What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Search Hijacker.H C:/windows/system32/geyekrnagyrahh.d

33 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
hi,

Please try running this online scan

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.

    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #17
Okay. Here's the Kaspersky file. ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0 REPORT Monday, August 3, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Monday, August 03, 2009 22:58:42 Records in database: 2577595 ——————————————————————————– Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Files scanned: 40067 Threat name: 2 Infected objects: 51 Suspicious objects: 0 Duration of the scan: 01:00:32 File name / Threat name / Threats count globalroot\systemroot\system32\geyekrnagyrahh.dll/globalroot\systemroot\system32\geyekrnagyrahh.dll Infected: Trojan.Win32.Agent.crez 50 C:\Program Files\Windows Antivirus Pro\Windows Antivirus Pro.exe Infected: not-a-virus:FraudTool.Win32.AntiVirusPro.ng 1 The selected area was scanned. ___________________________________________________________________ Here's the RootRepeal File. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/08/03 19:57 Program Version: Version 1.3.3.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xAAAFE000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xF7B29000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xA94EB000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ——————- Path: Volume C:\ Status: MBR Rootkit Detected! Path: Volume C:\, Sector 1 Status: Sector mismatch Path: Volume C:\, Sector 2 Status: Sector mismatch Path: Volume C:\, Sector 3 Status: Sector mismatch Path: Volume C:\, Sector 4 Status: Sector mismatch Path: Volume C:\, Sector 5 Status: Sector mismatch Path: Volume C:\, Sector 6 Status: Sector mismatch Path: Volume C:\, Sector 7 Status: Sector mismatch Path: Volume C:\, Sector 8 Status: Sector mismatch Path: Volume C:\, Sector 9 Status: Sector mismatch Path: Volume C:\, Sector 10 Status: Sector mismatch Path: Volume C:\, Sector 11 Status: Sector mismatch Path: Volume C:\, Sector 12 Status: Sector mismatch Path: Volume C:\, Sector 13 Status: Sector mismatch Path: Volume C:\, Sector 14 Status: Sector mismatch Path: Volume C:\, Sector 15 Status: Sector mismatch Path: Volume C:\, Sector 16 Status: Sector mismatch Path: Volume C:\, Sector 17 Status: Sector mismatch Path: Volume C:\, Sector 18 Status: Sector mismatch Path: Volume C:\, Sector 19 Status: Sector mismatch Path: Volume C:\, Sector 20 Status: Sector mismatch Path: Volume C:\, Sector 21 Status: Sector mismatch Path: Volume C:\, Sector 22 Status: Sector mismatch Path: Volume C:\, Sector 24 Status: Sector mismatch Path: Volume C:\, Sector 25 Status: Sector mismatch Path: Volume C:\, Sector 26 Status: Sector mismatch Path: Volume C:\, Sector 27 Status: Sector mismatch Path: Volume C:\, Sector 28 Status: Sector mismatch Path: Volume C:\, Sector 29 Status: Sector mismatch Path: Volume C:\, Sector 30 Status: Sector mismatch Path: Volume C:\, Sector 32 Status: Sector mismatch Path: Volume C:\, Sector 33 Status: Sector mismatch Path: Volume C:\, Sector 34 Status: Sector mismatch Path: Volume C:\, Sector 35 Status: Sector mismatch Path: Volume C:\, Sector 36 Status: Sector mismatch Path: Volume C:\, Sector 37 Status: Sector mismatch Path: Volume C:\, Sector 38 Status: Sector mismatch Path: Volume C:\, Sector 39 Status: Sector mismatch Path: Volume C:\, Sector 40 Status: Sector mismatch Path: Volume C:\, Sector 42 Status: Sector mismatch Path: Volume C:\, Sector 43 Status: Sector mismatch Path: Volume C:\, Sector 44 Status: Sector mismatch Path: Volume C:\, Sector 45 Status: Sector mismatch Path: Volume C:\, Sector 46 Status: Sector mismatch Path: Volume C:\, Sector 47 Status: Sector mismatch Path: Volume C:\, Sector 48 Status: Sector mismatch Path: Volume C:\, Sector 50 Status: Sector mismatch Path: Volume C:\, Sector 51 Status: Sector mismatch Path: Volume C:\, Sector 52 Status: Sector mismatch Path: Volume C:\, Sector 53 Status: Sector mismatch Path: Volume C:\, Sector 54 Status: Sector mismatch Path: Volume C:\, Sector 55 Status: Sector mismatch Path: Volume C:\, Sector 56 Status: Sector mismatch Path: Volume C:\, Sector 59 Status: Sector mismatch Path: Volume C:\, Sector 62 Status: Sector mismatch Path: C:\WINDOWS\system32\geyekrcseuavos.dat Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\geyekrnagyrahh.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\geyekrwnqyqmmx.dll Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\geyekrwrrnylch.dat Status: Invisible to the Windows API! Path: C:\WINDOWS\Temp\geyekrqwibabmgvv.tmp Status: Invisible to the Windows API! Path: C:\WINDOWS\system32\drivers\geyekrfukfraat.sys Status: Invisible to the Windows API! Path: C:\Documents and Settings\All Users\Application Data\SecTaskMan\geyekrnagyrahh.dll.q_Quarantine_1BB50_q.ini Status: Invisible to the Windows API! Path: C:\Documents and Settings\CE User\Local Settings\Temp\geyekr000 Status: Invisible to the Windows API! Path: C:\Documents and Settings\CE User\Local Settings\Temp\geyekrrysvlxxo000 Status: Invisible to the Windows API! Stealth Objects ——————- Object: Hidden Module [Name: geyekrwnqyqmmx.dll] Process: svchost.exe (PID: 912) Address: 0x008e0000 Size: 53248 Object: Hidden Module [Name: geyekrnagyrahh.dll] Process: svchost.exe (PID: 912) Address: 0x10000000 Size: 28672 Hidden Services ——————- Service Name: geyekrrysvlxxo Image Path: C:\WINDOWS\system32\drivers\geyekrfukfraat.sys ==EOF==
Post #18

