148 replies to this topic

[wilma1313]

Seems good

[oldman960]

Hi wilma1313,

We'll clean up the tools except for OTL then see if we can resolve the sound icon issue.

See if you can locate the copy of combofix.exe on your desktop. We renamed it jgh.exe. If present please right click it and select delete.

Download a new copy from HERE and save it to your desktop. No need to rename it or run it.

Disable McAffee

• Please open McAfee Security Centre
• Under Common Tasks click on Home
• Click Computer Files
• Click Configure
• Make sure the following are disabled by ticking the "Off" button.
  

  Virus protection
  Spyware protection
  System Guards Protection
  Script Scanning Protection (you may have to scroll down to see it)

• Next, select never for "When to re-enable real time scanning"
• and click OK.

After you do the next step McAffee can be re-enabled by reversing the above steps. Note: McAfee should be re-enabled when the computer is rebooted if combofix reboots it.

Click start > run and copy and paste this line into the run box and click ok.

combofix /uninstall


From your desktop please delete if present

• any logs or notepads we created
• RogueKiller
• aswMBR.exe
• MBR.dat

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 7.1.0 first. Be sure to move any PDF documents to another folder first though.

Next

Try this

• right click the tray near the clock and select task manager
• click the process tab locate explorer.exe
• right click on explorer.exe and click end process
• ok any warning you may recieve (your desktop will disappear)
• In taskmanger click File click new task (run)
• type explorer
• click ok

Sound icon appear now?

Thanks

[wilma1313]

I'm confused about moving PDF files to another folder? Move them from where to where?

[oldman960]

Hi wilma1313, If you have saved any .pdf files to a folder in C:\Program Files\Adobe they will be removed when Adobe is uninstalled so they should be moved to their own folder.

[wilma1313]

I downloaded combofix from the link you provided and when I pasted in the command it says the file doesn't exist - yet I see it sitting there on the desk top.....

[oldman960]

Hi wilma1313,

Try this. Copy and paste this into the run box

"%userprofile%\desktop\combofix.exe" /uninstall


Make sure you don't miss the first " mark.

[wilma1313]

HI, Ok I have caught up and got it all done

[oldman960]

Hi wilma1313, Good. Combofix behaved itself and uninstalled? Have you tried stopping and restarting explorer yet?

[wilma1313]

Hi, I had stopped and started explorer with no results. this morn I got combofix uninstalled and ran a malwarebytes scan (which was good) When I shut the computer down there was no volume on teh task bar. When he started it up tonight, the volume returned AND the garmin is completely functioning with all files returned. No clue what made that happen, but it all happened after the uninstallation of combofix. Way cool .

[oldman960]

Hi wilma1313, Glad it sorted itself out. May have been some stray combofx drivers using up resources. Everything good?

[wilma1313]

yes good

[oldman960]

Hi wilma1313, Well I guess we are finished. Take care and keep safe.

[wilma1313]

When it got reinfected, it seemed to all happen right after I added spybot, spyware guard, and super anti- spyware and followed the other steps which were backing up the registry using ERUNT. I also followed the steps to make explorer more secure before having to restore back . Everything I had done was lost when I had to restore the computer back to prior to the symtoms of reinfection. What, if any of that do I need to repeat? Obviously if I want any of the anti spyware stuff I have to reinstall, but I'm not sure if something I did created the second set of problems? Please advise.

[oldman960]

Hi wilma1313,

The Adobe update is current as you just did it. A custom Hosts file seems to be in place. You may want to check in Add/Remove programs and see what if any version of Java is installed.

As to why it happened I can't really say. It just may have been coincidence that it happened while you where installing your programs.

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.

Check these settings and make sure they are correct.

-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis

- Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System

- Keep your antivirus program updated, as well as any other security programs you have.

-More tips and programs can be found HERE

[wilma1313]

Ok, I will get after all that again this weekend and hopefully this is the last time you hear from me. Thanks a ton