This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

here are my 2 logs smit & hijck exp keeps adding new windows

54 min read

This thread's last reply is from February 5, 2008, 3:33 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

chryssi2001
February 3, 2008, 3:35 PM UTC
Hello drahm2007,

As i wait for the other scan..yawnnnnnn.....What can you tell me about the restore and recovery not working?

Do you mean you can't access restore point?
Maybe the infection you had disabled it.

I can see system restore points at C: and D: Drives.
-----------------------------------------------
Run this tool to enable restore point if you still have a problem.

Download to your Desktop FixPolicies.exe, a self-extracting ZIP archive from here: http://downloads.malwareremoval.com/BillCastner/FixPolicies.exe
  • Double-click FixPolicies.exe.
  • Click the "Install" button on the bottom toolbar of the box that will open.
  • The program will create a new Folder called FixPolicies.
  • Double-click to Open the new Folder, and then double-click the file within: Fix_Policies.cmd.
  • A black box should briefly appear and then close. This will enable your Control Panel and stop the Administrative warnings, at least until the malware infection resets the registry policy keys again. You can run this as many times as you like. A permanent fix requires removing the infection.

-----------------------------------------------
Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to and find the following Folder:

C:\QooBox\Quarantine

Right-click on it and empty all contents.
-----------------------------------------------
Your reports are clean. Let me know if you can access restore point now.
drahm2007
February 3, 2008, 4:43 PM UTC
pop ups are no more..cant thank you enough.....now about the restore points....i guess i would want to wait until this is all over before i try to go back. My fear is that i will same issues as i was having. I would prefer to restore if needed, to a point that i know i wasn't having any issues. I hope it was ok to delete the Qoobox folder from that menu, to me that was the only way i know to empty it.... :colors: I will wait 24 hours before i try the restore feature, and then i wil post again.....Do you know how to referee a hockey game?....no?.....just wanted to make myself feel smart again....LOL
chryssi2001
February 3, 2008, 5:38 PM UTC
Hello drahm2007,

I am glad everything is working fine now. :)

now about the restore points....i guess i would want to wait until this is all over before i try to go back. My fear is that i will same issues as i was having.

In my instructions below, you will find instructions how to create a new restore point and flush away all the infected restore points. ;)
------------------------------------------
Let's clear out the programs we've been using to clean up your computer, they are not suitable for general malware removal and could cause damage if used inappropriately.

Please download OTMoveIt2 and save it to desktop.
  • Double-click OTMoveIt2.exe.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.

------------------------------------------
Congratulations you are clean! :)
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Set correct settings for files that should be hidden in Windows XP
  • Click Start > My Computer > Tools menu (at top of page) > Folder Options > View tab.
  • Under "Hidden files and folders" if necessary select Do not show hidden files and folders.
  • If unchecked please checkHide protected operating system files (Recommended)
  • If necessary check "Display content of system folders"
  • If necessary Uncheck Hide file extensions for known file types.
  • Click OK


This is a good time to clear your existing system restore points and establish a new clean restore point:
  • Go to Start > All Programs > Accessories > System Tools > System Restore
  • Select Create a restore point, and Ok it.
  • Next, go to Start > Run and type in cleanmgr
  • Select the More options tab
  • Choose the option to clean up system restore and OK it.

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.5.1
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here
Find here changes from older version 1.4 here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Happy safe surfing!
Gary R
February 5, 2008, 3:33 PM UTC
This topic is now closed.

If you are the originator of this topic, and you need it re-opened please send an email to 'admin at malwareremoval.com', including a link to this topic.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Please do not contact us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.

Gary R