Scan statistics:
Files scanned: 40067
Threat name: 2
Infected objects: 51
Suspicious objects: 0
Duration of the scan: 01:00:32


shows 51 files infected…did you copy the log that included what those items were? If so please post it next post:


NEXT

Please do the following:

1. Please download The Avenger2 by Swandog46 to your Desktop.
  • Right click on the Avenger.zip folder and select "Extract All…"
  • Follow the prompts and extract the avenger folder to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Begin copying here:

Drivers to delete:
geyekrrysvlxxo

Files to delete:
C:\WINDOWS\system32\geyekrcseuavos.dat
C:\WINDOWS\system32\geyekrnagyrahh.dll
C:\WINDOWS\system32\geyekrwnqyqmmx.dll
C:\WINDOWS\system32\geyekrwrrnylch.dat
C:\WINDOWS\Temp\geyekrqwibabmgvv.tmp
C:\WINDOWS\system32\drivers\geyekrfukfraat.sys
C:\Documents and Settings\CE User\Local Settings\Temp\geyekr000
C:\Documents and Settings\CE User\Local Settings\Temp\geyekrrysvlxxo000

Note: the above code was created specifically for this user.  If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, open the Avenger folder and start The Avenger program by clicking on its icon.
  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions.  This log file will be located at  C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply
Post #19
Here's the Avenger txt.

Logfile of The Avenger Version 2.0, © by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "geyekrrysvlxxo" deleted successfully.

Error: could not delete file "C:\WINDOWS\system32\geyekrcseuavos.dat"
Deletion of file "C:\WINDOWS\system32\geyekrcseuavos.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\WINDOWS\system32\geyekrnagyrahh.dll"
Deletion of file "C:\WINDOWS\system32\geyekrnagyrahh.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\WINDOWS\system32\geyekrwnqyqmmx.dll"
Deletion of file "C:\WINDOWS\system32\geyekrwnqyqmmx.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\WINDOWS\system32\geyekrwrrnylch.dat"
Deletion of file "C:\WINDOWS\system32\geyekrwrrnylch.dat" failed!
Status: 0xc0000156


Error: file "C:\WINDOWS\Temp\geyekrqwibabmgvv.tmp" not found!
Deletion of file "C:\WINDOWS\Temp\geyekrqwibabmgvv.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
–> the object does not exist


Error: could not delete file "C:\WINDOWS\system32\drivers\geyekrfukfraat.sys"
Deletion of file "C:\WINDOWS\system32\drivers\geyekrfukfraat.sys" failed!
Status: 0xc0000156


Error: could not delete file "C:\Documents and Settings\CE User\Local Settings\Temp\geyekr000"
Deletion of file "C:\Documents and Settings\CE User\Local Settings\Temp\geyekr000" failed!
Status: 0xc0000156


Error: could not delete file "C:\Documents and Settings\CE User\Local Settings\Temp\geyekrrysvlxxo000"
Deletion of file "C:\Documents and Settings\CE User\Local Settings\Temp\geyekrrysvlxxo000" failed!
Status: 0xc0000156


Completed script processing.

