Need Help Please

I did the full scan. Hope that is just as good. Here are the 2 logs and thanks for your time: Malwarebytes' Anti-Malware 1.44 Database version: 3663 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1/31/2010 2:23:18 PM mbam-log-2010-01-31 (14-23-18).txt Scan type: Quick Scan Objects scanned: 114544 Time elapsed: 5 minute(s), 51 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 2 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.ShopperReports) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Extensions\CmdMapping\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.ShopperReports) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Malwarebytes' Anti-Malware 1.44 Database version: 3663 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 1/31/2010 5:56:27 PM mbam-log-2010-01-31 (17-56-27).txt Scan type: Full Scan (C:\|) Objects scanned: 139386 Time elapsed: 22 minute(s), 53 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 7 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016458.dll (Adware.Hotbar) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016467.dll (Adware.Hotbar) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016468.exe (Adware.Hotbar) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016469.exe (Adware.Hotbar) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016470.exe (Adware.Hotbar) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016471.exe (Adware.Hotbar) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{7CF7B143-8A5E-4DD7-A79A-B77934035832}\RP38\A0016473.dll (Adware.Hotbar) -> Quarantined and deleted successfully.

Hi NicoleB, That looks like two scans with Malwarebytes. Did you manage to carry out the Kaspersky one and if so did you get a report or did it tell you a result? Also, that last question of mine… how is your computer now

Hi again finally. I scanned everything with Kapersky and nothing was found in any of the scans. Computer seems to be running great.

Hello NicoleB,

I think your machine is clean.

We have a couple of last steps to perform and then you're all set.[image unavailable: Posted Image]

Follow these steps to uninstall Combofix and tools used in the removal of malware. This will also clean out and reset your Restore Points.

• Click START then RUN
• Now type Combofix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  🖼Click to load external image (Posted Image)

Step 2

• Double-click OTL.exe to run it. (Vista users, please right click on OTL.exe and select "Run as an Administrator")
• Click on the CleanUp! button
• Click Yes to begin the Cleanup process and remove these components, including this application.
• You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

MBAM can be uninstalled via control panel add/remove but it may be a useful tool to keep.

——————————————————————————————————————-

A reminder: Remember to turn back on any anti-malware programs you may have turned off during the cleaning process.

——————————————————————————————————————-

Now that your machine is clean here are some things that I think are worth having a look at if you don't already know about them:

———————————————————————————————————————

Regularly check that your Java is up to date. Older versions are vunerable to malicious attack.

• Download from here Java Runtime Environment (JDK) Update
• Scroll to where it says "Windows XP/Vista/2000/2003/2008 online" and download and follow the instructions to install.
  
  Reboot your computer.
  You also need to uininstall older versions of Java.
  
  
• Click Start > Control Panel > Add or Remove Programs
  
• Remove all Java updates except the latest one you have just installed.

——————————————————————————————————————–

Be sure and give the Temp folders a cleaning out now and then. This helps with security and your computer will run more efficiently. I clean mine once a week. For ease of use, you might consider the following free program:

• TFC

——————————————————————————————————————–

Make Internet Explorer more secure

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
• Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* Consider using an alternate browser.

Opera may be downloaded from here. It is one of the least targeted of all browers.

Avant may be downloaded from here. Another one that is less well known.

Firefox may be downloaded from Here. I use Firefox because I like it. Used to be one of the safest but now targeted probably as much as IE.

Addblock Plus is a good Add-on for Firefox. It helps stop popups.

———————————————————————————————————————–

Startuplite is a tool to help you stop some programs not needed when you start your computer from loading. They will begin automatically only when needed.

———————————————————————————————————————–

To help protect your computer in the future here are some suggestions you can look at:

It is recommended that you do set Windows to check, download and install your updates automatically.

* Click Start > Control Panel > Automatic Updates
* Set the day and time for the update check. Set this to a time when your computer will normally be on and connected to the internet.
* Click Apply then OK.
And to keep your system clean, consider choosing from these free malware scanners. Update and run

• AdAware SE Personal
  
• Spybot Search & Destroy
  
• SuperAntiSpyWare

weekly.

Be aware of what emails you open and websites you visit.

An antivirus program is essential.

• Here are a couple of good anti-virus programs to choose from (these are also free for personal use):
• Avast
• AVIRA Note: AVIRA free comes with adware that promotes their paid for version each time it updates.

I like Avira but some people find the pop up advertisements each time it updates a bit trying.

A firewall is essential to help prevent hackers from infiltrating your computer.

Here are two good firewalls free for personal use:

• OnLine-Armour
• PC Tools Firewall Plus

Note: Do not use more than one anti-virus or firewall. Running two or more real-time anti-virus, anti-spyware and firewall monitors at the same time can cause a conflict. That conflict can result in slow computer performance, error messages, crashes of the programs or other types of failure. You will very likely end up with little or no protection.

Go here for some good advice about how to prevent infection.

Have a safe and happy computing day!

Thanks so much for all of your time and help. When I type in Combofix /Uninstall it cannot locate anything. I know wee changed the name to Confuse. I have a shortcut to Combofix on my desktop. Also wondering what you would recommend for maintenance. I have enabled Windows Security Essentials and am downloading WOT now. I know to scan and update regularly. Are there any particular scans that are important?

Hi NicoleB,

When I type in Combofix /Uninstall it cannot locate anything. I know wee changed the name to Confuse. I have a shortcut to Combofix on my desktop.

May be to do with the name change but it shouldn't be.

If you have run the OTL CleanUP it will have removed it anyway. It won't however have reset a new restore point. This is important because it removes any leftover infection in System Restore. Combfix /Unistall does this automatically so when it doesn't run we have to do it manually.

This what to do to clean your restore points and set a new one:

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)1. Turn off System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
2. Restart your computer.

3. Turn ON System Restore.On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check Turn off System Restore.
Click Apply, and then click OK.
System Restore will now be active again.

Also wondering what you would recommend for maintenance.

Well there is what I have outlined in my last post.

This is what I do. On two of my machines I have Microsoft Security Essentials with the Windows Firewall. On my other one I run Avira with the Agnitum firewall.

Prior to that I used to run Avira with Comodo but after testing MSE with the Windows Firewall found it to be as light to run but less obtrusive. Incidentally I tried it for a while with the On Line Armour firewall which I quite like but ran into severe conflict issues. These can be overcome with some fiddling with MSE but I found it simpler to run it with Windows Firewall. Probably not quite the security of the other combination but very simple and unobtrusive. I also have Malwarebytes which in the free version is passive and doesn't conflict with real time activities of other programs.

On top of that I run TFC once a week to clear away the temporary files that build up. MSE is set to carry out a weekly scan. I also update and run Malwarebytes once a week. For me, it's also a good time to backup my data to a removable hard disk which I have. In addition I carry out a defrag. On my XP machine I use Auslogics Disk Defrag for this but you can use your computers built in utility.

Download Auslogics Disk Defrag and save it to your Desktop.

Double click and follow the prompts to install it. Note: only install the defrag utility. Some versions come with Askbar toolbars… do not install those.

Once installed, run the defrag utility.

At the end the utility may tell you that it has found Junk Files and recommend that you run a scan to remove. Disregard that suggestion, it is a promotion of a tool you don't need. All we are interested in here is the defrag. process.

Note: Do not download Windows Registry Cleaner which is promoted at the same site. Registry cleaners are not generally necessary and only cause problems when something important in the registry is removed during the process. You might not realise it for quite a while but when one day you come to run a program and find it doesn't work or doesn't work properly, you will be wondering why.

Hope that answers your question.

Well, guess that thing was still hiding in there. Got the blue screen of death when I downloaded WOT (Web of Trust). I should have done everything much faster and more carefully. Not listening to music online all night while running scans:) So.. my brother is going to erase for me. Any recomendations for staying protected? I plan on downloading WOT, using Microsoft Security Essentials and some other anti malware program of which I forgot the name.. besides using Firefox. Thanks again for all of your help! Live and learn

Got the blue screen of death when I downloaded WOT (Web of Trust).

I take it that was after you installed it?

If so why don't you uninstall it and see if you still have the same problem.

i guess it downloaded, but then I got the blue screen which will not go away.

See if you can boot into Safe Mode and uninstall it. Then restart your computer.

Boot into Safe Mode:

1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, tap F8 continually.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

I cannot even get into any kind of safe mode..

I take it that you can't boot up your machine at all then? Just goes straight to BSOD? If I am correct in that assumption we will have to look at using another way to access your computer. Before we go down that track though tell me exactly what happens when you start your machine.

i am thinking I should just let my brother erase the hard drive and then I will be starting fresh, right?

You didn't answer my questions but your reponse implies that you can't boot your machine. There are a number of options open to us. Here are two: If you have your Windows Installation CD we could use that to access your machine to see if we can restore it or replace a file which might be the culprit. There is a repair installation option with this one too. If you don't have your Windows CD we could download a program, burn a disk and use that to access your machine to run some tools and see what we can find that may be the cause of this. Up to you really but if you want to try and recoup the situation then tell me if you have your Windows CD.