[Resolved] HJT log please check

Too many OT tools I think

The log I was looking for was OTMoveIt3…which will be located in the OTMOVEIT3 folder on your C: drive…the log you have given is OTListIt2

,,,navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

see if you can find it…if not just advise if it seemed to go OK….

also advise of any issues you may still be having with the machine.

Thanks

CB

Is this the log?

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File move failed. C:\Program Files\Norton PC Checkup\downloader.vbs scheduled to be moved on reboot.
File move failed. C:\Program Files\Norton PC Checkup\executables\productScanner\downloader.vbs scheduled to be moved on reboot.
C:\Users\Becci\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report072eb8f3\Report.cab moved successfully.
File move failed. C:\Users\Becci\Incomplete\T-3545425-butterfly take that.mp3 scheduled to be moved on reboot.
C:\Users\Becci\Incomplete\T-3877629-Diana Vickers - Hallelujah.mp3 moved successfully.
C:\Users\Becci\Incomplete\T-39456-Westlife - Mack The Knife.mp3 moved successfully.
E:\sol.exe moved successfully.
========== COMMANDS ==========
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
FireFox cache emptied.
Opera cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.9.0 log created on 03222009_221736

*******************************************

The only issue thats still around is that when trying to log into some sites (Whatthetech is one of them!) via IE sometimes they refuse to load whereas others will do so.

When this happens my daughter uses IE without Add ons. Is there a list of known add ons that cause the problems?

Hi Bluesnapper

IE just may need to Reset the Web settings

1. Open Internet Explorer.
2. On the Tools menu, click Internet Options.
3. Click the Programs tab, and then click the Reset Web Settings button.
4. Under Internet programs, verify that the correct e-mail program is selected.
5. Click to select the Internet Explorer should check to see whether it is the default browser check box. (unless she doesn't choose this option)
6. Click Apply, and then click OK.

Note : If you receive a message when Internet Explorer starts telling you that IE is not currently your default browser, make the selection Yes/No depending on your preference.


NEXT

Please download ATF Cleaner by Atribune.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.
  
  • If you use Firefox browser
  • Click Firefox at the top and choose: Select All
• Click the Empty Selected button.

NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
It's normal after running ATF cleaner that the PC will be slower to boot the first time.

See if that works, if not it may be due to the security settings in IE. Or remove her add-ons one by one until she finds the offender, then remove it.

I have made some recommendations below for IE settings:

If you have no issues completing those procedures then I'm happy to say thet your logs look clean


Now we have some clean up to do.

Please do the following:

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points
We need to set a new system restore point:

Click Start > Run > copy and paste the following into the run box:

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next.
Name it (something you'll remember) and click Create,
when the confirmation screen shows the restore point has been created click Close.

Now remove all previous Restore Points:

Click Start > Run > copy and paste the following into the run box:

cleanmgr

At the top, click on More Options tab. Click the Clean up button in the System Restore box.
Click on the Yes button.
When finished, click on Cancel button to exit.


Next

Download ToolsCleaner2 to your desktop and run it ( by de A.Rothstein & Dj Quiou )

• Click the Pt. Restauration button and press OK to the prompts.
• Click the Corbeille button and press OK to the prompt.
• Click the Fichiers temp button and press OK to the prompt.
• Click the Recherche button and let it run ( it may look like it freezes but let it continue )
• Once it is done click the Suppression button and let it remove anything it finds.
• Close the program

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

• Keep Windows updated by regularly checking their website at :
  http://windowsupdate.microsoft.com/
  This will ensure your computer has always the latest security updates available installed on your computer.
• SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.
• SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.
• Make Internet Explorer more secure
  
  • Click Start > Run
  • Type Inetcpl.cpl & click OK
  • Click on the Security tab
  • Click Reset all zones to default level
  • Make sure the Internet Zone is selected & Click Custom level
  • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
  • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
• ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more.  Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.
• MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
• For Firefox, I highly recommend these add-ons to keep your PC even more secure.
  
  • NoScript - for blocking ads and other potential website attacks
  • McAfee SiteAdvisor - this tells you whether the sites you are about to visit are safe or not. A must if you do a lot of Googling
• Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories.  This article is full of good information on alternatives for home backup solutions.
• ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
• Recovery Console - Recent trends appear to indicate that future infections will include attacks to the boot sector of the computer. The installation of the Recovery Console in the computer will be our only defense against this threat. For more information and steps to install the Recovery Console see This Article. Should you need assistance in installing the Recovery Console, please do not hesitate to ask.
• Please read the guide by Rorschach112on how to prevent malware and about safe computing here

Thank you for your patience, and performing all of the procedures requested.

I have not completed as yet the instructions in your last posting because the Laptop running Vista did not recognise the system restore point command as its typed. Is it correct or is there another way of doing it? Also do your recommendations conflict with the Laptop already running Norton Protection Centre, Norton Internet Security and Norton System Works?

Oh sorry…forgot it's Vista….it doesn't like that run command Here's the LONG version for setting a new system restore point in vista Close and save any documents that you may have open. Open up the Start Menu and right-click on "Computer", and then select "Properties" This will take you into the System area of Control Panel. Click on the "Advanced system settings" on the left hand side. Now select the "System Protection" tab to get to the System Restore section. Click the "Create" button to create a new restore point. You'll be prompted for a name, and you might want to give it a useful name that you'll be able to easily identify later. Click the Create button, and then the system will create the restore point. When it's all finished, you'll get a message saying it's completed successfully. You will now have a new restore point As for Conflicts with Norton - I don't believe there will be any conflicts with Norton - but I don't use Norton - not a big fan of it - try the programs and see how it goes. I haven't heard of any problems with adding the recommended programs good Luck CB

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.