Log Review Please

Home Forums Contact

HijackThis Members

What the Tech? It's as easy as 1,2,3! ( Log In | Register )

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

Closed Topic

Start new topic

Log Review Please

mpm32 View Member Profile	Jan 14 2007, 07:44 PM Post #1
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	I am getting an unauthorized shutdown, it shuts down and restarts at random times. I have run AdAware, Spybot S&D, Windows Defender several times and the issue persists. I have run Hijack this and am pasting my logfile. In advance, thanks for your help. CODE Logfile of HijackThis v1.99.1 Scan saved at 8:35:01 PM, on 1/14/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\WINDOWS\System32\Drivers\WTSRV.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\Program Files\WinTV\Ir.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\PdeSrv2.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Mark\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.passport.net/uilogin.srf?lc=1033&id=6528 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = about:blank R3 - URLSearchHook: (no name) - - (no file) O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" O4 - HKLM\..\Run: [PDUiP6600DMon] C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe O4 - HKLM\..\Run: [SSRunScript] "C:\Program Files\Support.com\Charter\bin\SSRunScript.exe" /script "C:\Program Files\Support.com\Charter\vbs\verifyconnection.vbs" /args //b startupdelay O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://notesdancl1.pb.com/iNotes6W.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137209401114 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.0/installer.exe O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://usextranet.aigfpc.com/dana-cached/setup/JuniperSetupSP1.cab O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe (file missing) O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE My startup list CODE StartupList report, 1/14/2007, 8:43:05 PM StartupList version: 1.52.2 Started from : C:\Documents and Settings\Mark\Desktop\HijackThis.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\WINDOWS\System32\Drivers\WTSRV.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\Program Files\WinTV\Ir.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\system32\PdeSrv2.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Mark\Desktop\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\MSN Messenger\msnmsgr.exe -------------------------------------------------- Listing of startup folders: Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe,

3 Pages

< 1 2 3 >

Start new topic

Replies (15 - 29)

mpm32 View Member Profile	Jan 17 2007, 08:15 PM Post #16
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	I think I was able to do the command prompt thing, I posted the attachment at the website you referenced. I did the ATF cleaner and ran another Kaspersky scan. Here are the results. ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Wednesday, January 17, 2007 9:09:32 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 18/01/2007 Kaspersky Anti-Virus database records: 244703 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: standard Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ Scan Statistics: Total number of scanned objects: 82809 Number of viruses found: 3 Number of infected objects: 5 / 0 Number of suspicious objects: 2 Duration of the scan process: 00:50:56 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\3ad391678a806ec4d691e83aaa393b6f_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\552c4f10c7bc7882704d1e7e1cbf28ee_24adf822-76f7-4481-b30b-ff1b40f8687f Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-01142007-201932.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip/drsmartload1.exe Suspicious: Password-protected-EXE skipped C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\SmitfraudC.zip ZIP: suspicious - 1 skipped C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Mark\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{D26841B3-CF68-4BA8-89D0-CBD9F05AAAAB} Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Musicmatch\Jukebox\mmjbaltlog.txt Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Musicmatch\Jukebox\mmjblog.txt Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Musicmatch\Jukebox\Portables.log Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Musicmatch\MIM\Database\Default.ldb Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Application Data\Musicmatch\MIM\Database\Default.mdb Object is locked skipped C:\Documents and Settings\Mark\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mark\Local Settings\History\History.IE5\MSHist012007011720070118\index.dat Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Temp\JET73BF.tmp Object is locked skipped C:\Documents and Settings\Mark\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Mark\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Mark\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Mark\UserData\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP389\A0040573.EXE Infected: Trojan-Downloader.Win32.Agent.bda skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP389\A0040574.exe Infected: Trojan-Downloader.Win32.Agent.bda skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP389\A0042630.exe Infected: Trojan-PSW.Win32.Small.bs skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP389\A0042631.exe Infected: Trojan-PSW.Win32.Small.bs skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\A0048723.exe Infected: Trojan-PSW.Win32.Small.bs skipped C:\System Volume Information\_restore{129201FA-B0AC-49B3-96B2-DEB8B91E727B}\RP392\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{16DD27B4-F622-4799-9EBC-7D38C62DCE9E}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Let's see what this tells you. Thanks.

