This thread's last reply is from August 4, 2008, 7:14 PM UTC. Software, malware, and removal-tool
advice below may be out of date — treat specific steps and download links with caution.
I recently had a problem, restored to a 12/18/07 backup and still had the problem. Then I figured out it was my mouse that was malfunctioning, and I basically do not have the symptoms with my new mouse (although once in a while it does a little bit).
However, 12/18/07 backup had a "Backdoor:WIN32/Agent" found by Windows Defender and a trojan 7KJNLY2H found by Spy Sweeper. I have deleted both, rebuilt my files and the enclosed Hijack This log was done after deleting both. But it shows some possible effects this backdoor and trojan have had on my registry, etc. And I'm wondering if my mouse was just old or was it being infected, in which case my new mouse may end up with problems. So I am asking for help to eliminate the after-effects. Thank very much!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:14:31 AM, on 7/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Automated three-day notice: This topic had gone unanswered for more than three days. The original forum asked the author to post a link in its waiting-for-help queue within two days or the topic would be closed.
Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
Continue to respond to this thread until I give you the All Clean! If you have any question or you're stuck in there please reply it to me. I will try my best to help you!
Please bookmark or favourite this page. In case you need it as reference or etc.
Thank you so very much! Here is a new Hijack This log from today. I haven't done much since the original one of 7/19/08 that would affect the registry. I have a second job working at home doing data analysis and send reports by email, but I haven't tried to do anything with my basic problems with the computer while waiting to hear from you.
Only one new thing. Nearly every time I open Firefox, my AVG antivirus finds a new "trafficmp" tracking cookie.
Well here goes with the log. And thanks again! Yvette
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:49:19 PM, on 7/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
I can't see really infections in your HijackThis log, just minor fixes.
Do you have any other symptoms now except of this?
Only one new thing. Nearly every time I open Firefox, my AVG antivirus finds a new "trafficmp" tracking cookie.
We are cleaning Firefox cookies with ATF cleaner, so pay attention to what i wrote and use Firefox Tab in ATF cleaner, i am also posting instructions to clean your Firefox Cache. ----------------------------------------------
Please download ATF cleaner
Make sure that all browser windows are closed.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browser
Click Opera at the top and choose: Select All
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program. ----------------------------------------------
Open Firefox:
Choose Tools Tab.
Click on Clear private data.
Tick Cache and which others you choose to clean them.
---------------------------------------------- Disable MS Defender until the computer is clean
Microsoft Defender normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.
- Open Windows Defender
- Select Tools and then General Settings
- Under Real Time Protection Options uncheck Turn on real-time protection
- Select Save Don't forget to re-enable it, when your computer is clean. ---------------------------------------------- Disable SpySweeper until the computer is clean
SpySweeper normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.
- Open SpySweeper
- Select Options and then Program Options
- Uncheck the option Load at Windows Startup
- Select Shields and uncheck all there
- Uncheck Home page shield
- Uncheck automatically restore default without notification
- Reboot your machine to complete the process Don't forget to re-enable it, when your computer is clean. ---------------------------------------------- Disable Spybot's TeaTimer. This is a two step process.
Spybot S&D's tea timer normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.
First step:
Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For Either Version :
Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.
Don't forget to re-enable it, when your computer is clean. ---------------------------------------------- FIX HIJACKTHIS ENTRIES
Open up Hijackthis.
Click on do a system scan only.
Place a checkmark next to these lines(if still present).
Then close all windows except Hijackthis and click Fix Checked
Close HijackThis. ---------------------------------------------- Malwarebytes' Anti-Malware
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
Post that log back here.
----------------------------------------------
Post back:
A new HijackThis log.
Malwarebytes' Anti-Malware report.
Any more problems?
I have another problem but only occasionally. Once in a while my mouse acts weirdly, like jumping to another location on the screen or suddenly appearing somewhere else. When it is really bad I have to carefully navigate it up to where I want it. Since this is what it was doing to the extreme when I was badly infected, this is worrying me. (I went back to an older backup I had on disk to eliminate most of the infection.)
I have a couple of questions before I do this.
1. I found ATF Cleaner at majorgeeks.com. Is this the one you want me to download?
2. Do I do these in the order you wrote? Or should I disable Windows Defender, Spy Sweeper and Spybot Teatimer first?
3. On the O15 items, I didn't manually set any trusted zones and don't even know how to. However, att is my IP address and I have my high speed internet through AT&T, as well as a main email address and a subaccount email address at att.net. So I am assuming I should not fix the att.net.
4. I had noticed the sbcglobal.net and wondered. I never had anything to do with sbcglobal.net. I got a new computer and high speed internet last November (with AT&T). I used to have SBC as my phone carrier when I had dialup and a different computer, but I had a prodigy.net email address back then, not sbcglobal.net. I once opened one of those multi-forwarded emails from an sbcglobal.net email that my boss sent me. Could that have been what infected me? (I usually don't open that kind of email at all.) So I will check the sbcglobals to fix them.