*******************

Finished! Terminate.
Post #20 last edited
Please delete the copy of combofix that you have on your desktop and download a fresh copy, then please do the following:

Please make absolutely certain your security programs are disabled.


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

KillAll::

RootKit::
C:\WINDOWS\system32\geyekrcseuavos.dat
C:\WINDOWS\system32\geyekrnagyrahh.dll
C:\WINDOWS\system32\geyekrwnqyqmmx.dll
C:\WINDOWS\system32\geyekrwrrnylch.dat
C:\WINDOWS\Temp\geyekrqwibabmgvv.tmp
C:\WINDOWS\system32\drivers\geyekrfukfraat.sys
C:\Documents and Settings\CE User\Local Settings\Temp\geyekr000
C:\Documents and Settings\CE User\Local Settings\Temp\geyekrrysvlxxo000

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #21 last edited
Happy to report. My computer is running much smoother. Seems to be clean.

The ComboFix.log is attached.

ComboFix 09-08-03.04 - CE User 08/04/2009 2:15.4.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.675 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\CE User\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\geyekrfukfraat.sys
c:\windows\system32\geyekrcseuavos.dat
c:\windows\system32\geyekrnagyrahh.dll
c:\windows\system32\geyekrqwbuwmdi.dll
c:\windows\system32\geyekrwnqyqmmx.dll
c:\windows\system32\geyekrwrrnylch.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_geyekrrysvlxxo


((((((((((((((((((((((((( Files Created from 2009-07-04 to 2009-08-04 )))))))))))))))))))))))))))))))
.

