This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hidden Desktop

21 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi oldman960, I really appreciate what you've done for me (and my machine). The only log or text file I could find from PC Tools was called bugreport.txt. Here it is. date/time : 2011-09-08, 06:04:54, 218ms computer name : DCCB7L91 user name : SYSTEM registered owner : Margaret Quin operating system : Windows XP Media Center Service Pack 3 build 2600 system language : English system up time : 1 minute 45 seconds program up time : 41 seconds processor : Intel® Pentium® M processor 1.73GHz physical memory : 221/511 MB (free/total) free disk space : (C:) 11.44 GB display mode : 1280x800, 32 bit process id : $948 allocated memory : 83.30 MB executable : pctsSvc.exe exec. date/time : 2011-04-06 16:53 version : 7.0.0.168 compiled with : Delphi 2006/07 madExcept version : 3.0m beta 1 callstack crc : $0ae71894, $08ee2582, $41b43a69 exception number : 1 exception class : EIdSocketError exception message : Socket Error # 10054 Connection reset by peer.
Hi amitemurray,

Have a look here for the log(s)

Open PCTools and click on Settings in the left navigation menu and select Log Settings.

Click Log list. Click the most recent then click View Log.
Hi oldman960,
When I clicked on Settings, there was no option for Log Settings. However, under History I clicked on the most recent Infections Quarantined/Removed Summary and saved it to a file. Most of it consists of Tracking Cookies such as

"Threat Name - Spyware.Known_Bad_Sites
Type - Cookie
Risk Level - High
Infection - b3.mookie1.com/ b3.mookie1.com".

I can post the entire file if you like. I am not wedded to PC Tools, if you would like to suggest a change in antivirus. Thanks again.
Hi amitemurray, Cookies are harmless. Is that all that it has detected? What antivirus program yo use is up to you. If you are happy with PCTools keep using it. If you want to change to something else I can give you links to other free antivirus programs. Any problems with the computer?
Hi oldman960, Cookies are all that PC Tools has found. Computer is working fine–thanks for your excellent help! I would like to switch to a free antivirus program that doesn't ask me to upgrade every five minutes!
Hi amitemurray,

Try Avast!, it's the one I use. It autoupdates itself. It will notifiy you when it has updated or if there is a new program version available. The notofication is a small box that will appear near the clock. It will slide down the screen and disappear after a few seconds if you don't acknowledge it.

Download a copy from the link below. Disconnect from the internet and uninstall PCTools. Reboot the computer and install Avast.

Once you are finished post back and we'll clean up the tools

Avast
Help and support can be found here Avast Forum
Hi amitemurray,

Your java is out of date. Click your start button, open Control panel.
  • Locate the Java icon (it looks like a coffee cup)
  • double click it to open it
  • click the Update tab
  • Click update now

Next, Double click on OTL.exe
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Commands
[emptytemp]

Then click the Run Fix button at the top
  • Let the program run unhindered
No need to post the OTL log.



From your desktop, please delete, if present
  • any notepads/logs that we created
  • mbam-clean.exe
  • aswMBR.exe


Next

Click the Start button, click Run. [Vista users, go Start>"Start search"] Copy and paste the following line into the run box and click OK
Combofix /uninstall



Open OTL then click the Clean Up button. You may get prompted by your firewall that OTL wants to contact the internet - allow this. A cleanup.txt will be downloaded, a message dialog will ask you if you want to proceed with the cleanup process, click Yes. This will do some clean up tasks and delete some of the tools you have downloaded plus itself.


I suggest you keep MBAM. Keep it updated and use it regularly.

ESET online scan can be removed via add/remove programs.


Updates and upgrades

You have an older version of Adobe Reader. You can download the current version HERE

You may want to consider Foxit Reader instead. It may be a bit lighter on resources.

Visit their support forum
Foxit Forum

In either case you should uninstall Adobe Reader 8.2.5 first. Be sure to move any PDF documents to another folder first though.


Some Recommendations and prevention tips

Basic security consists of 1 antivirus program, 1 resident antispyware program, 1 on demand antispyware program and a firewall.

I suggest either for a resident antispyware program.

Windows Defender
OR
Winpatrol


* If you are behind a router Windows firewall should be fine. Otherwise a 3rd party firewall with outbound monitoring is recommended.

Click FIREWALL for links and tutorials to good, free and paid for firewalls. (Note: Zone Alarm is becoming bloatware IMO)


You should also use Spyware Blaster to help immunize your computer.

- SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

OR

A guide to understanding and using the hosts file.

Learn how your Hosts file can protect you and how you can protect it.
Besides the Hosts file information, there are links to a very good updated hosts file, a host file manager. and some programs that can protect your hosts file.
HOSTS

Please read the info on disabling the DNS Client before installing a custom hosts file.


-Secure your Internet Explorer

From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.


- Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis


- Make sure you have reset Automatic Updates to your chosen optionClick your start button > Control Panel > System


- Keep your antivirus program updated, as well as any other security programs you have.


-More tips and programs can be found HERE


- You may also want to read this article By Tony Klein
http://www.freedomlist.com/forum/viewtopic.php?t=22879

Please post back if you have any problems.

Take care :adios:
Hi oldman960, I can't thank you enough for your expertise (and patience!). You are providing a great service. I didn't deactivate Avast before I started uninstalling Combofix, and there was a lot of Sandbox warnings from Avast and loud beeps. Combofix fussed at me. Hopefully, it was uninstalled properly.
Hi amitemurray,


Hopefully, it was uninstalled properly.

Did combofix disappear from the desktop before you removed OTL?
Hi oldman960, Yes, the icon for ComboFix disappeared before I did the CleanUp with OTL. I tried the Combofix /uninstall command a second time, and the computer couldn't find a file by that name. If you want, I can re-download them both, then uninstall them again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI