RazeSpyware, popups, & slow computer - HiJack log attach

[Cannon]

We checked out both files at http://virusscan.jotti.org/ and got:


"The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file"

----------------------------------------------------------------------------------

Results of the Karspersky Scan:
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Wednesday, November 09, 2005 14:19:13
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 9/11/2005
Kaspersky Anti-Virus database records: 159104
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 64258
Number of viruses found: 9
Number of infected objects: 35
Number of suspicious objects: 0
Duration of the scan process: 7797 sec

Infected Object Name - Virus Name
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/ace.dll Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/blavga.exe Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/catqedit.exe Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/mmuutils.exe Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/rsfhdprf.dll Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/WinGenerics.dll Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip/backups/wtslmf32.exe Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Administrator\Desktop\aproposfix\backups\backups.zip Infected: Trojan.Win32.Crypt.t
C:\Documents and Settings\Jeff Cannon\Local Settings\Temporary Internet Files\Content.IE5\K5ERC5AV\087[1].htm Infected: Trojan-Downloader.JS.Inor.a
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS250.exe/WISE0018.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.d
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS250.exe/WISE0039.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS250.exe/WISE0040.BIN/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS250.exe/WISE0040.BIN/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS250.exe/WISE0040.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS250.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS251.exe/WISE0017.BIN Infected: not-a-virus:AdWare.Win32.180Solutions.d
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS251.exe/WISE0037.BIN Infected: not-a-virus:AdWare.Win32.NewDotNet
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS251.exe/WISE0038.BIN/SaveNow.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS251.exe/WISE0038.BIN/Uninst.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS251.exe/WISE0038.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare2.5\BS251.exe Infected: not-a-virus:AdWare.Win32.SaveNow.ag
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare4.6.3\BSINSTALL.exe/WISE0024.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare4.6.3\BSINSTALL.exe/WISE0024.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare4.6.3\BSINSTALL.exe/WISE0024.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare\BearShare4.6.3\BSINSTALL.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Program Files\BearShare\Installer\BSINSTALL.exe/WISE0024.BIN/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Program Files\BearShare\Installer\BSINSTALL.exe/WISE0024.BIN/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Program Files\BearShare\Installer\BSINSTALL.exe/WISE0024.BIN Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Program Files\BearShare\Installer\BSINSTALL.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z
C:\Program Files\Calypso3\Mailbox\Mary.box.bak/Received Mail/To:E-Post@jeffcannon.net From:register@cs.com Subj:Registration Confirmation Date:2005-05-09 13:32:23 -0700 /account_info.zip Infected: Email-Worm.Win32.Sober.p
C:\Program Files\Calypso3\Mailbox\Mary.box.bak Infected: Email-Worm.Win32.Sober.p
C:\Program Files\Microsoft AntiSpyware\Quarantine\09059B0C-A165-472B-95E7-BBE440\9C22F4F3-A3E8-4EA3-AB65-7E8F31/stream/data0005 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\Program Files\Microsoft AntiSpyware\Quarantine\09059B0C-A165-472B-95E7-BBE440\9C22F4F3-A3E8-4EA3-AB65-7E8F31/stream Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\Program Files\Microsoft AntiSpyware\Quarantine\09059B0C-A165-472B-95E7-BBE440\9C22F4F3-A3E8-4EA3-AB65-7E8F31 Infected: not-a-virus:AdWare.Win32.BargainBuddy.y
C:\WINDOWS\system32\ncvv9qa4.ini Infected: not-a-virus:AdWare.Win32.Sahat.ao

Scan process completed.

----------------------------------------------------------------------------------
Panda ActiveScan:


Incident Status Location

Possible Virus. No disinfected C:\Documents and Settings\Jeff Cannon\My Documents\BearShare\2004-07-10.Jewel.Quest.v1.206.Cracked.WinALL-F4CG.zip[jewelres.dll]
Possible Virus. No disinfected C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\Linksys\riched20.dll
Possible Virus. No disinfected C:\Program Files\GameHouse\Jewel Quest\jewelres.dll
Adware:Adware/Exact.BargainBuddyNo disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\09059B0C-A165-472B-95E7-BBE440\9C22F4F3-A3E8-4EA3-AB65-7E8F31
Adware:Adware/SpySheriff No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\C75E935A-B472-4FBE-93F7-A1F7A0\26149386-0005-4A61-8022-C1636C
Adware:Adware/Popuper No disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\C75E935A-B472-4FBE-93F7-A1F7A0\64CCA790-F65F-49FF-AECD-BF35FB
Adware:adware/startpage.cbx No disinfected C:\WINDOWS\scvhost.exe
Adware:adware/miamore No disinfected C:\WINDOWS\system32\winstyle3.dll

-----------------------------------------------------------------------------------


YIKES!!!

