Oops...Posted to My Own Topic with More Information...

No threats found! Thank you so much! So, can I ask what it was that my computer had? And any advice as to how to avoid having this same problem again?

Thats great CF removed some files that may have been part of a rogue program that may have not installed completely, but there gone now. How is your system running now ? Any browser redirects of unwanted pop up windows ? Let me know and before I close this thread I will link you to some free security programs to install and some tips on staying secure in the future

Ken, it seems to be running ok. But, it's always been good some days and really bad on other days–hard to say! If you don't mind leaving this ticket open for a few days I could come back and let you know in the next few days when I go back to all day web surfing. So…what were those suggestions you had?

Good Morning Heather,

Not a problem keeping the thread open for you , do post back and let me know how its going. Is your problem with internet your Internet Explorer browser ?


Open OTL.exe

• Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL
  
  

  :processes
  killallprocesses
  
  :OTL
  
  :Services
  
  :Reg
  
  :Files
  ipconfig /release /c
  ipconfig /renew /c
  ipconfig /flushdns /c
  
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [start explorer]
  [Reboot]

• Then click the Run Fix button at the top. <–Not run Scan
• Let the program run unhindered, reboot when it is done
• Then post the results of the log it produces.

Well, I don't use Microsoft Internet Explorer. But, I guess it could be the Firefox. Last night, I fell asleep before disconnecting my computer from the internet, and instead of shutting itself down, it was still running at 5 am. Weird, right? It doesn't usually do that when I disconnect it. But, sometimes it doesn't shut down and an error message says it's because my printer won't let it and would I like to report the problem? I always just close the dialogue box. The printer works fine. But, seemed like a possibly important detail.


Here are the log contents:

All processes killed
Error: Unable to interpret in the current context!
========== PROCESSES ==========
========== OTL ==========
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
< ipconfig /release /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
C:\Documents and Settings\Home User\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Home User\Desktop\cmd.txt deleted successfully.
< ipconfig /renew /c >
Windows IP Configuration
No operation can be performed on Local Area Connection while it has its media disconnected.
C:\Documents and Settings\Home User\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Home User\Desktop\cmd.txt deleted successfully.
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Home User\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Home User\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 0 bytes

User: Home User
->Temp folder emptied: 50438 bytes
->Temporary Internet Files folder emptied: 338133 bytes
->Java cache emptied: 352801 bytes
->FireFox cache emptied: 87349781 bytes
->Flash cache emptied: 6951 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2163646 bytes
%systemroot%\System32 .tmp files removed: 28629332 bytes
%systemroot%\System32\dllcache .tmp files removed: 1774080 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 58416 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 115.00 mb


OTL by OldTimer - Version 3.2.29.1 log created on 10092011_094939

Files\Folders moved on Reboot…
File\Folder C:\Documents and Settings\Home User\Local Settings\Temp\~DF4FC7.tmp not found!
File\Folder C:\Documents and Settings\Home User\Local Settings\Temp\~DFF0A.tmp not found!
File\Folder C:\Documents and Settings\Home User\Local Settings\Temporary Internet Files\Content.Word\~WRS0003.tmp not found!

Registry entries deleted on Reboot…

Open Firefox and go to Help> About, the latest version is 7.1, if you dont have it you can update it from here and see if it helps. Any redirects with Firefox

http://www.mozilla.org/en-US/firefox/new/

Ok, Firefox is updated. It said a couple of add-ons were incompatible with my new Firefox version: Microsoft .NET Framework Assistant 1.2.1 Java Console 6.0.20 Do you have any other suggestions?

Hi


We need to update your Java to help keep you more secure

Download the latest version Here save it, do not install it yet.

Java SE Runtime Environment (JRE)JRE 6 Update 26 <–The wording is confusing but this is what you need, its should also be for Windows X86 Offline

• Go to your Add Remove Programs in the Control Panel and uninstall any previous versions of Java
• Reboot your computer
• Install the latest version

You can verify the installation Here

• Click START then RUN
• Now type Combofix /uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.
  
  
  🖼Click to load external image (Posted Image)

Open OTL and click on Clean Up and it will remove programs we used to clean your system along with there backups

Malwarebytes is the free version and yours to keep and will not be removed

• How did I get infected in the first place ?
  Read these links and find out how to prevent getting infected again.
• Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
• WhattheTech
• Grinler BleepingComputer
• GeeksTo Go
• Dslreports

Safe Surfn
Ken

Good morning, Ken! Well, my computer exhibited the same strange behavior this morning–total Firefox freezup and 100% processor usage. I ended up disconnecting the internet and closing Firefox and reopening it. I had a bunch of strange extra ghost links on my desktop when I disconnected. As luck would have it, I took a screen shot of half the desktop and my windows task manager while this was going on. How can I send you this picture? Anyway, disconnecting internet didn't fix the problem, but closing Firefox and reopening it halted the 100% processor usage. Needless to say, I am concerned that there is still something strange going on. I changed my Windows update settings from every day to 'always ask me' (before downloading/installing) in the hopes that it might be that. I'm running Online Armor (started it before I found your response) to see if that might help–found that on another page in your blog. It's saying that 'Exploring Start Menu' and 'Checking Autoruns' need attention. It skipped the latest OA ratings (I think because I unplugged the internet). The windows security alerts are saying that it can't find virus protection, but I'm not sure what to load. I will update my Java as instructed and wait for further instructions. Please let me know how to send you that screen shot. Thank you, Ken!

Online Armor came up with the following unrecognized programs that are set to start when I turn on my computer: atiptaxx.exe ATI Desktop Control Panel, 6.14.10.5155 hpqSRMon.exe HpqSRmon, 10.0.0.202 What should I do with them? Thank you, Heather

Heather,

These two are fine, there related to your ATI Graphics card and your HP Digital Imaging Software
atiptaxx.exe ATI Desktop Control Panel, 6.14.10.5155
hpqSRMon.exe HpqSRmon, 10.0.0.202

To insert an image, you would have to use a free site like Photo Bucket to upload the picture from your hard drive and then copy the image location on Photo Bucket and use the Insert Image on the toolbar at the top of this thread as you reply


Why dont you go to Add Remove Programs in the Control Panel and uninstall Firefox completely, then go to C:\ Program Files and if the folder is still present , delete it, then use my link for Firefox 7.1 and reinstall it fresh and see if it makes a difference.


Post both these reports and lets make sure nothing has returned
Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
[external image: Posted Image]

On completion of the scan click save log, save it to your desktop and post in your next reply
[external image: Posted Image]



Download DDS from one of the links below to your desktop

Link 1
Link 2

• Double click the tool to run it.
• A black Screen will open, just read the contents and do nothing.
• When the tool finishes, it will open 2 reports, DDS.txt and attach.txt
• Copy/Paste the contents of 'DDS.txt' into your post.
• 'attach.txt' should be zipped using Windows native zip utility and attached to your post. Compress and uncompress files (zip files)

Ok. Is there a way to save all my favorites if I totally uninstall Firefox?

You can give this a shot

http://support.mozilla.com/en-US/kb/Backin…ing%20bookmarks

Due to inactivity this topic will be closed.
If you need help please start a new thread.

New members follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html and start a new topic