OneStep search - hjt log, please help!!

[ndmmxiaomayi]

Good.

You will need to create a new user profile for the account which keeps giving out the "Access denied" error when trying to view the Application Data folder. The permissions have been messed up.

After creating the new profile, you can copy your personal files you have from that account to the new user account.

Everything looks good.

Any other issues?

[tamskinner]

No, dont think there are any other issues. Should all the accounts have administration rights?
Tam

[ndmmxiaomayi]

If you don't need to install anything, but just use it for everyday surfing, work on documents, etc, a normal user account would suffice. Administrative rights is not needed.

But if you do install and uninstall things on a regular basis, you may want to consider an account with administrative rights.

All accounts don't need administrative rights; just one or two accounts with administrative rights are enough.

[tamskinner]

I've changed all bar mine to limited accounts now anyway!! Anything else I need to do?
Tam

[ndmmxiaomayi]

Hi,

Yes, but nothing much. Just need to remove the tools we have used.

Remove Combofix

Click on Start > Run. Copy and paste in ComboFix /u and click OK. An image is below for reference.



Uninstall Navilog

Click on Start > Control Panel and double click on Add/Remove Programs.

Locate Navilog and click on Change/Remove to uninstall it.

Remove all other tools

Double click on OTMoveIt2.

Click on CleanUp!.

You will receive a prompt that it has finished downloaded a list. Click OK.

After this, it will prompt you to restart your computer. Please restart your computer.

Re-enable protection programs

Re-enable Winpatrol

1. Go to Start > All Programs > Winpatrol > Winpatrol.
2. Winpatrol will start, near the clock.
3. Right click on the Scotty Dog and select Options.... A window will open.
4. Select the Options tab.
5. Check (tick) this box: Automatically run Winpatrol when computer starts.
6. Close the Winpatrol window.

Re-enable Spybot Teatimer

1. Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
2. On the left hand side, click on Tools.
3. Check (tick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
4. Exit Spybot Search & Destroy.
5. Restart your computer for the changes to take effect.

Create a new, clean System Restore point

1. Click on Start > All Programs > Accessories > System Tools > System Restore.
2. On the Welcome Page, select Create a restore point. Click Next.
3. Give this restore point a descriptive name and click Create.
4. When done, click Close.

Warning: Do not clear infected System Restore points before creating a new System Restore point first!

Please read the above to create a new System Restore point first, then clear out the infected System Restore points.

Clear infected System Restore points

1. Click on Start > All Programs > Accessories > System Tools > Disk Cleanup.
2. Select C drive and click OK.
3. Select the More Options tab.
4. Under System Restore, click on Clean up....
5. You will be prompted. Click Yes.
6. When done, click OK.
7. You will be prompted again. Press Yes to confirm.
8. When done, Disk Cleanup will close automatically.

Here are some prevention tips. There's no need to install all programs recommended. Try out and see which are suitable for you.

Keep your system updated

Microsoft releases patches for Windows and Office products regularly to patch up Windows and Office products loopholes and fix any bugs found. Please ensure that you visit the following websites regularly or do update your system regularly.

Install the updates immediately if they are found. Reboot your computer if necessary, revisit Windows Update and Office update sites until there are no more updates to be installed.

To update Windows

Go to Start > All Programs > Windows Update

To update Office

Open up any Office program.

Go to Help > Check for Updates

Alternatively, you can visit the links below to update Windows and Office products.

Windows Update
Office Update

If you are forgetful, you can change some settings so that you will be informed of updates. Here's how:

1. Go to Start > Control Panel > Automatic Updates
2. Select Automatic (recommended) radio button if you want the updates to be downloaded and installed without prompting you.
3. Select Download updates for me, but let me chose when to install them radio button if you want the updates to be downloaded automatically but to be installed at another time.
4. Select Notify me but don't automatically download or install them radio button if you want to be notified of the updates.

Besides Windows that needs regular updating, antivirus, anti-spyware and firewall programs update regularly too.