[Kimberly]

Indeed.

Click on Start, Control Panel, click on Add/Remove Programs
Look through the installed programs for the following items and remove them if present:

Bearshare
When U Save
180 solutions

I would remove those all those GameHouse games too. (Flip Words, Jewel quest...)

During the uninstall process, you might be presented with several prompts to guide you through uninstalling the product. Read these carefully to make sure you are actually choosing to uninstall rather than keep the software.
______________________________

Download win32delfkil.exe: http://users.telenet.be/marcvn/tools/win32delfkil.exe
Save it on your desktop.
Double click on win32delfkil.exe and install it. This creates a new folder on your desktop: win32delfkil
Close all windows, open the win32delfkil folder and double click on fix.bat.

The computer will reboot automatically. If the computer does not restart automatically, reboot it yourself.
______________________________

Using Windows Explorer, Search and Delete these Folders if listed:

C:\Documents and Settings\Administrator\Desktop\aproposfix
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\BearShare
C:\Program Files\BearShare
C:\Program Files\GameHouse

Using Windows Explorer, Search and Delete these Files if listed:

C:\Program Files\Calypso3\Mailbox\Mary.box.bak
C:\WINDOWS\system32\ncvv9qa4.ini
C:\WINDOWS\scvhost.exe
C:\WINDOWS\system32\winstyle3.dll
______________________________

Navigate to C:\Windows\Prefetch
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Windows\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Navigate to C:\Documents and Settings\(EVERY LISTED USER)\Local Settings\Temp
Click Edit, click Select All, press the DELETE key, and then click Yes to confirm that you want to send all the items to the Recycle Bin.

Clean out your Temporary Internet files. Procede like this:

• Quit Internet Explorer and quit any instances of Windows Explorer.
• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, click to select the Delete all offline content check box , and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin.
______________________________

Close ALL open Windows / Programs / Folders. Please start Ewido Security Suite, and run a full scan.

• Click on Scanner
• Click on Settings
  
  • Under How to scan all boxes should be checked
  • Under Unwanted Software all boxes should be checked
  • Under What to scan select Scan every file
  • Click on Ok
• Click on Complete System Scan to start the scan process.
• Let the program scan the machine.

If Ewido finds anything, it will pop up a notification. When it asks if you want to clean the first file, put a checkmark in the lower left corner of the box that says Perform action on all infections, then choose clean and click Ok.

Once the scan has completed, there will be a button located on the bottom of the screen named Save Report.

• Click Save Report button
• Save the report to your Desktop

Close Ewido.
______________________________

Start Ad-Aware SE

• Click on Add-ons
• Select the VX2 Cleaner plug-in and click Run Tool
• If your computer isn’t infected, click Close.
  OR
• If you computer is infected with VX2, a dialog box with text such as New VX2 variant found or VX2 variant 1 found will appear.
• Press Clean and a dialog box with text The first phase completed. Please reboot and perform a Smart Scan will appear.
• Reboot your computer
• Run Ad-Aware and Click on the Scan Now Button
  
  • Choose Perform Smart System Scan
  • DESELECT Search for negligible risk entries, as negligible risk entries (MRU's) are not considered to be a threat. (make it show a red X)
  Click Next to begin the scan. When the scan is completed, the Performing System Scan screen will change name to Scan Complete.
  
  Click the Next Button to get to the Scanning Results Window where more information about the objects detected during the scan is available. Click the Critical Objects Tab. In general all of the items listed will be bad. To fix all the bad critical objects, right click on one of them, click the Select All entry in the pop-up menu to mark all entries. Click Next and then OK in the dialog box to confirm the removal.

Repeat this until the VX2 Cleaner reports System clean. Press Close to exit.

Run Ad-Aware one more time and perform a Perform Full System Scan of your computer to make sure VX2 has been found and removed.
______________________________

Reboot the PC.

Download WinPFind.zip to your Desktop or to your usual Download Folder.
http://www.bleepingcomputer.com/files/winpfind.php
Extract it to your C:\ folder. This will create a folder called WinPFind in the C:\ folder.
Open the C:\WinPFind folder and double-click on WinPFind.exe.
Click on the Start Scan button and wait for it to finish.

This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log file named C:\WinPFind\WinPFind.txt. Please copy that log into your next reply.
______________________________

Please post the WinPFind.txt along with the Ewido log and a New HijackThis log.

Try to rescan those files at http://virusscan.jotti.org/ or http://www.virustotal.com/xhtml/index_en.html

Check this one too please:
C:\Documents and Settings\Jeff Cannon\My Documents\My Downloads\Linksys\riched20.dll

Kim

[Cannon]

Ok, here we go...


WinPFind.txt

WARNING: not all files found by this scanner are bad. Consult with a knowledgable person before proceeding.

If you see a message in the titlebar saying "Not responding..." you can ignore it. Windows somethimes displays this message due to the high volume of disk I/O. As long as the hard disk light is flashing, the program is still working properly.

»»»»»»»»»»»»»»»»» Windows OS and Versions »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Product Name: Microsoft Windows XP Current Build: Service Pack 2 Current Build Number: 2600
Internet Explorer Version: 6.0.2900.2180

»»»»»»»»»»»»»»»»» Checking Selected Standard Folders »»»»»»»»»»»»»»»»»»»»

Checking %SystemDrive% folder...
SAHAgent 11/8/2005 9:05:06 PM 18217 C:\adawarelog.txt
PECompact2 7/6/2005 6:21:28 PM 1334104 C:\WebCleaner.dll
aspack 7/6/2005 6:21:28 PM 1334104 C:\WebCleaner.dll

Checking %ProgramFilesDir% folder...

Checking %WinDir% folder...
PECompact2 10/26/2005 11:30:48 PM 16223629 C:\WINDOWS\lpt$vpn.915
qoologic 10/26/2005 11:30:48 PM 16223629 C:\WINDOWS\lpt$vpn.915
SAHAgent 10/26/2005 11:30:48 PM 16223629 C:\WINDOWS\lpt$vpn.915
UPX! 5/3/2005 10:44:44 AM 25157 C:\WINDOWS\RMAgentOutput.dll
UPX! 8/14/2005 12:45:04 PM 170053 C:\WINDOWS\tsc.exe
PECompact2 10/26/2005 11:30:48 PM 16223629 C:\WINDOWS\VPTNFILE.915
qoologic 10/26/2005 11:30:48 PM 16223629 C:\WINDOWS\VPTNFILE.915
SAHAgent 10/26/2005 11:30:48 PM 16223629 C:\WINDOWS\VPTNFILE.915
UPX! 8/14/2005 12:45:04 PM 1044560 C:\WINDOWS\vsapi32.dll
aspack 8/14/2005 12:45:04 PM 1044560 C:\WINDOWS\vsapi32.dll

Checking %System% folder...
PEC2 8/23/2001 7:00:00 AM 41397 C:\WINDOWS\SYSTEM32\dfrg.msc
SAHAgent 9/29/2005 2:31:20 PM 35 C:\WINDOWS\SYSTEM32\gdn9hnrr.ini
SAHAgent 9/29/2005 3:08:26 PM 3026 C:\WINDOWS\SYSTEM32\i6kq5tul.ini
PTech 7/12/2005 5:04:22 PM 520456 C:\WINDOWS\SYSTEM32\LegitCheckControl.dll
PECompact2 11/1/2005 9:34:18 PM 2368864 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 11/1/2005 9:34:18 PM 2368864 C:\WINDOWS\SYSTEM32\MRT.exe
aspack 8/4/2004 12:56:38 AM 708096 C:\WINDOWS\SYSTEM32\ntdll.dll
Umonitor 8/4/2004 12:56:46 AM 657920 C:\WINDOWS\SYSTEM32\rasdlg.dll
UPX! 10/30/2005 8:49:02 PM 42496 C:\WINDOWS\SYSTEM32\swreg.exe
winsync 8/23/2001 7:00:00 AM 1309184 C:\WINDOWS\SYSTEM32\wbdbase.deu

Checking %System%\Drivers folder and sub-folders...
UPX! 10/22/2005 10:05:40 AM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
FSG! 10/22/2005 10:05:40 AM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
PEC2 10/22/2005 10:05:40 AM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
aspack 10/22/2005 10:05:40 AM 726592 C:\WINDOWS\SYSTEM32\drivers\avg7core.sys
PTech 8/3/2004 10:41:38 PM 1309184 C:\WINDOWS\SYSTEM32\drivers\mtlstrm.sys

Items found in C:\WINDOWS\SYSTEM32\drivers\etc\hosts


Checking the Windows folder and sub-folders for system and hidden files within the last 60 days...
11/10/2005 10:32:52 AM S 2048 C:\WINDOWS\bootstat.dat
11/9/2005 10:00:50 AM H 24 C:\WINDOWS\p0Yrl
10/5/2005 8:33:38 PM S 12849 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896424.cat
10/4/2005 5:17:40 PM S 21737 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB896688.cat
9/28/2005 10:53:30 AM S 17402 C:\WINDOWS\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\KB900725.cat
11/10/2005 10:43:34 AM H 1024 C:\WINDOWS\system32\config\default.LOG
11/10/2005 10:43:20 AM H 1024 C:\WINDOWS\system32\config\SAM.LOG
11/10/2005 10:43:36 AM H 1024 C:\WINDOWS\system32\config\SECURITY.LOG
11/10/2005 11:29:42 AM H 1024 C:\WINDOWS\system32\config\software.LOG
11/10/2005 10:44:16 AM H 1024 C:\WINDOWS\system32\config\system.LOG
11/10/2005 3:01:38 AM H 1024 C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
10/14/2005 3:50:42 PM HS 388 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\89e834cb-58ae-4f8e-b41d-d14036b18964
10/14/2005 3:50:42 PM HS 24 C:\WINDOWS\system32\Microsoft\Protect\S-1-5-18\User\Preferred
11/1/2005 4:02:18 PM H 32389 C:\WINDOWS\system32\spool\drivers\w32x86\3\lxbama.GID
11/10/2005 10:33:10 AM H 6 C:\WINDOWS\Tasks\SA.DAT

Checking for CPL files...
Microsoft Corporation 8/4/2004 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\access.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 549888 C:\WINDOWS\SYSTEM32\appwiz.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 110592 C:\WINDOWS\SYSTEM32\bthprops.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 135168 C:\WINDOWS\SYSTEM32\desk.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 80384 C:\WINDOWS\SYSTEM32\firewall.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 155136 C:\WINDOWS\SYSTEM32\hdwwiz.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 358400 C:\WINDOWS\SYSTEM32\inetcpl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 129536 C:\WINDOWS\SYSTEM32\intl.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 380416 C:\WINDOWS\SYSTEM32\irprops.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 68608 C:\WINDOWS\SYSTEM32\joy.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\main.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 618496 C:\WINDOWS\SYSTEM32\mmsys.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\ncpa.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 25600 C:\WINDOWS\SYSTEM32\netsetup.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 257024 C:\WINDOWS\SYSTEM32\nusrmgr.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\nwc.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 32768 C:\WINDOWS\SYSTEM32\odbccp32.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 114688 C:\WINDOWS\SYSTEM32\powercfg.cpl
Apple Computer, Inc. 9/23/2004 5:57:40 PM 323072 C:\WINDOWS\SYSTEM32\QuickTime.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 298496 C:\WINDOWS\SYSTEM32\sysdm.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\telephon.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 94208 C:\WINDOWS\SYSTEM32\timedate.cpl
Microsoft Corporation 8/4/2004 12:56:58 AM 148480 C:\WINDOWS\SYSTEM32\wscui.cpl
Microsoft Corporation 5/26/2005 3:16:30 AM 174360 C:\WINDOWS\SYSTEM32\wuaucpl.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 187904 C:\WINDOWS\SYSTEM32\dllcache\main.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 35840 C:\WINDOWS\SYSTEM32\dllcache\ncpa.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 36864 C:\WINDOWS\SYSTEM32\dllcache\nwc.cpl
Microsoft Corporation 8/23/2001 7:00:00 AM 28160 C:\WINDOWS\SYSTEM32\dllcache\telephon.cpl
Microsoft Corporation 5/26/2005 3:16:30 AM 174360 C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl

»»»»»»»»»»»»»»»»» Checking Selected Startup Folders »»»»»»»»»»»»»»»»»»»»»

Checking files in %ALLUSERSPROFILE%\Startup folder...
1/13/2005 11:05:06 AM HS 84 C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini

Checking files in %ALLUSERSPROFILE%\Application Data folder...
1/13/2005 2:46:04 AM HS 62 C:\Documents and Settings\All Users\Application Data\desktop.ini

Checking files in %USERPROFILE%\Startup folder...
1/13/2005 11:05:06 AM HS 84 C:\Documents and Settings\Jeff Cannon\Start Menu\Programs\Startup\desktop.ini

Checking files in %USERPROFILE%\Application Data folder...
8/26/2005 9:17:18 AM 877 C:\Documents and Settings\Jeff Cannon\Application Data\AdobeDLM.log
1/13/2005 2:46:04 AM HS 62 C:\Documents and Settings\Jeff Cannon\Application Data\desktop.ini
8/26/2005 9:17:18 AM 0 C:\Documents and Settings\Jeff Cannon\Application Data\dm.ini
10/11/2005 5:49:20 PM 28112 C:\Documents and Settings\Jeff Cannon\Application Data\GDIPFONTCACHEV1.DAT
8/23/2005 7:56:56 AM 2059955 C:\Documents and Settings\Jeff Cannon\Application Data\Install.dat

»»»»»»»»»»»»»»»»» Checking Selected Registry Keys »»»»»»»»»»»»»»»»»»»»»»»

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
SV1 =
KB0:511863 = Microsoft patch Q339390

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]

[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers]
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\AVG7 Shell Extension
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With
{09799AFB-AD67-11d1-ABCD-00C04FC30936} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\WS_FTP
{797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll
HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}
Start Menu Pin = %SystemRoot%\system32\SHELL32.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG7 Shell Extension
{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} = C:\Program Files\Grisoft\AVG Free\avgse.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\WS_FTP
{797F3885-5429-11D4-8823-0050DA59922B} = C:\Program Files\WS_FTP Pro\wsftpsi.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EncryptionMenu
{A470F8CF-A1E8-4f65-8335-227475AA5C46} = %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Offline Files
{750fdf0e-2a26-11d1-a3ea-080036587f03} = %SystemRoot%\System32\cscui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Sharing
{f81e9010-6ea4-11ce-a7ff-00aa003ca9f6} = ntshrui.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\WinRAR
{B41DB860-8EE4-11D2-9906-E49FADC173CA} = C:\Program Files\WinRAR\rarext.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers]
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{0D2E74C4-3C34-11d2-A27E-00C04FC30871}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F01-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{24F14F02-7B1C-11d1-838f-0000F80461CF}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{66742402-F9B9-11D1-A202-0000F81FEDEE}
= %SystemRoot%\system32\SHELL32.dll
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\{F9DB5320-233E-11D1-9F84-707F02C10627}
= C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll

[HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}
= C:\PROGRA~1\SPYBOT~1\SDHelper.dll
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}
Google Toolbar Helper = c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{4D5C8C25-D075-11d0-B416-00C04FB90376}
&Tip of the Day = %SystemRoot%\System32\shdocvw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{32683183-48a0-441b-a342-7c2a440a9478}
=
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E61-B078-11D0-89E4-00C04FC9E26E}
Favorites Band = %SystemRoot%\System32\shdocvw.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{EFA24E62-B078-11D0-89E4-00C04FC9E26E}
History Band = %SystemRoot%\System32\shdocvw.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar]
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser
{01E04581-4EEE-11D0-BFE9-00AA005B4383} = &Address : %SystemRoot%\System32\browseui.dll
{0E5CBF21-D15F-11D0-8301-00AA005B4383} = &Links : %SystemRoot%\system32\SHELL32.dll
{2318C2B1-4965-11D4-9B18-009027A5CD4F} = &Google : c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
gcasServ "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
AVG7_EMC C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
AVG7_CC C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
tcactive C:\Program Files\The Cleaner\tca.exe
tcmonitor C:\Program Files\The Cleaner\tcm.exe
x3watch C:\Program Files\X3watch\x3watch.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
IMAIL Installed = 1
MAPI Installed = 1
MSFS Installed = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\load]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE
item Adobe Reader Speed Launch
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE
item Adobe Reader Speed Launch

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\KODAKE~1\bin\EASYSH~1.EXE -h
item Kodak EasyShare software
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\KODAKE~1\bin\EASYSH~1.EXE -h
item Kodak EasyShare software

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l
item Microsoft Office
path C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
location Common Startup
command C:\PROGRA~1\MICROS~2\Office10\OSA.EXE -b -l
item Microsoft Office

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\278P36X
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item lodwsock
hkey HKLM
command lodwsock.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item lodwsock
hkey HKLM
command lodwsock.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AdaptecDirectCD
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item DirectCD
hkey HKLM
command "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item DirectCD
hkey HKLM
command "C:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CreateCD50
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item CREATE~1
hkey HKLM
command C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item CREATE~1
hkey HKLM
command C:\PROGRA~1\COMMON~1\ADAPTE~1\CreateCD\CREATE~1.EXE -r
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gp0m4oe7
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item gp0m4oe7
hkey HKLM
command C:\WINDOWS\system32\gp0m4oe7.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item gp0m4oe7
hkey HKLM
command C:\WINDOWS\system32\gp0m4oe7.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iTunesHelper
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item iTunesHelper
hkey HKLM
command "C:\Program Files\iTunes\iTunesHelper.exe"
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item iTunesHelper
hkey HKLM
command "C:\Program Files\iTunes\iTunesHelper.exe"
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\JwrFRWbpj
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item imaogmsg
hkey HKCU
command imaogmsg.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item imaogmsg
hkey HKCU
command imaogmsg.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\msxct
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item msxct
hkey HKLM
command msxct.exe
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item msxct
hkey HKLM
command msxct.exe
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item qttask
hkey HKLM
command "C:\Program Files\QuickTime\qttask.exe" -atboottime
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item qttask
hkey HKLM
command "C:\Program Files\QuickTime\qttask.exe" -atboottime
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TypingSatellite
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item KBOOST
hkey HKCU
command "C:\Program Files\TypingMaster\KBOOST.EXE"
inimapping 0
key SOFTWARE\Microsoft\Windows\CurrentVersion\Run
item KBOOST
hkey HKCU
command "C:\Program Files\TypingMaster\KBOOST.EXE"
inimapping 0

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\state
system.ini 0
win.ini 0
bootini 0
services 0
startup 2


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} = C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} =
{0DF44EAA-FF21-4412-828E-260A8728E7F1} =


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Ratings
Key v&qˆ·ðHŒÞéë5²Â

[Kimberly]

It might seem complicated or bad, but it isn't.

Copy/paste the following text into a new Notepad document. Make sure that you have one blank line at the end of the document as shown in the quoted text.

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"SV1"=""

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\278P36X]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\gp0m4oe7]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\JwrFRWbpj]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\msxct]

Save it to your desktop as Fixme.reg. Save it as :
File Type: All Files (not as a text document or it wont work).
Name: Fixme.reg

Locate Fixme.reg on your desktop and double-click it. When asked if you want to merge with the registry, click YES. Wait for the merged successfully prompt.
______________________________

Using Windows Explorer, Search and Delete these Files if listed:

C:\WINDOWS\SYSTEM32\gdn9hnrr.ini
C:\WINDOWS\SYSTEM32\i6kq5tul.ini
C:\WINDOWS\system32\gp0m4oe7.exe
C:\WINDOWS\p0Yrl <------ Can be a folder or a file

Use the Start > Search function to find the following Files and Delete them if listed. Make sure that Local Disk (C) is listed in the dropdrown box - if not, click the arrow and select it.
Click All files and folders, and then click More advanced options.

• Click to select the Search system folders and Search hidden files and folders check boxes.
• Make sure that the Subfolders are checked too.

Type the name of the file in the search box and click the Search button

lodwsock.exe
imaogmsg.exe
msxct.exe

If you get an error when deleting a file, right click on the file and check to see if the read only attribute is checked. If it is uncheck it and try again.
______________________________

Please let me know how the computer behaves.