Susan528 View Member Profile	Jan 17 2007, 08:48 PM Post #17
SuperMember Group: Authentic Member Posts: 3,194 Joined: 25-May 05 From: L.A. (lower Alabama) Member No.: 33,131 Operating System: Windows XP Pro	Thank you. Kapersky looks good. There are infected _restore files but those we will take care of at the end. The file upload did not work. Please run GMER again and post (reply) with the log.

mpm32 View Member Profile	Jan 18 2007, 05:11 PM Post #18
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	Here is the latest GMER scan GMER 1.0.12.12011 - http://www.gmer.net Rootkit scan 2007-01-18 18:09:20 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE A8BE9C8A Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE A8BE67C8 Device \FileSystem\Fastfat \Fat IRP_MJ_READ A8BE260A Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE A8BE2AED Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION A8BED958 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION A8BF0821 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA A8BF938A Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA A8BF8D49 Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS A8BF2BBE Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION A8BF3331 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION A8C014F4 Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL A8BE9B37 Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL A8BE5948 Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL A8BEF46B Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN A8C0079D Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL A8BFFC4A Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP A8BE62FD Device \FileSystem\Fastfat \Fat IRP_MJ_PNP A8C001DB Device \FileSystem\Fastfat \Fat FastIoCheckIfPossible A8BFB1F9 Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [AA230D30] tfsnifs.sys ---- Files - GMER 1.0.12 ---- ADS C:\WINDOWS\system32:huy32.sys ---- EOF - GMER 1.0.12 ----

Susan528 View Member Profile	Jan 18 2007, 08:35 PM Post #19
SuperMember Group: Authentic Member Posts: 3,194 Joined: 25-May 05 From: L.A. (lower Alabama) Member No.: 33,131 Operating System: Windows XP Pro	Open notepad and copy/paste the text in the code box below into it: Note: To open Notepad go to Start => Run => and type the word notepad press the Enter key and a window should appear CODE @echo off type C:\WINDOWS\system32:huy32.sys type C:\WINDOWS\system32:huy32.sys > c:\huy32.sys explorer C:\ pause Save this as fix.bat Choose to "Save type as – All Files" It should look like this: Double click on fix.bat & allow it to runSTEP 1. ====== ADSpy Run hijackthis Click the tab Open the Misc Tools Section Click the tab Open ADSpy Uncheck the Quick Scan (Windows base folder only) Click the “Scan button under Ready Allow the scan to finish and then click Save log tab. Please post the ADSpy log unless nothing is found.

mpm32 View Member Profile	Jan 18 2007, 08:52 PM Post #20
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	I made the bat file, ran it and got this; The file name, directory name, or volume label syntex is incorrect. The file name, directory name, or volume label syntex is incorrect. Press any key to continue... AdSpy log; C:\WINDOWS\system32 : huy32.sys (70570 bytes) C:\WINDOWS\system32 : huy32.sys (70570 bytes) Looks like my little friend won't go away. However, the pc is not randomly rebooting anymore, so that's something.

Susan528 View Member Profile	Jan 18 2007, 09:02 PM Post #21
SuperMember Group: Authentic Member Posts: 3,194 Joined: 25-May 05 From: L.A. (lower Alabama) Member No.: 33,131 Operating System: Windows XP Pro	Please be patient. I am consulting with others.

mpm32 View Member Profile	Jan 18 2007, 09:10 PM Post #22
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	I didn't mean to convey impatiance. I am far from it. I find this process interesting and was making light of the situation. I really appreciate all the help you are giving me.

LDTate View Member Profile	Jan 18 2007, 09:33 PM Post #23
Forum God Group: Root Admin Posts: 45,794 Joined: 23-September 04 From: Missouri, USA Member No.: 15,276	While you're waiting for Susan to post back,will you do this plaese? Double-click My Computer. Click the Tools menu, and then click Folder Options. Click the View tab. Clear "Hide file extensions for known file types." Under the "Hidden files" folder, select "Show hidden files and folders." Clear "Hide protected operating system files." Click Apply, and then click OK. Please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis: C:\WINDOWS\system32\712d88b994.sys Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see. BTW, can you see the file C:\WINDOWS\system32 : huy32.sys? If so, how is it listed? If Jotti is too busy you can try these. http://www.kaspersky.com/scanforvirus.html http://www.virustotal.com/en/indexf.html

mpm32 View Member Profile	Jan 18 2007, 10:18 PM Post #24
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	The scanner found nothing under each of virus scans for that file. I cannot see the huy32.sys file anywhere including the Windows folder, other than on some of the scans I had done previously. I did run ADSpy again and it is not listed anymore. Perhaps it is gone? I did find something labeled huy32.sys on my C: drive however, it lists 0KB.

Susan528 View Member Profile	Jan 19 2007, 05:15 AM Post #25
SuperMember Group: Authentic Member Posts: 3,194 Joined: 25-May 05 From: L.A. (lower Alabama) Member No.: 33,131 Operating System: Windows XP Pro	QUOTE I did run ADSpy again and it is not listed anymore. Perhaps it is gone? Please rum GMER again and post(reply) with the results.

mpm32 View Member Profile	Jan 19 2007, 05:27 PM Post #26
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	Here's the latest GMER scan; GMER 1.0.12.12011 - http://www.gmer.net Rootkit scan 2007-01-19 18:25:30 Windows 5.1.2600 Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwOpenProcess SSDT \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys ZwTerminateProcess Code 696A89A7 KeFindConfigurationEntry ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Fastfat \Fat IRP_MJ_CREATE A82E8C8A Device \FileSystem\Fastfat \Fat IRP_MJ_CLOSE A82E57C8 Device \FileSystem\Fastfat \Fat IRP_MJ_READ A82E160A Device \FileSystem\Fastfat \Fat IRP_MJ_WRITE A82E1AED Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_INFORMATION A82EC958 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_INFORMATION A82EF821 Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_EA A82F838A Device \FileSystem\Fastfat \Fat IRP_MJ_SET_EA A82F7D49 Device \FileSystem\Fastfat \Fat IRP_MJ_FLUSH_BUFFERS A82F1BBE Device \FileSystem\Fastfat \Fat IRP_MJ_QUERY_VOLUME_INFORMATION A82F2331 Device \FileSystem\Fastfat \Fat IRP_MJ_SET_VOLUME_INFORMATION A83004F4 Device \FileSystem\Fastfat \Fat IRP_MJ_DIRECTORY_CONTROL A82E8B37 Device \FileSystem\Fastfat \Fat IRP_MJ_FILE_SYSTEM_CONTROL A82E4948 Device \FileSystem\Fastfat \Fat IRP_MJ_DEVICE_CONTROL A82EE46B Device \FileSystem\Fastfat \Fat IRP_MJ_SHUTDOWN A82FF79D Device \FileSystem\Fastfat \Fat IRP_MJ_LOCK_CONTROL A82FEC4A Device \FileSystem\Fastfat \Fat IRP_MJ_CLEANUP A82E52FD Device \FileSystem\Fastfat \Fat IRP_MJ_PNP A82FF1DB Device \FileSystem\Fastfat \Fat FastIoCheckIfPossible A82FA1F9 Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [AA230D30] tfsnifs.sys ---- EOF - GMER 1.0.12 ----

Susan528 View Member Profile	Jan 19 2007, 09:45 PM Post #27
SuperMember Group: Authentic Member Posts: 3,194 Joined: 25-May 05 From: L.A. (lower Alabama) Member No.: 33,131 Operating System: Windows XP Pro	You got rid of the file. You had a new variant of a rustock infection and we were trying to obtain copy of the ADS file for additional analsyis. But I am glad that we were able to obtain some information to help us with others. Thank you for your persistence. Please post (reply) with a new hijackthis log for a final review.