Please make sure that you update your antivirus, firewall and anti-spyware programs at least once a week.

Be careful when opening attachments and downloading files.

1. Never open email attachments, not even if they are from someone you know. If you need to open them, scan them with your antivirus program before opening.
2. Never open emails from unknown senders.
3. Beware of emails that warn about viruses that are spreading, especially those from antivirus vendors. These email addresses can be easily spoofed. Check the antivirus vendor websites to be sure.
4. Be careful of what you download. Only download files from known sources. Also, avoid cracked programs. If you need a particular program that costs too much for you, try finding free alternatives on Sourceforge or Pricelessware.

Surf safely

Many of the exploits are directed to users of Internet Explorer and Firefox.

Using Firefox with NoScript add-on helps to prevent most exploits from running as NoScript by default disables all scripts on all websites. If you trust the website, you can manually allow it.

If you prefer to use Internet Explorer, here are some settings to change to improve the security of Internet Explorer.

For Internet Explorer 7

Please read this article to configure Internet Explorer 7 properly.

Stop malicious scripts

Windows by default allow scripts (which is VBScript and JavaScript) to run and some of these scripts are malicious. Use Noscript by Symantec or Script Defender by AnalogX to handle these scripts.

Backup regularly

You never know when your PC will become unstable or become so infected that you can't recover it. Follow this Microsoft article to learn how to backup. Follow this article by Microsoft to restore your backups.

Alternatively, you can use 3rd-party programs to back up your data. One example can be found at Bleeping Computer.

Avoid P2P

P2P may be a great way to get lots of stuffs, but it is a great way to get infected as well. There's no way to tell if the file being shared is infected. Worse still, some worms spread via P2P networks, infecting you as well. If you do need to use them, use them sparingly. Check this list of clean and infected P2P programs if you need to use one.

Prevent a re-infection

1. Spyware Blaster
   SpywareBlaster is a program that is used to secure Internet Explorer by making it harder for ActiveX programs to run on your computer. It does this by disabling known offending ActiveX programs from running at all.
   
   You can download SpywareBlaster from Javacool.
   
   If you need help in using SpywareBlaster, you can read SpywareBlaster's tutorial at Bleeping Computer.
   
   
2. SpywareGuard
   Just as an antivirus program scans a file for viruses before opening it, SpywareGuard does the same thing, except that it scans it for spywares.
   
   You can download SpywareGuard from Javacool.
   
   If you need help in using SpywareGuard, you can SpywareGuard's tutorial at Bleeping Computer.
   
   
   A tutorial about Hosts File can be found at Malware Removal.
   
   
3. Malwarebytes' Anti-Malware
   Malwarebytes' Anti-Malware is a new and powerful anti-malware program. It scans and removes malware for free, but if you want real-time protection, you can pay a small one-time fee.
   
   Remember to update and scan with it regularly. A tutorial for using Malwarebytes' Anti-Malware can be found on BFC Computer Help.
   
   Before downloading any anti-spyware programs, always check the Rogue/Suspect list of anti-spyware programs and Malwarebytes RogueNET. This will save you from a lot of trouble. If in doubt, don't ever download it.
   
   
4. SiteHound Toolbar
   SiteHound is a toolbar that warns you if you go to a site that is known to scam people, that has potentially lots of viruses or spywares or has questionable contents. If you know the site, you can enter it; if you don't, it will bring you back to the previous page. Currently, SiteHound works for Internet Explorer and Firefox only.

Use an alternative email client

If you are using Outlook Express as your default email client, try using Thunderbird or Pegasus Mail instead.

Here are some more things to read about:

List of clean and infected download managers
Configuring Skype
Greater email safety
Phishing - what is it?
Configuring Outlook Express
The Unofficial Cookie FAQ
Securing your home wireless network
80 Super Security Tips
The different classes of security softwares

[tamskinner]

Thank you so much for your help. Once again I am enormously impressed with the service provided here. I will be making a donation again.
Cheers.
Tam

[Gary R]

This topic is now closed.

If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Gary R