My HiJackThis Log

[Wingman]

Hello dragon910,
Good job, getting those programs updated.
Let's run a few scans to make sure there's nothing hiding somewhere...

Please read these instructions carefully before executing and then perform the steps, in the order given. lf, you have any questions or problems, executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

Step 1.
Malwarebytes' Anti-Malware
Please save any items you were working on... close any open programs. You may be asked to reboot your machine.
Please download Malwarebytes Anti-Malware and save it to your desktop. If needed...Tutorial w/screenshots
Alternate download sites available here or here.

1. Make sure you are connected to the Internet.
2. Double-click on mbam-setup.exe to install the application.
   VISTA users: Right-click on mbam-setup.exe, select "Run As Administrator" to install the application.
3. When the installation begins, follow the prompts and do not make any changes to default settings.
4. When installation has finished, make sure you leave both of these checked:
   • Update Malwarebytes' Anti-Malware
   • Launch Malwarebytes' Anti-Malware
   • Then click Finish.
   MBAM will automatically start and you will be asked to update the program before performing a scan.
   • If an update is found, the program will automatically update itself.
   • Press the OK button to close that box and continue.
   • Problems downloading the updates? Manually download them from here and double-click on "mbam-rules.exe" to install.

On the Scanner tab:

1. Make sure the "Perform Quick Scan" option is selected.
2. Then click on the Scan button.
3. If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
   The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
   When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
4. Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

1. Click on the Show Results button to see a list of any malware that was found.
2. Check all items except items in the C:\System Volume Information folder... then click on Remove Selected.
   We will take care of the System Volume Information items later.
   When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
   The log is automatically saved and can be viewed by clicking the Logs tab in MBAM. The log can also be found here:
   C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
3. Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Step 2.
ESET NOD32 Online Scan
Note: You - will - need to use Internet Explorer for this scan!
Vista users: You will need to to right-click on the IE icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.
Please temporarily disable your Anti-virus real-time protection. If active, it could impact the online scan.
Please go to ESET Online Scanner - © ESET All Rights Reserved... to run an online scan.
** Make sure you are using an account that has Administrative privileges **

Press the "ESET Online Scanner" button.

1. Check the box next to "YES, I accept the Terms of Use."
2. Click "Start"... a window will open... it may appear nothing is happening... please be patient.
3. Click Yes... at the run ActiveX prompt. Click Install... at the install ActiveX prompt.
   Once installed, the scanner will be initialized.
4. Click "Start". Make sure that the options:
   • Remove found threats is UNCHECKED
   • Leave the "default" settings under Advanced as they are, if not set , please check:
     
     • Scan for potentially unwanted applications
     • Scan for potentially unsafe applications
     • Enable Anti-Stealth Technology
5. Click "Start"... ESET scanner will begin to download the virus signatures database.
   When the signatures have been downloaded, the scan will start automatically.
6. Wait for the scan to finish... it may take a while... please be patient. When the scan is finished...
7. Use Notepad to open the log file located at C:\Program Files\EsetOnlineScanner\log.txt
8. Copy and paste the contents of log.txt in your next reply.

Remember to enable your Anti-virus protection... before continuing!
You may also enable your Spybot Tea-Timer protection again.

Step 3.
Please include in your next reply:

1. Any problem executing the instructions?
2. MBAM scan results.
3. ESET online scan results.
4. How is the computer behaving?

Thanks,
Wingman

[dragon910]

1. There were no problems in executing the instructions.
4. The computer is behaving fine.
2. MBAM scan results
Malwarebytes' Anti-Malware 1.44
Database version: 3535
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

1/10/2010 10:25:21 AM
mbam-log-2010-01-10 (10-25-21).txt

Scan type: Quick Scan
Objects scanned: 97946
Time elapsed: 12 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\ByteLinker (PUP.BitSpirit) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
3. ESET online scan results
esets_scanner_update returned -1 esets_gle=53251
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=75f8f50544fb524ba5279f9ecea33b7b
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2010-01-11 12:55:58
# local_time=2010-01-10 04:55:58 (-0800, Pacific Standard Time)
# country="United States"
# lang=9
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 1143360 1143360 0 0
# compatibility_mode=1280 16777215 100 0 0 0 0 0
# compatibility_mode=5121 16776893 100 96 4498542 16001783 0 0
# compatibility_mode=5892 16776637 100 100 0 99776231 0 0
# compatibility_mode=6912 16777215 100 0 1136463 1136463 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=107542
# found=0
# cleaned=0
# scan_time=2699

[Wingman]

Hello dragon910,

Based on the scan results and how the computer is running, I think you are good to go.
Please read these instructions carefully before executing and then perform the steps, in the order given.
lf, you have any questions or problems, executing these instructions, <<STOP>> do not proceed, post back with the question or problem.

We need to cleanup some of the tools we used, as these are not for everyday use and could damamge the computer if used improperly.

Step 1.
Please delete the following programs from your desktop:
sreng2.zip
SREngLdr.EXE
SysProt.zip
Sysprot.exe
All logs or reports from these programs can also be deleted.

Step 2.
OTC
Let's perform some housekeeping and cleanup some of the other tools we used.
Please download OTC.exe... by OldTimer. Save it to your desktop.

