checking to see if infection has been removed by changing restore poin

I am running Win XP Service Pack 3 Dell Desktop. A fake message appeared titled " PC perfromance and stability analysis". Desktop icons dissappeared, program files reported "empty" computer was unstable. I restarted it in Safe mode and and chose a restore point of the day before the virus appeared. All icons came back internet access is successful. I disabled Micro Penicillin (it seemed to be damaged) and downloaded and installed AVG Internet and scanned, no problems. I don't know if the virus is gone, because I don't know if it stays in some restore point. I used your service with success almost a year ago. Please advise. John

Hi jocase,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please download DDS by sUBs from one of the following links and save it to your desktop.

• • DDS.scr
  • DDS.pif
• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Thanks for responding. you mentioned two reports. I got only one and have attached it. AVG 2011 resident shield was deactivated. 📎dds.txt

I have attached the other file called attached.txt, so now you have two files. I may have sent dds twice, sorry

jocase,

Looking pretty good.

Your Java is out of date and you have other old versions still on your computer, those old versions are now a security vulnerability:

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer - Version 6 update 26

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

When attempting to solve the Java problem, I download the Java update and get this message: IES\5UWUET.JN\ire-6u26-windows- x64 [1].exe is not a valid windows 32 application.

the x64 in IES\5UWUET.JN\ire-6u26-windows- x64 [1].exe stands for 64 bit. So… obviously it isn't a 32 bit application.

Do it this way.

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
• Scroll down to where it says "JRE 6 Update 26".
• Click the "Download" button to the right.
• Select your Platform: "Windows".
• Select your Language: "Multi-language".
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
• Click Continue and the page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Then from your desktop double-click on jre-6u26-windows-i586-p.exe to install the newest version.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

• Under Temporary Internet Files, click the Settings… button
• click the Delete Files button.
• There are two options in the window to clear the cache - Leave both Checked
  
  • Applications and Applets
    Trace and Log Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Settings
• Click OK to leave the Java Control Panel.

It appears that the instructions do not match the Java website. I will try again Monday and see where I am going wrong. I am sending this message to let you know I haven't given up and to be sure that I don't rubn up against the "3 day shutdown" rule for non responsiveness.

I removed old Java versions via control panel ( win xp) and went to the Java websight and downloaded Java (TN) SE Runtime enviroment 6 ver 6 update 26. Next I clicked your link for malwarebytes and got to a trial version ARO2011. I started the scan and it reported errors. I cancelled the scan because with previous experience using malwarebytes from this site, it resulted in a report which I sent to a tech here for evaluation. After I clicked "cancel" It asked me to ckick the "fix button". I didn't click the "fix button" as I thought I was possibly on the wrong page. Can you tell me if ARO2011 is the free malwarebytes software?

No.

Please look at this screenshot:
[external image: Posted Image]
Just click on the big grey Download Now button that the red arrow is pointing to.

Ran Malwarebites. I don't know if I should "remove selected". below is a log right after scan Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6864 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/15/2011 6:19:34 PM mbam-log-2011-06-15 (18-17-15).txt Scan type: Full scan (C:\|) Objects scanned: 308292 Time elapsed: 53 minute(s), 14 second(s) Memory Processes Infected: 1 Memory Modules Infected: 1 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 5 Files Infected: 66 Memory Processes Infected: c:\program files\spywarestop\spywarestop.exe (Rogue.CNetMedia) -> 4456 -> No action taken. Memory Modules Infected: c:\program files\spywarestop\spycleaner.dll (Rogue.SpyCleaner) -> No action taken. Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ Ext\Stats\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> No action taken. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: c:\documents and settings\john casey\application data\spywarebot (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\Log (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55 (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\Settings (Rogue.SpywareBot) -> No action taken. Files Infected: c:\program files\spywarestop\spywarestop.exe (Rogue.CNetMedia) -> No action taken. c:\program files\spywarestop\spycleaner.dll (Rogue.SpyCleaner) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\rs.dat (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\Log\2008 aug 01 - 03_00_01 am_109.log (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\18.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\0.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\0.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\1.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\1.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\10.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\10.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\11.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\11.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\12.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\12.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\13.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\13.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\14.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\14.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\15.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\15.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\16.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\16.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\17.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\17.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\18.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\19.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\19.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\2.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\2.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\20.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\20.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\21.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\21.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\22.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\22.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\23.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\23.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\24.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\24.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\25.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\25.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\26.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\26.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\27.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\27.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\28.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\28.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\29.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\29.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\3.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\3.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\30.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\30.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\4.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\4.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\5.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\5.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\6.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\6.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\7.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\7.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\8.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\8.qnf (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\9.qit (Rogue.SpywareBot) -> No action taken. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\9.qnf (Rogue.SpywareBot) -> No action taken.

