Slow searching

[chryssi2001]

Hello redcap04,

I am glad the pc is running better.

Somehow you manage to save Kaspersky report as HTML, or you copied the entire page when Kaspersky finished, and not only the report..
Never mind.

Tell me do you know what is this on your desktop?

C:\Documents and Settings\Troilus\Desktop\Script\registryedit.vbs

It was created after the first time you run Combofix report.
Did you make any changes to the registry yourself?
----------------------------------------------
FileLook

• Double-click FileLook.exe to run it. (Vista users will almost certainly have to right click and select Run As Administrator)
• Ensure that the BBCode Ouput checkbox is checked.
• Copy the content of the following codebox into the main textfield:
  
  

  Code: Select all

  C:\WINDOWS\DUMP7743.tmp
  C:\WINDOWS\DUMP073e.tmp
  

  
  
• Click the FileLook button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found at C:\fl_log.txt
----------------------------------------------
Your Adobe Reader is disabled from start-up using msconfig.
You should update it as you have version 8.

Update Adobe Reader
Recently there have been vunerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version. Adobe Reader 9.
You can download it from http://www.adobe.com/products/acrobat/readstep2.html
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Adobe 9 is a large program and if you prefer a smaller program you can get Foxit 2.0 instead from http://www.foxitsoftware.com/pdf/rd_intro.php
----------------------------------------------
Post back:
FileLook results.
Answer to my question please.

[redcap04]

It was a script which just enabled registry editting i didnt use it much cause i barely get the chance to change lines in the registry. No i don't change lines directly.

FileLook.exe v2.0 by jpshortstuff
Log created at 00:30 on 01/11/2008
==================================
FileLook - "DUMP7743.tmp"

Filename: DUMP7743.tmp
Path: C:\WINDOWS\
MD5: 688769F9FCB9AB1AD2A8B31D3DA7A311
Created: 23:07:51 on 03/12/2007
Modified: 11:41:14 on 23/07/2008
Size: 110592 bytes
Attributes: Archive Compressed
-------------------------
==================================
FileLook - "DUMP073e.tmp"

Filename: DUMP073e.tmp
Path: C:\WINDOWS\
MD5: C7540480EC3F1FB78281BF27D3146947
Created: 23:07:51 on 03/12/2007
Modified: 13:47:31 on 22/07/2008
Size: 110592 bytes
Attributes: Archive Compressed
-------------------------

==============================

=EOF=

[chryssi2001]

Hello redcap04,

It was a script which just enabled registry editting i didnt use it much cause i barely get the chance to change lines in the registry. No i don't change lines directly.

Please avoid messing up with the registry, even with a tool.

A mistake can make your pc unbootable.
----------------------------------------------
Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to and find the following files: if found, delete the following:

C:\WINDOWS\DUMP7743.tmp
C:\WINDOWS\DUMP073e.tmp
----------------------------------------------
I can't see any firewall in your HijackThis log, so i assume you use windows firewall.

FIREWALL
Without a firewall your computer is susceptible to being hacked and taken over. If you use the Windows Firewall you might think that's sufficient but it only controls one way of the traffic (inbound). Simply using a Firewall in its default configuration can lower your risk greatly. It's preferable to install one of the suggested firewalls.
Vista users, must check compatibility with Vista before installation.

FREE FIREWALLS

• Comodo
• Outpost
• Sunbelt Kerio

Tutorial about Firewalls can be found here
----------------------------------------------
Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
• 

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

----------------------------------------------
Remove FileLook and the reports it created which should be located here:C:\fl_log.txt
----------------------------------------------
OTCleanIt

Please download OTCleanIt and save it to desktop. This tool will remove all the tools we used to clean your pc.

• Double-click OTCleanIt.exe.
• Click the CleanUp! button.
• Select Yes when the "Begin cleanup Process?" prompt appears.
• If you are prompted to Reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
----------------------------------------------
Congratulations you are clean!

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.6
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install SpyWare Blaster 4.0
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com
Note 1: If you are running Windows XP SP2, you should upgrade to SP3.
Note 2: Users of Norton Internet Security 2008 and newer versions should uninstall the software before they install Service Pack 3.
The security suite can then be reinstalled afterwards.

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Is your pc running slow?
Read What to do if your Computer is running slowly

Happy safe surfing!

[redcap04]

Thanks man =). I've installed some of the stuff you requested and all the stuff to remove the tools we used. If there's any way I can help you just send me a pm or an email.

[chryssi2001]

You are welcome redcap04.... I am a lady

Your email address will be removed to protect you from spam.

Surf safe and stay clean.

[Gary R]

This topic is now closed.

If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Gary R

e-mail address removed