1. Right click on OTC.exe and select Run As Administrator.
2. Click on Allow, then click on CleanUp!.
3. Click "Yes" to the Begin cleanup process? prompt.
4. Click "Yes" ... when prompted to reboot the computer to remove files.

Your computer should restart automatically. If it doesn't, please do so manually.

Step 3.
If you haven't already done so... you can enable your Spybot TeaTimer protection.

Please follow these simple guidelines in order to help keep your computer more secure:

You have ERUNT, this can be used to create a registry backup and restore it if needed.
View the readme file for instructions to have a backup created automatically each day.

Create a System Restore Point

1. Right-click on Computer ... select Properties.
2. In the left pane under Tasks ... click System protection.
   If UAC prompts for an administrator password or approval, type the password or give your "permission to continue".
3. Select System Protection ...then choose Create.
4. In the System Restore dialog box, type a description for the restore point ... click Create, again.
   A window will pop up with "The Restore Point was created successfully" confirmation message.
5. Click OK ...then close the System Restore dialog.

Now you have a clean restore point to use if you need to restore your system.

Perform Disk Cleanup
Note: You have to have administrative rights to run Disk Cleanup for "All" users.

1. Click the Vista Start... button. Type disk in the Start Search text entry box.
2. Double click the Disk Cleanup entry, from the matching program list.
3. In the Disk Cleanup options...select "Files from all users on this computer"
   If the Disk Cleanup: Drive Selection dialog box appears:
   • Select the drive where Windows Vista is installed. (Normally, this would be C:\ drive)
   • Press the "OK"...button.
   Disk Cleanup will begin space saving calculations.
4. When the calculations are finished... Press the More Options tab.
5. In the "System Restore and Shadow Copies" section... select "Clean up" button.
6. Press the "Delete"... button, at the "Are you sure..." prompt.
   Disk Cleanup will begin cleaning up old files and restore points.
7. Exit Disk Cleanup.

This will remove all restore points except the one you just created..

Update your Antivirus programs and other programs regularly.
Secunia Software Inspector - Copyright © Secunia. F-secure Health Check - Copyright © F-Secure Corporation.

Visit Microsoft often.
Keep on top of critical updates , as well as other updates for your computer.
Using Windows Update in Windows Vista
What is Windows Update?
Microsoft Update Home

Install additional (free) programs, that can help improve security.
Many feel that having a "layered" protection scheme is beneficial, you'll have to decide what works best for your situation.
Here are a few you can look into, if you want.

Malwarebytes' Anti-Malware
You have this already, so ignore the download instructions. This is an excellent scanner and should be used frequently. Always check for updates, before scanning.
Download it from Malewarebytes © Malwarebytes Corporation.
Tutorials are available for installing and running, Malwarebytes' Anti-Malware.
Powerful, easy to use and free. For real-time protection you will have to purchase the product.

Spybot Search and Destroy
Do not enable Spybot's Teatimer protection, if you have WinPatrol installed. System conflicts can occur.
Download it from © Safer Networking Ltd. Just choose a mirror and off you go.
A Spybot tutorial can be found Here.

SpywareBlaster
You have this installed... but you are also using Internet Explorer 8...
If using Internet Explorer 8 and using the SmartScreen Filter, do not install. Can inhibit browser performance. Use the Smart Screen Filter.
Download it from © Javacool Software LLC.
A SpywareBlaster knowledgebase can be found Here.

WinPatrol
Do not install if you have installed Spybot Search & Destroy and enabled Teatimer protection. System conflicts can occur.
Download it from Copyright © BillP Studios
Information about how WinPatrol works, is available Here
(The free version of WinPatrol... provides limited real-time protection)

Firetrust SiteHound
You can find information and download it from © Firetrust Ltd

Firewall
Looking over your log, it appears the installed firewall (Outpost) is disabled. If your AV product (McAfee) provides a firewall, you're using, great!
Otherwise, the installed firewall should be enabled to provide an additional level of protection.
As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access from the outside world.
Firewalls protect against hackers and malicious intruders.
If you prefer a different firewall ... you could download a free (for personal use) firewall NOW that monitors traffic in
both directions... from one of these excellent vendors:

1. Comodo (Is now bundled with AV software, toolbar and search provider. Opt to install only the firewall software... uncheck the rest)
2. ZoneAlarm (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)
3. Ashampoo
4. Agnitum
5. Sunbelt/Kerio ... (30 day free trial)

Remember to install and have active, only one firewall at the same time.

Read - stay informed.
Please check out these articles:
Tony Klein's "How did I get infected in the first place?"
How to prevent Malware:© miekiemoes - Microsoft MVP - Consumer Security .

Unless you have any malware related questions, please let me know you performed the various steps outlined and read the remainder of the post.
Once I receive your reply, unless you have problems, I will ask for this topic to be closed as resolved.

Stay Safe!
Wingman

[dragon910]

I am done with everything(and there were no problem in executing the instructions).
McAfee already has a firewall, so I disabled Outpost.
You can close the topic now.
Thanks for your help .

[Wingman]

Glad we could help.

[Dakeyras]

As it appears this issue has been resolved, this topic is now closed.

We are pleased we could help you resolve your computer's malware issues.

If you would like to make a comment or leave a compliment regarding the help you have received, please see Feedback for Our Helpers - Say "Thanks" Here.