security\isamntr.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Internet Security\isamini.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
    C:\HijackThis\HijackThis.exe
    C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.skysports.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Internet Security\isadd.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Internet Security\iesplugin.dll
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
    O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O21 - SSODL: didynamia - {8329660f-e248-4872-98cc-fb9c4fec7ba8} - (no file)
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec
     
    Deejay1975,
    #3
  5. 2007/03/03
    markp62

    markp62 Geek Member Alumni

    Joined:
    2002/05/01
    Messages:
    4,012
    Likes Received:
    16
    It has been awhile since I have tackled one of these, yours doesn't seem too complicated.

    Rescan with HJT and remove these.

    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    O2 - BHO: (no name) - {67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} - C:\Program Files\Internet Security\isadd.dll
    O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Internet Security\iesplugin.dll
    O21 - SSODL: didynamia - {8329660f-e248-4872-98cc-fb9c4fec7ba8} - (no file)

    Reboot into Safe Mode, and delete this folder.

    C:\Program Files\Internet Security

    Then delete this file, it may be Hidden as a system file.

    C:\WINDOWS\system32\xkrdk.dll
     
    markp62,
    #4
  6. 2007/03/03
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    DeeJay this is a Smithfraud\Zlob ionfection.

    Fixing with HJT will not remove the infection.

    Please download SmitfraudFix (by S!Ri). Save it to your desktop.

    Double-click the Smithfraud.exe and it will install a new folder to your desktop, called SmithFraudFix. Shortly after that a dos command window will appear. Once it opens, hit any key to continue.
    Select option #1 - Search by typing 1 and press "Enter "; a text file will appear, which lists infected files (if present).
    Please copy/paste the content of that report into your next reply.

    Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool "; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore you may get an alert.

    No need for a new HJT log, just the results from the SmithFraud tool.
     
    TeMerc,
    #5
  7. 2007/03/04
    Deejay1975

    Deejay1975 Inactive Thread Starter

    Joined:
    2006/12/15
    Messages:
    20
    Likes Received:
    0
    Here is the text file:

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Thomas\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Thomas\FAVORI~1

    C:\DOCUME~1\Thomas\FAVORI~1\Online Security Test.url FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    C:\Program Files\Internet Security\ FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source "= "About:Home"
    "SubscribedURL "= "About:Home"
    "FriendlyName "= "My Current Home Page"


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{8329660f-e248-4872-98cc-fb9c4fec7ba8} "= "didynamia"



    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs "=" "


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System "=" "


    »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End
     
    Deejay1975,
    #6
  8. 2007/03/04
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    Second part of fix:

    You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site. Please follow the instructions exactly in the order listed; this is very important!

    Please download, install, and update the free version of AVG Anti-Spyware 7.5 Save the file to your desktop.
    1. Double-click the file and select your language.
    2. Follow the prompts to install. The application will add three start ups to your system, be sure and allow them if you have any real time monitoring of your system.
    3. Once install has completed, run the program.
    4. Be sure the two options are enabled:
      • Resident shield
      • Aromatic updates
    5. From the main AVG 'Status' screen, click the update now link the update should begin automatically. If not then hit the [Manual Update] Burton to begin updating.
    6. After the update finishes, the status bar will display "Update successful "
    7. Click the 'Scanner' tab, and select the 'Settings' tab.
    8. Under 'How to act?' click 'Recommended actions' and select 'Quarantine'
    9. Under 'Reports' be sure to tick the radio button for 'Automatically generate report after each scan' and un-tick the 'Only if threats were found box.
    10. Exit AVG. DO NOT run a scan yet.

    Reboot, into safe mode, this way:
    Turn on the computer
    Immediately begin tapping the F8 key.
    Use the arrow keys to highlight Safe Mode and press the Enter key.

    Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
    Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

    You will be prompted : "Registry cleaning - Do you want to clean the registry ? "; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

    The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter ".

    The tool may need to restart your computer to finish the cleaning process. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply.

    AFTER SmitfraudFix finishes (and after a reboot if required), please open AVG. (If a reboot is required, please boot BACK into Safe Mode.)
    • Click on Scanner
    • Click on Complete System Scan and the scan will begin.
    • When the scan is finished, click the [Save report] button at the bottom of the screen.
    • Then hit the [Save report as] button.
    • Save the report to your desktop.
    • Click the 'Scanner' tab again and then click the [Apply all actions] button.
    • Close AVG
    Then please restart it into Normal Windows. Please post the contents of the SmitfraudFix log located at C:\rapport.txt into this thread, along with the AVG report and a new HijackThis log. (please edit out all 'cookies', 'Recycler folder' and 'restore\system volume folder' references from the AVG log)
     
    TeMerc,
    #7
  9. 2007/03/09
    Deejay1975

    Deejay1975 Inactive Thread Starter

    Joined:
    2006/12/15
    Messages:
    20
    Likes Received:
    0
    This is the smitfraudfix one:

    SmitFraudFix v2.147

    Scan done at 22:23:04.89, Thu 03/08/2007
    Run from C:\Documents and Settings\Thomas\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
    "{8329660f-e248-4872-98cc-fb9c4fec7ba8} "= "didynamia"


    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\WINDOWS\system32\xkrdk.dll Deleted
    C:\DOCUME~1\Thomas\FAVORI~1\Online Security Test.url Deleted
    C:\Program Files\Internet Security\ Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System "=" "


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End

    Next we have the 2 hour.. AVG:

    + Scan result:



    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP251\A0046939.dll -> Adware.Comet : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP252\A0049852.dll -> Adware.Comet : No action taken.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} -> Adware.Generic : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP271\A0066319.exe -> Adware.SpyDawn : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP280\A0069067.dll -> Adware.WorldSecurityOnline : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP271\A0066329.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP271\A0066331.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066380.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066382.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066392.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066395.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066406.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066408.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066418.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066420.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP273\A0066436.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP273\A0066438.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066477.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066479.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066491.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066492.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066502.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066503.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066538.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066539.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066577.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066578.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066596.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066598.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP276\A0066612.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP276\A0066614.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP277\A0067612.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP277\A0067613.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP277\A0067623.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP277\A0067624.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP277\A0067662.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP277\A0067663.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP278\A0067725.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP278\A0067727.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP278\A0068725.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP278\A0068726.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068854.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068856.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068903.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068904.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068958.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068959.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068969.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068971.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068980.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP279\A0068982.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP280\A0069058.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP280\A0069060.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP280\A0069070.dll -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP280\A0069071.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP280\A0069072.exe -> Downloader.Zlob.ang : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP271\A0066330.exe -> Downloader.Zlob.bov : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066381.exe -> Downloader.Zlob.bov : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066393.exe -> Downloader.Zlob.bov : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066407.exe -> Downloader.Zlob.bov : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP272\A0066419.exe -> Downloader.Zlob.bov : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP273\A0066437.exe -> Downloader.Zlob.bov : No action taken.
    C:\System Volume Information\_restore{28DBFCE6-9957-486B-B960-A6A2D3727674}\RP275\A0066478.exe -> Downloader.Zlob.bov : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@2o7[2].txt -> TrackingCookie.2o7 : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@adtech[1].txt -> TrackingCookie.Adtech : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@adviva[2].txt -> TrackingCookie.Adviva : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : No action taken.
    C:\Documents and Settings\Thomas\Cookies\thomas@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.
    C:\Documents and Settings\Thomas\Local Settings\Temp\Temporary Directory 1 for The Sims - Living Large Expansion.zip\install.exe -> Trojan.Install.d : No action taken.


    ::Report end


    And finally a new Hijack this report:

    Logfile of HijackThis v1.99.1
    Scan saved at 11:48:08 PM, on 3/8/2007
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 (6.00.2600.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Logitech\iTouch\iTouch.exe
    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R3 - URLSearchHook: ScriptInocUI Class - - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
    O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
    O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
     
    Deejay1975,
    #8
  10. 2007/03/09
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    OK, that last log looked good. And AVG scan didn't really turn any threats up.

    How's the machine running at this point?
     
    TeMerc,
    #9
  11. 2007/03/10
    Deejay1975

    Deejay1975 Inactive Thread Starter

    Joined:
    2006/12/15
    Messages:
    20
    Likes Received:
    0
    Hi,

    Machine is running well. Home page has finally returned and no more hoax virus threats.
     
    Deejay1975,
    #10
  12. 2007/03/10
    TeMerc

    TeMerc Inactive Alumni

    Joined:
    2006/05/13
    Messages:
    3,226
    Likes Received:
    4
    Glad to hear the machine is running well.

    Ok, at this point it is imperitive you go to Windows Update and get this machine patched up proper, or you wil be back within the month if not sooner.

    Then you need to add some additional security as we recommend below.

    We have 3 more things to do, mostly maintenance and then our recommendations:

    Empty the TIF (Temporary Internet Files)
    Delete all the files in (and any subfolders of) the C:\Windows\Temp folder
    The app below will help with temp files.
    Index.dat Suite

    Also, delete all your cookies, and empty your recycle bin. But remember, by deleting your cookies, you will have to re-enter any passwords and log-in info for any sites you are usually required to do so with.

    This would also be a good time to set a new system restore point for your machine.
    Set New System Restore Point. Do not do this unless there are no other user accounts to be diagnosed.

    Also, as you are an XP user, if there are any other accounts on this machine, they too, must be cleaned with AdAware, Spybot S&D, then HJT. Not all infections are global, nor are all the HJT fixes global. You can post each user account here into this thread, but please, do only one at a time to avoid confusion. It is very rare that anything significant is ever found.

    Here is a link which describes how security apps work with WIN XP machines.
    XP User Accts Security Apps Operation

    To further prevent the installation of ad/mal/spyware, DL the apps below, which are just as good the fight against ad/mal/spyware as AdAware & Spybot S&D:

    SpywareBlaster
    With SpywareBlaster v3.5.1 , just DL, install and check for updates, enable Internet Explorer protection, and your done! I don't recommend using IE restricted sites protection as it's not a very large database. Use IE-SPYADs below.

    To avoid known malware infested sites from loading in IE install IESPY ADS.
    And MVPS Hosts File will accomplish a similar tactic and provide another layer of protection.

    And to prevent unknown applications from being inserted to start up on your machine install WinPatrol 2007 v11.1.2007.

    Another thing I would suggest, is to install SiteAdvisor. It gives sites a few different 'ratings' and while not fool proof, a good additional layer of information about many sites.

    Links for tutorials for all the apps I mentioned can be found on my site as well.

    Confused about which apps are good or not? Read about Rogue/Approved Anti Security apps

    And just because you have security apps installed, they are useless unless updated regularly. Keep track of updates for ALL your security needs here:
    Calendar of Updates

    Subscribe to update alerts for all the above security apps here.

    You can also see my own ongoing security testing with all the above apps proving how securely you can safe with them installed.
    TeMerc Test Box Forum

    Happy surfing!!
    Tom :D


    Due to resolution this topic is closed.

    If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.
     
    TeMerc,
    #11
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...