jocase, Yes. Please make sure everything is selected and remove them.

All check boxes checked and all threats removed. Restarted computer. Scan results after restart: Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6864 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/15/2011 8:16:25 PM mbam-log-2011-06-15 (20-16-25).txt Scan type: Full scan (C:\|) Objects scanned: 308292 Time elapsed: 53 minute(s), 14 second(s) Memory Processes Infected: 1 Memory Modules Infected: 1 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 5 Files Infected: 66 Memory Processes Infected: c:\program files\spywarestop\spywarestop.exe (Rogue.CNetMedia) -> 4456 -> Unloaded process successfully. Memory Modules Infected: c:\program files\spywarestop\spycleaner.dll (Rogue.SpyCleaner) -> Delete on reboot. Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: c:\documents and settings\john casey\application data\spywarebot (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\Log (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55 (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\Settings (Rogue.SpywareBot) -> Quarantined and deleted successfully. Files Infected: c:\program files\spywarestop\spywarestop.exe (Rogue.CNetMedia) -> Quarantined and deleted successfully. c:\program files\spywarestop\spycleaner.dll (Rogue.SpyCleaner) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\rs.dat (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\Log\2008 aug 01 - 03_00_01 am_109.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\18.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\0.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\0.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\1.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\1.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\10.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\10.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\11.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\11.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\12.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\12.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\13.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\13.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\14.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\14.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\15.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\15.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\16.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\16.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\17.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\17.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\18.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\19.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\19.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\2.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\2.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\20.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\20.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\21.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\21.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\22.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\22.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\23.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\23.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\24.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\24.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\25.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\25.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\26.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\26.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\27.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\27.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\28.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\28.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\29.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\29.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\3.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\3.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\30.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\30.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\4.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\4.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\5.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\5.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\6.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\6.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\7.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\7.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\8.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\8.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\9.qit (Rogue.SpywareBot) -> Quarantined and deleted successfully. c:\documents and settings\john casey\application data\spywarebot\quarantine\01-08-2008-15-44-55\9.qnf (Rogue.SpywareBot) -> Quarantined and deleted successfully.

jocase,

Let's get an online scan. This will take quite a while.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

• Please go here then click on: [external image: Posted Image]
  

  Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
  All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

• Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
• When prompted allow the Add-On/Active X to install.
• Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
• Now click on Advanced Settings and select the following:

• • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology
• Now click on: [external image: Posted Image]
• The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
• When completed the Online Scan will begin automatically.
• Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
• When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
• Now click on: [external image: Posted Image]
• Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
• Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

ESET log C:\Documents and Settings\John Casey\Application Data\Sun\Java\Deployment\cache\6.0\35\37e5fd23-5924cc9b multiple threats C:\Documents and Settings\John Casey\Application Data\Sun\Java\Deployment\cache\6.0\55\7f6d3777-614e8c8d Java/Agent.CL trojan C:\Documents and Settings\John Casey\Desktop\Eagle +Senior flash\Eagle\Aeries\instructional design docs and ppt\FreewarePrimoPDF.exe Win32/OpenCandy application C:\Documents and Settings\John Casey\Desktop\instructional design docs and ppt\FreewarePrimoPDF.exe Win32/OpenCandy application C:\Program Files\SpywareStop\TCL.dll Win32/Adware.AntiSpyware2008 application