Kim

[Cannon]

Sorry for the delayed response.

We did everything you mentioned and deleted the files that we found.

Thanks for all of your help! The computer is back to behaving well!


Thanks again!!!!

[Kimberly]

No worries, at least the PC is behaving well again and that is very good news.

Please reset System Restore to remove eventual backups of the spyware and trojans.

Turn off System Restore

1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Reboot your computer.

Turn System Restore back on

1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.

A new restore point will be created automatically.
______________________________

Hide your system files again.

1. Click Start.
2. Click My Computer.
3. Select the Tools menu and click Folder Options.
4. Select the View Tab.
5. Under the Hidden files and folders heading uncheck Show hidden files and folders.
6. Check the Hide protected operating system files (recommended) option.
7. Click Yes to confirm.
8. Click OK.

______________________________


Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Windows, Internet Explorer and Microsoft Office Updates

Visit Microsoft's Windows Update Site frequently. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

If you are running Microsoft Office, or any application of it, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed.

Make your Internet Explorer more secure

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click on the Security tab
3. Click the Internet icon so it becomes highlighted.
4. Click on Default Level and click Ok
5. Click on the Custom Level button.
   
   • Change the Download signed ActiveX controls to Prompt
   • Change the Download unsigned ActiveX controls to Disable
   • Change the Initialise and script ActiveX controls not marked as safe to Disable
   • Change the Installation of desktop items to Prompt
   • Change the Launching programs and files in an IFRAME to Prompt
   • Change the Navigate sub-frames across different domains to Prompt
   • When all these settings have been made, click on the OK button.
   • If it prompts you as to whether or not you want to save the settings, press the Yes button.
6. Next press the Apply button and then the OK to exit the Internet Properties page.

Additional information is available in the following KB article:
Resources for using Internet Explorer 6

Download and install the following free programs

• SpywareBlaster
  SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  You can download SpywareBlaster here
  A tutorial can be found here
• SpywareGuard
  It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method. An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware. And you can easily have an anti-virus program running alongside SpywareGuard. It also features Download Protection and Browser Hijacking Protection.
  You can download SpywareGuard here
  A tutorial can be found here
• IE-SPYAD
  IE-SPYAD puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. It basically prevents any downloads, cookies, scripts from the sites listed, although you will still be able to connect to the sites.
  You can download IE-SPYAD here
  A tutorial can be found here
• Hosts File
  A Hosts file replaces your current HOSTS file with one containing well known ad, spyware sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
  A tutorial tutorial can be found here
  
  • MVPS Hosts File
    You can download the MVPS Hosts File here
    Furthermore the website contains useful tips and links to other resources and utilities.
  • Bluetack's Hosts File and Hosts Manager
    Essentially based on the research made by Webhelper, Andrew Clover and Eric L. Howes, it contains most if not all the known spyware sites, sites responsible for hijacks, rogue apllications etc...
    Download Bluetack's Hosts file here
    Download Bluetack's Hosts Manager here

Install Spyware Detection and Removal Programs

• Ad-Aware
  It scans for known spyware on your computer. These scans should be run at least once every two weeks.
  You can download Ad-Aware here
  A tutorial can be found here
• Spybot - Search & Destroy
  It scans for spyware and other malicious programs. Spybot has preventitive tools that stop programs from even installing on your computer.
  You can download Spybot - S&D here
  A tutorial can be found here

Before adding any other Spyware Detection and Removal programs always check the Rogue Anti-Spyware List for programs known to be misleading, mistaken, or just outright "Foistware".
You will find the list here

Use an AntiVirus Software

It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See the link below for a listing of some online & their stand-alone antivirus programs.
Computer Safety On line - Anti-Virus
http://www.malwareremoval.com/forum/viewtopic.php?p=53#53

Update your Anti Virus Software

It is imperative that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall

I can not stress enough how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below.
Computer Safety On line - Software Firewalls
http://www.malwareremoval.com/forum/viewtopic.php?p=56#56
A tutorial on Understanding and Using Firewalls can be found here

For more information about Spyware, the tools available, and other informative material, including information on how you may have been infected in the first place, please check out this link.

Happy surf Cannon

Kim

[NonSuch]

Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.