Lets reset the settings. All your temporary internet files, probably including navigating history, will be deleted!
Open Internet Explorer
Go to Tools and choose for Internet Options
Go to the Advanced tab
Click on Reset… and allow if any warnings are given
Let the computer do its work if it has to
ok I reset IE, and it worked for a little bit, but then went to a website and click a link to go to another page in the website and IE launched another window, but this time it went right to Google.com
ok I reset IE, and it worked for a little bit, but then went to a website and click a link to go to another page in the website and IE launched another window, but this time it went right to Google.com
it;s good that it went to the next page. But it's bad that Google opened in another window. Also when I go to Google and search for something it pulls up millions of websites (normal like it should) then when I click on one, it opens up the another window with an advertisement in it.
Changed the setting on IE pop blocker from custom to medium, it looks like it is working. I'll try it more tonight and see if the problem has been fixed. Thanks for helping out. I'm kind of embarrassed that I didn't know about the IE pop blocker.
Changed the setting on IE pop blocker from custom to medium, it looks like it is working. I'll try it more tonight and see if the problem has been fixed. Thanks for helping out. I'm kind of embarrassed that I didn't know about the IE pop blocker.
Let me know how is goes
Do this now:
Good job
The following will implement some cleanup procedures as well as reset System Restore points:
Click START run
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.
To be on the safe side, I would also change all my passwords.
This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.
Here's my usual all clean post
Log looks good
This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
so….still have the same problem. Today McAfee detected a Trojan. Since I can't upload or paste the screen shot here's the text:
Trojan Detected
McAfee detected an infected file on your PC. Restart your PC so we can fix it.
About this Trojan
Detected: RakeAlert-FakeSpy!env.a (Trojan)
Quarantined From C;\Documents and Settings\Mike Unser\Local Settings\Application\Data\jrgqfpweq\hphfxthtssd.exe
We cannot remove a Trojan while the infected file is in use. Restarting your PC frees up the infected file allowing McAfee to fix the issue.
http://www.eset.eu/online-scanner
Go here to run an online scannner from ESET.
Click the green ESET Online Scanner button.
Read the End User License Agreement and check the box: YES, I accept the Terms of Use.
Click on the Start button next to it.
You may receive an alert on the address bar that "This site might require the following ActiveX control…Click here to install…". Click on that alert and then click Insall ActiveX component.
A new window will appear asking "Do you want to install this software?"".
Answer Yes to download and install the ActiveX controls that allows the scan to run.
Click Start.
Check Remove found threats and Scan potentially unwanted applications.
Click Scan to begin.
If offered the option to get information or buy software. Just close the window.
Wait for the scan to finish
Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic.
I ran the scanner the first time and it found 5 threats and cleaned them. I messed up cause I checked the uninstall button and I did not get a log file. I ran it again and this time saved the log file and there was still 1 threat that it found and cleaned. I still get another window when I click on links within the website or go to Google. The other window is always a advertisement. So i restarted my computer and now it seems ok. BUT thats what I said last time too. I guess I'll wait a day or so and see if there are any other problems.
ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=7.00.6000.17055 (vista_gdr.100414-0533)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=8117c217123277409a330497201ad220
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2010-07-02 04:29:25
# local_time=2010-07-01 09:29:25 (-0700, US Mountain Standard Time)
# country="United States"
# lang=9
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 42966343 42966343 0 0
# compatibility_mode=5121 16777173 100 75 5297361 9709140 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=149563
# found=1
# cleaned=1
# scan_time=4429
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2\A0000211.dll probably a variant of Win32/Adware.Softomate.AD application (cleaned by deleting - quarantined) 6B7D146274799059EACEA427F5996A5E C
Delete the folder
C:\Documents and Settings\Mike Unser\Local Settings\Application\Data\jrgqfpweq
Remove old system restore points.
Click Start > All Programs > Accessories > System Tools > Click Disc Cleanup
Now launch this utility and click More Options tab. Under which click System Restore and followed by that click Clean Up tab a message will popup -Are you sure you want to delete all but the most recent restore point?Click Yes then OK. Finally another message will popup-Are you sure you want to perform these actions?Click Yes.
Now, all the System Restore points except the most recent one are cleaned.
