checking to see if infection has been removed by changing restore poin

jocase,

Looks like you didn't clear your java cache.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]

• Under Temporary Internet Files, click the Settings… button
• click the Delete Files button.
• There are two options in the window to clear the cache - Leave both Checked
  
  • Applications and Applets
    Trace and Log Files
• Click OK on Delete Temporary Files Window
  Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
• Click OK to leave the Temporary Files Settings
• Click OK to leave the Java Control Panel.

Then

Please download the OTM by OldTimer.

• Save it to your desktop.
• Please double-click OTM.exe to run it.
  (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  :Processes
  
  :Files
  C:\Program Files\SpywareStop
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [Reboot]

• Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

All processes killed ========== PROCESSES ========== ========== FILES ========== C:\Program Files\SpywareStop folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Java cache emptied: 13690439 bytes ->Flash cache emptied: 56543 bytes User: Helen ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 196608 bytes ->Flash cache emptied: 348 bytes User: John Casey ->Temp folder emptied: 24467536 bytes ->Temporary Internet Files folder emptied: 12238453 bytes ->Java cache emptied: 5293240 bytes ->Apple Safari cache emptied: 22409216 bytes ->Flash cache emptied: 2128816 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NeroMediaHomeUser.4 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 94213 bytes ->Java cache emptied: 13690439 bytes ->Flash cache emptied: 41 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 195557667 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2325617 bytes %systemroot%\System32 .tmp files removed: 17766417 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 3304442 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 186007219 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 89308 bytes RecycleBin emptied: 1183195 bytes Total Files Cleaned = 477.00 mb OTM by OldTimer - Version 3.1.18.0 log created on 06162011_230921 Files moved on Reboot… C:\Documents and Settings\John Casey\Local Settings\Temp\clclean.0001.dir.0000\~df394b.tmp moved successfully. C:\Documents and Settings\John Casey\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp moved successfully. Registry entries deleted on Reboot…

jocase,

That should take care of things.

Let's cleanup.

You need to create a new Clean restore point:

Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Cleanup

• Double click on OTM to run it.
• Click on CleanUp!
• When done, you will be prompted to restart your computer. Please restart your computer.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Thanks a bunch Tomk! I followed the last steps and am reading the anti-malware page You . Have been very helpful.

You are very welcome. Good luck and be well.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.