mpm32 View Member Profile	Jan 20 2007, 07:41 AM Post #28
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	Here is the hijack this logfile; Thank you so much for your help! If I should have an issue in the future, should I post in this thread or start a new one? Logfile of HijackThis v1.99.1 Scan saved at 8:39:05 AM, on 1/20/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe C:\WINDOWS\system32\svchost.exe C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe C:\WINDOWS\System32\Drivers\WTSRV.EXE C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\ehome\ehtray.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\igfxpers.exe C:\WINDOWS\stsystra.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe C:\Program Files\WinTV\Ir.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\MMDiag.exe C:\Program Files\internet explorer\iexplore.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\PdeSrv2.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Documents and Settings\Mark\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.passport.net/uilogin.srf?lc=1033&id=6528 O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" O4 - HKLM\..\Run: [PDUiP6600DMon] C:\Program Files\Canon\Memory Card Utility\iP6600D\PDUiP6600DMon.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://notesdancl1.pb.com/iNotes6W.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1137209401114 O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://www.nick.com/common/groove/gx/GrooveAX27.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab34246.cab O16 - DPF: {C4925E65-7A1E-11D2-8BB4-00A0C9CC72C3} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...0/installer.exe O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/vir...l/installer.exe O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://usextranet.aigfpc.com/dana-cached/s...perSetupSP1.cab O16 - DPF: {EF0DBA6F-43CE-4B26-9808-2AB38FA0DB29} (MSN Money Ticker) - http://fdl.msn.com/public/investor/v13/ticker.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe (file missing) O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE Mark

Susan528 View Member Profile	Jan 20 2007, 06:58 PM Post #29
SuperMember Group: Authentic Member Posts: 3,194 Joined: 25-May 05 From: L.A. (lower Alabama) Member No.: 33,131 Operating System: Windows XP Pro	Good work mpm32! Hopefully you will not have any problems for awhile. If you should have a problem in the next week or two, you can request that this log be re-opened. Otherwise you can start a new post. It appears that your logs are clean. You do need to Reset and Re-enable your System Restore points to get rid of those infected _restore files left in the Kapersky log. You can delete the tools we used to clean up your system. CWSshredder, GMER, ComboFix STEP 1. ====== System Restore for Windows XP Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected) Turn off System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. Reboot. Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check *Turn off System Restore. Click Apply,* and then click OK. STEP 2. ====== DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!! http://forum.malwareremoval.com/viewtopic....39eba6ea0b5e8ee QUOTE Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail. "The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late." Now that you are clean, please follow these simple steps in order to keep your computer clean and secure: Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out. Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here: Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here: Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A tutorial on installing & using this product can be found here: Using SpywareBlaster to protect your computer from Spyware and Malware Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. More info on how to prevent malware you can also find here (By Tony Klein) Follow this list and your potential for being infected again will reduce dramatically. Thank you for allowing me to assist you. Susan

mpm32 View Member Profile	Jan 21 2007, 09:57 AM Post #30
Authentic Member Group: Authentic Member Posts: 30 Joined: 14-January 07 Member No.: 66,404 Operating System: XP	Susan, I can't thank you enough for all of your help. You and this site provide a truly valuble service and resource. Thanks again. Mark

« Next Oldest · Infections Removal · Next Newest »

3 Pages

< 1 2 3 >

Closed Topic

Start new topic

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Similar Topics

Similar Topics

Similar Topics

		Topic Title	Replies	Topic Starter	Views	Last Action
		Infections Removal [Resolved] HJT review, please help!	8	benjt	214	3rd September 2009 - 06:32 PM Last post by: LDTate
		Infections Removal [Closed] Review of HijackThis log dtd 081309	2	mchurch3	122	24th August 2009 - 10:27 AM Last post by: Tomk
		Infections Removal [Resolved] Please help review this HijackThis Log! A new vers 12	18	johntk	605	21st August 2009 - 04:44 AM Last post by: ken545
		Infections Removal [Closed] Please help review logs	2	Wil1111	211	28th July 2009 - 08:51 AM Last post by: Tomk

Display Mode: Switch to: Standard · Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

Time is now: 21st November 2009 - 06:29 AM

Advertisements do not imply our endorsement of that product or service. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk.
Member site: Alliance of Security Analysis Professionals | UNITE Against Malware
Memory Forums | Auto Repair Forum
© Geeks to Go, Inc. | All Rights Reserved | Privacy Policy

Powered By IP.Board © 2009 IPS, Inc.