2009-08-03 21:14 . 2009-08-04 06:07 4 —-a-w- c:\windows\system32\bincd32.dat
2009-08-03 21:10 . 2009-08-03 21:10 ——– d—–w- C:\_OTM
2009-08-02 17:06 . 2009-08-02 17:06 8704 —-a-w- c:\windows\system32\sporder.dll
2009-08-02 17:01 . 2009-08-02 17:01 827392 —-a-w- c:\windows\system32\dddesot.dll
2009-07-31 06:35 . 2008-11-27 22:47 ——– d—a-w- c:\windows\system32\images
2009-07-24 22:10 . 2009-07-24 22:10 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\WMTools Downloaded Files
2009-07-21 16:05 . 2009-07-26 16:08 ——– d–h–w- C:\$AVG8.VAULT$
2009-07-20 17:17 . 2009-07-20 17:17 ——– d—–w- c:\program files\iPod
2009-07-20 17:17 . 2009-07-20 17:17 ——– d—–w- c:\program files\iTunes
2009-07-17 19:32 . 2009-07-17 19:33 ——– d—–w- c:\program files\LimeWire
2009-07-17 05:45 . 2009-07-17 05:45 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Ahead
2009-07-17 01:03 . 2009-07-17 01:03 ——– d—–w- c:\program files\Trend Micro
2009-07-17 00:58 . 2009-07-17 01:10 ——– d—–w- c:\documents and settings\CE User\Application Data\Uniblue
2009-07-17 00:58 . 2009-07-17 01:10 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\DriverScanner
2009-07-17 00:18 . 2009-07-17 00:18 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\Help
2009-07-17 00:16 . 2009-07-21 16:05 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SecTaskMan
2009-07-17 00:15 . 2009-07-24 17:01 ——– d—–w- c:\program files\Security Task Manager
2009-07-16 23:53 . 2009-07-16 23:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-07-16 23:53 . 2009-07-16 23:53 108552 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2009-07-16 23:53 . 2009-07-17 18:02 335752 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-16 23:53 . 2009-07-16 23:53 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-16 23:53 . 2009-08-03 21:08 ——– d—–w- c:\windows\system32\drivers\Avg
2009-07-16 23:52 . 2009-07-16 23:52 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\avg8
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\documents and settings\CE User\Application Data\Malwarebytes
2009-07-16 08:16 . 2009-07-13 17:36 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-07-16 08:16 . 2009-07-16 08:16 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Malwarebytes
2009-07-16 08:16 . 2009-07-13 17:36 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-07-16 00:47 . 2009-07-16 03:07 ——– d—a-w- c:\docume~1\ALLUSE~1\APPLIC~1\TEMP
2009-07-16 00:39 . 2009-07-17 00:26 ——– d—–w- c:\program files\SUPERAntiSpyware
2009-07-15 21:50 . 2009-07-15 21:50 ——– d-sh–w- c:\windows\system32\config\systemprofile\PrivacIE
2009-07-15 21:07 . 2009-07-15 21:07 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-07-15 20:58 . 2009-07-15 20:58 ——– d-sh–w- c:\documents and settings\LocalService\IETldCache
2009-07-15 20:55 . 2009-07-17 01:12 ——– d—–w- c:\program files\Windows Live Safety Center
2009-07-15 20:39 . 2009-07-16 04:15 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\SITEguard
2009-07-15 20:38 . 2009-07-15 20:38 ——– d—–w- c:\program files\STOPzilla!
2009-07-15 20:38 . 2009-07-15 20:38 ——– d—–w- c:\program files\Common Files\iS3
2009-07-15 20:38 . 2009-08-04 00:35 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\STOPzilla!
2009-07-15 20:13 . 2009-07-15 20:14 ——– d—–w- C:\Temp
2009-07-15 20:12 . 2009-07-15 20:12 ——– d—–w- c:\documents and settings\CE User\Application Data\Syntrillium
2009-07-15 20:12 . 2001-10-19 18:40 438608 —-a-w- c:\windows\system32\wmv8dmod.dll
2009-07-15 20:12 . 2001-10-19 18:40 665424 —-a-w- c:\windows\system32\wmv8dmoe.dll
2009-07-15 20:12 . 2001-10-19 18:40 1683792 —-a-w- c:\windows\system32\wmvcore2.dll
2009-07-15 20:12 . 2001-10-19 18:39 572752 —-a-w- c:\windows\system32\wmvdmoe.dll
2009-07-15 19:58 . 2009-07-15 19:58 4 —-a-w- c:\documents and settings\CE User\Application Data\NP.sys
2009-07-15 03:34 . 2009-07-15 05:55 ——– d—–w- c:\documents and settings\CE User\Local Settings\Application Data\FullTiltPoker
2009-07-15 03:33 . 2009-07-22 20:28 ——– d—–w- c:\program files\Full Tilt Poker
2009-07-13 19:08 . 2009-07-13 19:08 17408 —-a-r- c:\windows\system32\SZIO5.dll
2009-07-13 19:07 . 2009-07-13 19:07 311296 —-a-r- c:\windows\system32\SZBase5.dll
2009-07-13 19:06 . 2009-07-13 19:06 540672 —-a-r- c:\windows\system32\SZComp5.dll
2009-07-13 17:12 . 2009-07-13 17:12 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-07-09 19:52 . 2009-07-09 19:52 126976 —-a-r- c:\windows\system32\IS3HTUI5.dll
2009-07-09 19:52 . 2009-07-09 19:52 393216 —-a-r- c:\windows\system32\IS3DBA5.dll
