Computer infected with fake "spyware protection" program

no problem…i appreciate any help! i will try to run the scan again tonight. thanks kristin

Hi kristin031204, Thanks.

i think the problem was that i clicked "uninstall application on close" not realizing that the logs would be removed in addition to the program. attached is the log, and i also exported the scan results to a txt file (scan results.txt). thanks!! kristin

Hi kristin031204,

The first detection is a file that came from AOL and the second was bundled with some Dell software. The last one is a file we have quarantined. This will be removed when we remove the tools we used.

Next, Double click on OTL.exe

• Under the Custom Scans/Fixes box at the bottom, paste in the following
• Do Not copy the word CODE
• please note the fix starts with the :

:Services
:Files
C:\WINDOWS\SYSTEM32\dmcjqqij.ini
:Commands
[emptytemp]

Then click the Run Fix button at the top

• Let the program run unhindered

Please post the OTL fix log.

How is the computer?

Thanks

attached is the log. computer is acting normal, albeit a little slow. i rebooted 2x, shut it down for about 30min, and booted it up again. seems a little better now. -kristin

Hi kristin031204,

We cleaned out a lot of temporary folders and caches. The computer should speed up as Windows repopulates these caches.

Did you resolve the time issue?

Your computer appears to be malware free.

From your desktop, please delete, if present

• any notepads/logs that we created
• GMER (exz1hs.scr)
• scan.txt
• fix.txt
• MCPR.exe

Next

* Create a new restore point

You must be logged on to an administrator account

• Go to Start - All Programs - Accessories - System Tools - System Restore.
• Click Create a restore point, and then click Next.
• In the text box labeled Restore Point Description, type a name for this restore point
• click create

* Remove old restore points

• Go to Start - All Programs - Accessories - system tools.
• Launch the Disk Cleanup tool and let it run.
• When it finishes a box with tabs will appear, select the more options tab.
• On this tab you will find a section for System Restore.
• If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.

Next

Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep it updated and use it regularly.

ESET online scan can be removed via add/remove programs if you have not already uninstalled it.


Updates and upgrades

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 3.01 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

I suggest either

Windows Defender
OR
Winpatrol

* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware, IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.

• Click once on the Security tab
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
• Change the Download signed ActiveX controls to Prompt
• Change the Download unsigned ActiveX controls to Disable
• Change the Initialize and script ActiveX controls not marked as safe to Disable
• Change the Installation of desktop items to Prompt
• Change the Launching programs and files in an IFRAME to Prompt
• Change the Navigate sub-frames across different domains to Prompt
• When all these settings have been made, click on the OK button.
• If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

Please post back if you have any problems.

We will keep this thread open for a couple of days. Please post back if you have any problems or questions. Please post back when you have finished so this thread can be marked "Resolved".

Take care

Thanks so much!! i was kind of hoping that the computer was slow because we gave it a thorough cleaning…makes sense. I'll work on those great instructions tonight and tomorrow, then post back to let you know we are all set. Feels good to hear "malware free" One question…you have instructions as to how to "Secure your Internet Explorer". We use Firefox. Should we follow similar instructions in that program? or, in your opinion, is IE a better browser? we had switched to FF a while back because we had heard it was more "resistant' against attacks. Thanks again…i'm sure you're glad to be rid of me…it's been about 6wks!!! I appreciate you sticking with me -Kristin

Hi kristin031204,

it's been about 6wks!!!

Really? Hmmm…time seems to fly when you are having fun. Apologies for this taking so long.

i'm sure you're glad to be rid of me

Not really, it's been a pleasure helping out.

We use Firefox. Should we follow similar instructions in that program?

FireFox is secured in a different manner. A lot is done with "extensions".
http://www.brighthub.com/computing/smb-sec…cles/33444.aspx

There is a link under the Security Extensions for Firefox section near the end of page 2 for the top 5 extensions.

You should still secure IE as you might need it to visit some MS sites.

we had switched to FF a while back because we had heard it was more "resistant' against attacks.

Yes and no. There is malware written specifically for FireFox that will not effect IE. Keeping your browser as well as Windows and other programs updated will help no matter which browser you use.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.