5. I ran a startup list in Hijack This and had a bunch of "registry keys not found" and a number of installed components in active setup stub paths "disabled by HKCU twin". Are these what will be fixed by the registry fixes you identified or are they not to be worried about? They sound pretty bad to a non-computer geek like me!
I'll wait to get your answers to these last questions before I do these fixes so I am sure I am doing everything right.
1. I found ATF Cleaner at majorgeeks.com. Is this the one you want me to download?
Yes
2. Do I do these in the order you wrote? Or should I disable Windows Defender, Spy Sweeper and Spybot Teatimer first?
Yes, exactly like i wrote them.
5. I ran a startup list in Hijack This and had a bunch of "registry keys not found" and a number of installed components in active setup stub paths "disabled by HKCU twin".
This is normal. ------------------------------------------------
If you fix 015 lines, and something wrong, like loosing internet connection, you can open HijackThis, click on Backups, and check they 015 lines to bring them back. I'll explain the way you can do it here:
RESTORE ENTRIES
Open HijackThis.
Open the Misc Tools section.
Click on backups tab.
Find 015 lines you fixed.
Put a tick and click on Restore.
------------------------------------------------
Now about your mouse problem, i am not sure what is creating this problem, let me know if still the same after you do all the steps i asked.
One last question: Of the Hijack This fixes you wanted me to do, I have a question about alcmtr. It seems to have come with Realtek which was installed on my computer when I got it. I googled it and found a warning not to disable it unless it was causing computer problems. Should I do this?
About the mouse--when I had the really serious problems starting July 5, it turned out to be a bad mouse. I bought a new optical mouse and almost all the symptoms have gone, but occasionally it does these things. Maybe it is too sensitive or something????
I'm getting started on your list, but will wait for the answer about the alcmtr before I do the HijackThis fixes. Thanks again! Yvette
"yalycer" wrote:One last question: Of the Hijack This fixes you wanted me to do, I have a question about alcmtr. It seems to have come with Realtek which was installed on my computer when I got it. I googled it and found a warning not to disable it unless it was causing computer problems. Should I do this?
Description of ALCMTR.EXE
Realtek AC97 Audio - Event Monitor. "Spyware" file used surreptitiously monitor one's actions. It is not a sinister one, like remote control programs, but it is being used by Realtek to gather data about customers
Fixing the line with HijackThis will only stop it loading when the computer boot. It will still work.
About the mouse--when I had the really serious problems starting July 5, it turned out to be a bad mouse. I bought a new optical mouse and almost all the symptoms have gone, but occasionally it does these things. Maybe it is too sensitive or something????
Did you have an optical mouse before this one?
If not, try changing the mouse pad, buy one with no slippery surface, and see if any difference.
I did not have an optical mouse before. The mouse that came with my computer didn't have a large enough ball inside to work right, so I went back to a mouse from my 1997 computer. This worked fine for months, but apparently got too old and started shorting out or something. That is most if not all of what I was experiencing when I thought I had a really bad virus. My new optical mouse doesn't do well with the mouse pad I have, so I am just using it on a laminated desktop. Good idea to try a better mousepad.
Before I found out the 1997 mouse was malfunctioning, my son had me download a number of spyware sweeps, including Hijack This, and I found a Backdoor/Win 32 agent and a trojan. However, when I restored to the December 2007 DVD, they were there, so I had those viruses for a while, with no noticeable effect. I eliminated them and bought the new mouse and am now getting help from you to make sure I have straightened out all my problems and can have a clean computer.
I will go get my instructions and get to work on it. I'll be sending the two logs soon. Thanks again, Yvette
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:27:00 AM, on 7/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Here you are. mbam found nothing to remove. Be waiting to hear from you and thanks again so very much, Yvette
That's great, and you are welcome.
We'll do another scan just to be sure there is no remainants from that infection you had. ----------------------------------------------
I can't see any firewall in your HijackThis log, so i assume you use windows firewall.
FIREWALL
Without a firewall your computer is susceptible to being hacked and taken over. If you use the Windows Firewall you might think that's sufficient but it only controls one way of the traffic (inbound). Simply using a Firewall in its default configuration can lower your risk greatly. It's preferable to install one of the suggested firewalls. Vista users, must check compatibility with Vista before installation.
Tutorial about Firewalls can be found here ----------------------------------------------
Update Adobe Reader
Recently there have been vunerabilities detected in older versions of Adobe Reader. It is strongly suggested that you update to the current version. Adobe Reader 9.
You can download it from http://www.adobe.com/products/acrobat/readstep2.html
If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.
Adobe 9 is a large program and if you prefer a smaller program you can get Foxit 2.0 instead from http://www.foxitsoftware.com/pdf/rd_intro.php ----------------------------------------------
Update Java Runtime
You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 7.
Go to Java Runtime Environment (JRE) 6 Update 7 and click on Download button.
In Platform box choose Windows.