2009-07-09 19:51 . 2009-07-09 19:51 385024 —-a-r- c:\windows\system32\IS3UI5.dll
2009-07-09 19:51 . 2009-07-09 19:51 61440 —-a-r- c:\windows\system32\IS3Hks5.dll
2009-07-09 19:51 . 2009-07-09 19:51 23040 —-a-r- c:\windows\system32\IS3XDat5.dll
2009-07-09 19:50 . 2009-07-09 19:50 225280 —-a-r- c:\windows\system32\IS3Win325.dll
2009-07-09 19:50 . 2009-07-09 19:50 94208 —-a-r- c:\windows\system32\IS3Inet5.dll
2009-07-09 19:50 . 2009-07-09 19:50 90112 —-a-r- c:\windows\system32\IS3Svc5.dll
2009-07-09 19:47 . 2009-07-09 19:47 724992 —-a-r- c:\windows\system32\IS3Base5.dll
2009-07-07 08:57 . 2009-07-07 08:57 ——– d—–w- c:\documents and settings\CE User\Application Data\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-02 16:57 . 2009-07-01 04:07 1 —-a-w- c:\documents and settings\CE User\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2009-07-31 19:49 . 2009-07-31 19:49 596 —-a-w- c:\program files\waazce.txt
2009-07-24 20:00 . 2009-07-01 20:07 ——– d—–w- c:\documents and settings\CE User\Application Data\LimeWire
2009-07-20 17:17 . 2009-07-01 02:49 ——– d—–w- c:\program files\Common Files\Apple
2009-07-17 00:41 . 2009-07-17 00:41 156 —-a-w- c:\program files\zwsgk.txt
2009-07-15 03:33 . 2007-10-25 20:26 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-07-05 11:47 . 2009-07-03 01:35 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\NOS
2009-07-05 11:47 . 2009-07-03 01:35 ——– d—–w- c:\program files\NOS
2009-07-03 17:09 . 2004-08-04 05:56 915456 —-a-w- c:\windows\system32\wininet.dll
2009-07-03 01:37 . 2009-07-03 01:37 ——– d—–w- c:\program files\Common Files\Adobe
2009-07-03 01:36 . 2009-07-03 01:36 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-07-01 04:52 . 2009-07-01 04:52 0 —-a-w- c:\windows\nsreg.dat
2009-07-01 04:06 . 2009-07-01 04:06 ——– d—–w- c:\documents and settings\CE User\Application Data\OpenOffice.org
2009-07-01 03:07 . 2009-07-01 02:51 ——– d—–w- c:\documents and settings\CE User\Application Data\Apple Computer
2009-07-01 02:51 . 2009-07-01 02:51 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-07-01 02:51 . 2009-07-01 02:50 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple Computer
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\Bonjour
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\QuickTime
2009-07-01 02:50 . 2009-07-01 02:50 ——– d—–w- c:\program files\Apple Software Update
2009-07-01 02:49 . 2009-07-01 02:49 ——– d—–w- c:\docume~1\ALLUSE~1\APPLIC~1\Apple
2009-07-01 02:40 . 2009-07-01 02:40 18864 —-a-w- c:\documents and settings\CE User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-29 14:28 . 2009-06-29 14:28 ——– d—–w- c:\program files\AVG
2009-06-16 14:36 . 2004-08-04 05:56 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2003-03-31 12:00 81920 —-a-w- c:\windows\system32\fontsub.dll
2009-06-03 19:09 . 2004-08-04 05:56 1291264 —-a-w- c:\windows\system32\quartz.dll
2009-05-12 18:13 . 2009-05-12 18:13 61328 —-a-r- c:\windows\system32\drivers\SZKG.sys
2009-05-07 15:32 . 2004-08-04 05:56 345600 —-a-w- c:\windows\system32\localspl.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-08-01_18.54.32 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-08-04 06:22 . 2009-08-04 06:22 16384 c:\windows\Temp\Perflib_Perfdata_170.dat
+ 2007-10-25 01:04 . 2009-08-03 21:11 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-10-25 01:04 . 2009-08-01 18:40 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-10-25 01:04 . 2009-08-03 21:11 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2007-10-25 01:04 . 2009-08-01 18:40 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-06-29 14:23 . 2009-08-03 06:35 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-06-29 14:23 . 2009-08-01 18:40 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2007-06-19 101144]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2007-06-19 84760]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2007-06-19 125720]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-14 815104]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-01-20 159744]
"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2005-12-13 507904]
"PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-06-08 131072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-24 136600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-11-01 32768]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-07-16 1948440]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2005-11-16 88209]

