Iminent/teeveewatch, etc malware

Hi,
Well done getting the ESET scan to run, the scan was clean so that's good news.

Firefox is behaving wierd where it would work fine after launching it at the begining but later on the entire window would turn completely black after accessing other sites making it impossible to see the webpage content.

Try running FireFox in Safe Mode, then let me know if it runs any better.

In the FireFox Browser go to Help > Restart with Add-ons Disabled > Restart.

Good morning Cypher and thanks again.

Starting Firefox in safe mode seems to have fixed the issue. No more black screens.

Fyi - Here are the Firefox Extensions, Appearance and plugins.

There were no Extensions.
Found 1 Appearance:
Default 21.0


Found 8 plugins:
iTunes Application Detector 1.0.1.1
Microsoft Download Manager Plugin 1.2.1.2044
Microsoft DRM 9.0.0.4503
Microsoft DRM 9.0.0.4503
QuickTime Plug-in 7.6.9
Shockwave Flash 11.7.700.202
Silverlight Plug-in 1.0.30716.0
Windows media Player Plug-in Dynamic Link Library 3.0.2.629


Thanks.

Hi,

Good morning Cypher and thanks again.

Good afternoon and you're welcome

Starting Firefox in safe mode seems to have fixed the issue. No more black screens.

Good, in that case reset FireFox, that should solve the problem.
.
In the FireFiox browser click Help > Troubleshooting information > Reset FireFox.
In the pop-up window click Reset FireFox again.

Your computer appears to be clean of malware.
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Double-click OTL.exe to run it.
• Copy and Paste the following code into the textbox. Do not include the word Code
• (Click the select all button next to the codebox to select the entire script).
  

  
  
  
  
  :commands
  
  [emptytemp]
  
  [clearallrestorepoints]
  
  
  
  

• Then click the Run Fix button at the top.
• Click .
• OTL may ask to reboot the machine. Please do so if asked.
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Next.

Clean up with OTL

• Double click on OTL.exe to run it.
• This will remove some of the tools we used to clean your pc.
• Close all other programs apart from OTL as this step will require a reboot
• On the OTL main screen, press the CleanUp! button
• Say Yes to the prompt and then allow the program to reboot your computer.

You can now delete any tools/logs we used if they remain on your Desktop.

Protection Programs
Don't forget to re-enable any protection programs we disabled during your fix.

Please read the article below which will give you a few suggestions for how to minimise your chances of getting another infection.

• Computer Security - a short guide to staying safer online

I would be grateful if you could reply to this post so that I know you have read it and, if you've no other questions, the thread can be closed.

Safe surfing!

Cypher,

REset Firefox completed but the black screen continued until I unchecked the checkbox: "Use hardware acceleration when available." Looks like the problem is gone.


Below is the latest OTL log and thereafter I ran the OTL cleanup which removed some of the tools used to fix the PC, like you said.

I sincerely appreciate the help and guidance you provided to fix my PC.



Thank you very much.



OTL log:

All processes killed
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: csgadm#
->Temp folder emptied: 181248 bytes
->Temporary Internet Files folder emptied: 16779997 bytes
->FireFox cache emptied: 14034440 bytes
->Flash cache emptied: 492 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Guest
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 19858 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: raglanj
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Sysprep

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4412536 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 84467748 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 122584 bytes

Total Files Cleaned = 115.00 mb

Error creating restore point.

OTL by OldTimer - Version 3.2.69.0 log created on 06282013_080000

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DF309B.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DF3131.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DF31E6.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DF324D.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DFB606.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DFB617.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DFC57F.tmp not found!
File\Folder C:\Documents and Settings\csgadm#\Local Settings\Temp\~DFC750.tmp not found!
C:\Documents and Settings\csgadm#\Local Settings\Temporary Internet Files\Content.IE5\Y7NBJ177\sh120[1].html moved successfully.
C:\Documents and Settings\csgadm#\Local Settings\Temporary Internet Files\Content.IE5\QI2G9NTV\like[1].htm moved successfully.
C:\Documents and Settings\csgadm#\Local Settings\Temporary Internet Files\Content.IE5\QI2G9NTV\viewtopic[3].htm moved successfully.
C:\Documents and Settings\csgadm#\Local Settings\Temporary Internet Files\Content.IE5\1CTCQYCI\welcome[1].htm moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...



Thanks.

Hi,

REset Firefox completed but the black screen continued until I unchecked the checkbox: "Use hardware acceleration when available." Looks like the problem is gone.

That's good to hear.

I sincerely appreciate the help and guidance you provided to fix my PC.

You're most welcome, glad we could help.
One more thing to do then you are good to go.

• Click Start, Right Click on Computer, and select Properties.
• In the left pane, click System Protection > Create.
• Give this restore point a descriptive name and click Create.
• Click Apply and OK.

Note: Do not clear infected/old System Restore points before creating a new System Restore point first!

Flush infected System Restore points

• Click Start, Right Click on Computer, and select Properties.
• In the left pane, click System Protection.
• Select the name of the drive (C:) and click "Configure."
• Click Delete.
• Click Continue or provide your administrator user name and password and click "OK.
• Restart your computer.

Once done let me know if you have any further questions, if not i will close this topic.

Cypher,
From the Start button which I clicked, Computer is not one of the choices available. I am running windows xp sp3. Thanks

Hi,
My apologies i gave you the wrong instructions, this should be correct.
Any other problems let me know.

Create a new, clean System Restore point

• Create a new, clean System Restore point which you can use in case of future system problems:
• Press Start >> All Programs >> Accessories >>System Tools >> System Restore
• Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
• Now remove old, infected System Restore points:
• Next click Start >> Run and type cleanmgr in the box and press OK
• Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
• Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
• Press OK and Yes to confirm

Hello Cypher,
LoL. I imagine you are helping many others simultaneously so no big deal
I created the System Restore point as you suggested.

Wishing you the best and thank you ever so much!

Hi,

LoL. I imagine you are helping many others simultaneously so no big deal

Usually yes but no excuse, thankfully no harm done this time

Wishing you the best and thank you ever so much!

You're welcome, we're happy to have helped.