Check the box to Accept License Agreement and click Continue.
Click on Windows Offline Installation, click on the link under it which says "jre-6u7-windows-i586-p.exe" and save the downloaded file to your desktop.
Go to Start => Control Panel => Add or Remove Programs
Uninstall all old versions of Java (Java 3 Runtime Environment, JRE or JSE)
Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions.
Reboot your computer
---------------------------------------------- Run Kaspersky Online AV Scanner Note:Internet Explorer should be used.
Please go to Kaspersky website and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
Click on My Computer under Scan and then put the kettle on!
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place like your Desktop. Change the Files of type to Text file (.txt) before clicking on the Save button.
Copy and paste the report into your next reply along with a fresh HJT log and a description of how your PC is behaving.
----------------------------------------------
Post back:
Kaspersky report.
A new HijackThis log.
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, July 27, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, July 28, 2008 04:39:42
Records in database: 1017623
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
Scan statistics:
Files scanned: 46459
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 00:48:48
No malware has been detected. The scan area is clean.
The selected area was scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:16 PM, on 7/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
This is an Optional Removal.
You might consider removing AskBar toolbar after reading this information.
Use Add/Remove programs and uninstall it if you decide to do so, then continue with the rest of my instructions to completely remove it from your pc. ----------------------------------------------
Please disable MS Defender if you are removing AskBar lines using HijackThis, as it may interfere with the fix. You can re-enable it, and all other programs we disabled, after you are done.
Disable MS Defender until the computer is clean
Microsoft Defender normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.
- Open Windows Defender
- Select Tools and then General Settings
- Under Real Time Protection Options uncheck Turn on real-time protection
- Select Save Don't forget to re-enable it, when your computer is clean. ---------------------------------------------- FIX HIJACKTHIS ENTRIES
Open up Hijackthis.
Click on do a system scan only.
Place a checkmark next to these lines(if still present).
Then close all windows except Hijackthis and click Fix Checked
Close HijackThis. ----------------------------------------------
Using Windows Explore by right-clicking the Start button and left clicking Explore navigate to and find the following Folder: if found, delete the following (some may not be present after previous steps):
C:\Program Files\AskSBar ----------------------------------------------
Congratulations you are clean!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore-WINDOWS XP
This is a good time to clear your existing system restore points and establish a new clean restore point:
Turn off System Restore
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
This will remove all restore points except the new one you just created.
Here are some free programs I recommend that could help you improve your computer's security.
Spybot Search and Destroy 1.6
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here
Install SpyWare Blaster 4.0
Download it from here
Find here the tutorial on how to use Spyware Blaster here
Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here
Install FireTrust SiteHound
You can find information and download it from here
Install MVPS Hosts Filefrom here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc. Secunia Software Inspector
F-secure Health Check
Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com Note 1: If you are running Windows XP SP2, you should upgrade to SP3. Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.
The security suite can then be reinstalled afterwards.
Please check out Tony Klein's article "How did I get infected in the first place?"
Read some information here how to prevent Malware.
Thank you for the information on the Ask Toolbar. It was one of the items my son questioned on my first Hijack This log back in the beginning of July. But it wasn't on the backup I restored. It was with one of the programs you had me download yesterday (Java, Adobe or Comodo), but I unchecked it before installing. Yet the toolbar appeared anyway!
so I am getting rid of it.
I will do these last things and reenable the things you had me disable before.
How long will this post be here before it gets archived? I think the extras you've suggested I may wait a few weeks and look over them then. I have so many new spywares and antiviruses and firewalls I need to learn to use first. But I'm really glad for the link on how to use Spybot, because I've had that for a long time and probably never knew how to use it right.
And if this post gets archived, do the links still work? Because if they don't, I may set up a bookmarks folder now to save them for my use later.
How do I know if I have Windows XP SP2? I have Windows XP Pro and I have a security center that sounds like the description I found in "help and support". (I uninstalled Norton when Vern suggested I get AVG.)
Anyway, now I want to thank you one last time for all your help. My son may have been able to figure out all my problems eventually, but he's been working extra hours and got frustrated trying to help me long distance. And I was frustrated because the final deadline on my data analysis project is August 11, and I only have weekends to work on it. I may not have had much infection left when I found you, but I needed to be sure I didn't have some little something left that would grow and suddenly disable me again. Having lost two weekends of work time with my problems (even if they did turn out to be my old mouse), I couldn't afford to take any chances that there wasn't something else wrong. So I thank you and the Dental Task Force I'm doing this research for thanks you!!!
By the way, I got a cloth mouse pad today and so far it seems to be doing the trick.
Yours with much, much gratitude, Yvette
✨ Ask AI about this thread
No ads, no affiliate links — generated on request from this thread's own
archived content, not written by forum staff. Never run a scan/removal tool
as a self-service step if the original thread describes it being done under
a helper's direct supervision, and don't include your name, email, or other
personal details in a follow-up question. See our privacy page
for details on how this works.