c:\docume~1\ALLUSE~1\STARTM~1\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-6 561213]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-16 23:53 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]
2006-03-03 20:08 434176 —-a-w- c:\windows\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\C:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3689:TCP"= 3689:TCP:iTunes

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [7/16/2009 7:53 PM 335752]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [7/16/2009 7:53 PM 108552]
R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [11/29/2005 5:56 PM 36768]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/16/2009 7:53 PM 907032]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/16/2009 7:52 PM 298776]
R2 szkg5;szkg;c:\windows\system32\drivers\SZKG.sys [5/12/2009 2:13 PM 61328]
R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [10/25/2007 4:50 PM 88192]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [10/21/2005 12:19 PM 36352]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [10/24/2007 9:08 PM 169984]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
——- Supplementary Scan ——-
.
uLocal Page = \blank.htm
uStart Page = hxxp://denethor2.is.uindy.edu/cp/home/loginf
uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch
uInternet Settings,ProxyOverride = *.local
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-04 02:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,69,70,99,11,41,f3,16,4a,8b,7b,54,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,69,70,99,11,41,f3,16,4a,8b,7b,54,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\IfxWlxEN.dll

- - - - - - - > 'explorer.exe'(2844)
c:\windows\system32\WININET.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\scardsvr.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\IFXSPMGT.exe
c:\windows\system32\IFXTCS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\ProtectTools\Embedded Security Software\PSDsrvc.EXE
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\ProtectTools\Embedded Security Software\PSDrt.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\HPQ\Shared\HPQTOA~1.EXE
.
**************************************************************************
.
Completion time: 2009-08-04 2:25 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-04 06:25
ComboFix2.txt 2009-08-02 16:52
ComboFix3.txt 2009-08-01 18:59
ComboFix4.txt 2009-07-16 08:08

Pre-Run: 51,221,393,408 bytes free
Post-Run: 51,301,724,160 bytes free

245 — E O F — 2009-07-29 16:33

Attachments:

Post #22
Hi,

Still a couple of things we have to take care of

first - please upload these files for analysis that i requested from my previous post:

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\documents and settings\CE User\Application Data\NP.sys

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

Do you recognize the following files:

c:\program files\waazce.txt
c:\program files\zwsgk.txt

If you don't recognize then, please upload them to VirScan also.


NEXT

Please download mbr.exe from >>HERE<<and save it to your desktop,
  • click the downloaded file to run the scan (a window will open briefly, then close).
  • The scan will create an mbr.log on your desktop
  • please copy/paste those contents in your next reply.


NEXT:

The report from the online Kaspersky scan….do you have it saved? I would like to see the 51 items, they may have all been quarantined files, but I need to check. If you don't have the report, I will need you to do another scan.
Post #23
Here are the mbr and Kaspersky logs. The VirScan Log is attached.

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.6 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user & kernel MBR OK

___________________________________________________________________________

KASPERSKY ONLINE SCANNER 7.0 REPORT
Tuesday, August 4, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Tuesday, August 04, 2009 19:31:16
Records in database: 2580256
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\

Scan statistics:
Files scanned: 44197
Threat name: 1
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 01:22:55


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\geyekrnagyrahh.dll.vir Infected: Trojan.Win32.Agent.crez 1
C:\System Volume Information\_restore{02933101-065A-4CC3-9CDA-04D637136CB6}\RP31\A0012037.dll Infected: Trojan.Win32.Agent.crez 1

The selected area was scanned.

Attachments:

Post #26

I thought we'd never find a way to kill that one.


I am tenacious :lol:

We have a little more work to do, almost there.

Please do the following:

Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

cmd /c del /f/a/q "c:\windows\system32\dddesot.dll"



NEXT

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:


    c:\windows\system32\sporder.dll

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 14. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


NEXT

P2P - I see you have P2P software Limewire installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It likely contributed to your current situation. This page will give you further information.
Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.
Please see this topic for more information:
Perils of P2P File Sharing.
I would strongly recommend that you uninstall this now. You can do so via Control Panel >> Add or Remove Programs.
Post #27
Here's the VirScan Log.

VirSCAN.org Scanned Report :
Scanned time : 2009/07/18 04:05:27 (EDT)
Scanner results: All Scanners reported not find malware!
File Name : SpOrder.Dll
File Size : 8704 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : a082e5473b2a9a4d846ed7ddf637ac76
SHA1 : 1703f7969a6e76f8458eda3e8e40fd115c0bfdc3
Online report : http://virscan.org/report/bac4a02ca0991d75…ca85ddd2a7.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.3 20090718010457 2009-07-18 0.64 -
AhnLab V3 2009.07.18.00 2009.07.18 2009-07-18 1.88 -
AntiVir 8.2.0.222 7.1.4.252 2009-07-17 0.35 -
Antiy 2.0.18 20090716.2619098 2009-07-16 0.00 -
Arcavir 2009 200907171744 2009-07-17 0.00 -
Authentium 5.1.1 200907172230 2009-07-17 0.00 -
AVAST! 4.7.4 090717-0 2009-07-17 0.00 -
AVG 8.5.288 270.13.19/2244 2009-07-18 0.00 -
BitDefender 7.81008.3771748 7.26658 2009-07-18 0.00 -
CA (VET) 9.0.0.143 31.6.6623 2009-07-18 0.00 -
ClamAV 0.95.2 9587 2009-07-18 0.00 -
Comodo 3.10 1688 2009-07-18 0.00 -
CP Secure 1.1.0.715 2009.07.18 2009-07-18 0.00 -
Dr.Web 4.44.0.9170 2009.07.18 2009-07-18 0.00 -
F-Prot 4.4.4.56 20090717 2009-07-17 0.00 -
F-Secure 5.51.6100 2009.07.17.10 2009-07-17 0.00 -
Fortinet 2.81-3.120 10.618 2009-07-17 0.00 -
GData 19.6534/19.400 20090718 2009-07-18 0.00 -
ViRobot 20090716 2009.07.16 2009-07-16 0.00 -
Ikarus T3.1.01.64 2009.07.18.73055 2009-07-18 0.00 -
JiangMin 11.0.800 2009.07.18 2009-07-18 0.00 -
Kaspersky 5.5.10 2009.07.18 2009-07-18 0.00 -
KingSoft 2009.2.5.15 2009.7.17.21 2009-07-17 0.00 -
McAfee 5.3.00 5679 2009-07-17 0.00 -
Microsoft 1.4803 2009.07.17 2009-07-17 0.00 -
mks_vir 2.01 2009.07.15 2009-07-15 0.00 -
Norman 6.01.09 6.01.00 2009-07-16 0.00 -
Panda 9.05.01 2009.07.17 2009-07-17 0.00 -
Trend Micro 8.700-1004 6.288.06 2009-07-17 0.00 -
Quick Heal 10.00 2009.07.17 2009-07-17 0.00 -
Rising 20.0 21.38.51.00 2009-07-18 0.00 -
Sophos 2.88.0 4.43 2009-07-18 0.00 -
Sunbelt 5267 5267 2009-07-17 0.00 -
Symantec 1.3.0.24 20090717.006 2009-07-17 0.00 -
nProtect 20090718.01 4801869 2009-07-18 0.00 -
The Hacker 6.3.4.3 v00370 2009-07-17 0.00 -
VBA32 3.12.10.8 20090717.0839 2009-07-17 0.00 -
VirusBuster 4.5.11.10 10.109.1/1838041 2009-07-17 0.00 -
Post #28
Hi,

You are clean, just some housekeeping to do now.

You were seriously infected. As a precaution I would change all your passwords and if you used the computer for banking, notify your financial institutions of your situation so your accounts can be watched.

Please do the following:

Follow these steps to uninstall Combofix

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]


NEXT

Now to remove the rest of the tools that we have used in fixing your machine:
  • Make sure you have an Internet Connection.
  • Download OTC to your desktop and run it
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.


NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.


  • It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
    Strong passwords: How to create and use them

    Then consider a password keeper, to keep all your passwords safe.
  • Keep Windows updated by regularly checking their website at :
    http://windowsupdate.microsoft.com/
    This will ensure your computer has always the latest security updates available installed on your computer.

  • SpywareBlaster protects against bad ActiveX, it immunizes your PC against them.

  • SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program ( eg : TeaTimer, Windows Defender ) or there will be a conflict.

  • Make Internet Explorer more secure
    • Click Start > Run
    • Type Inetcpl.cpl & click OK
    • Click on the Security tab
    • Click Reset all zones to default level
    • Make sure the Internet Zone is selected & Click Custom level
    • In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
    • Next Click OK, then Apply button and then OK to exit the Internet Properties page.
  • ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

    WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
    • Green to go
    • Yellow for caution
    • Red to stop
    WOT has an addon available for both Firefox and IE

  • Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
    secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
    blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
    Here


    If you choose to use Firefox, I highly recommend this add-on to keep your PC even more secure.
    • NoScript - for blocking ads and other potential website attacks
  • Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
  • ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
  • In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:
    Think Prevention.
    PC Safety and Security–What Do I Need?.


**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.


Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.
Post #29
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI