Http://www.filost.com/stop.htm Launches

Sorry for the double post but I couldn't find an edit button.

Additional information.
Last night I left my computer on all night and this morning the page http://www.filost.com/stop.htm was open about 20 times.

Hi raven Welcome to Tom Coyote Forums. I'm looking over your log file and will get back to you soon. Elrond

Hi Elrond thank you I will check back regularly for instruction.

Hi again raven

Your log does not look to bad.


RED or UNDERLINED words are links that can be clicked.

HOW TO Instructions: This is where you find instructions or references for a number of common tasks. If you do not know how to do something then try to find it in this part.

Should you need instructions for:
Showing hidden files and folders in Windows.
Reboot in safe mode. If you have a keyboard with a "F Lock" key click it so that the "F" light above it is on when you start tapping the "F8" key.
How to print the fix instructions
Click the red links above.

How to unzip a downloaded zip file.
Place the zip file in the folder where you want the unzipped program to be.
If you are running Windows XP you simply right click the zip file and select "Extract Files".
For the other versions of Windows you will need a program like 7-Zip . Open 7-Zip. Navigate to to the downloaded zipfile and highlight it. Right click and select "Extract Here"

When asked to post a new HijackThis log please
Close all windows and browsers.
Find the HijackThis folder. Open it and double click "HijackThis.exe". Click "Do a system scan" and save a "logfile". (If Hijack this shows you a "Scan" button instead of "Do a system scan" that is OK. Just click it.)
When the scan is finished, the "Scan" button will change into a "Save Log" button. Click it. Click "Ctrl-A" (the "Ctrl" key and the "A" key at the same time) to highlight the whole log. Now click "Ctrl-C" to copy the text. Open this topic and click the "Add Reply" button at the bottom of the page. Paste the log into the window that opens up by clicking "Ctrl-V". Click "Add Reply" to post.


Preliminaries:


1. Please copy the instructions to a notepad or preferably print them.


2. Make sure to work through the fixes exactly as given and in the exact order they are mentioned below.


3. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.


4. IMPORTANT. Must be done before start of cleanup.

Your HijackThis is not the latest version. Please download this self extracting file to your Downloads folder in My Documents or some other place where you will find it easily:
* Now go to the folder you saved "HijackThis_sfx.exe" in. Double click "HijackThis_sfx.exe" and select "Unzip". When done click "OK".
* Close the WinZip self Extractor window.
* To find HijackThis go to C:\Program Files\HijackThis.

DO NOT MAKE ANY CHANGES OR CLICK "FIX CHECKED" UNTIL INSTRUCTED TO DO SO. SOME OF THE FILES ARE LEGIT AND VITAL TO YOUR COMPUTER'S HEALTH


5. Configure Windows to show all files.


Start the cleanup:


6. Open HijackThis and click "Do a System Scan Only". (If HijackThis shows a "Scan" button instead of "Do a System Scan Only" that is OK. In that case click "Scan".) When the scan is finished put a check mark by the items that are listed in bold below. If you can not find an item, that is OK. Just continue but inform me with your next post. Do not click fix until instructed to do so:

O16 - DPF: {24311111-1111-1121-1111-111191113457} - file://c:\eied_s7.cab
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O21 - SSODL: SystemCheck2 - {54645654-2225-4455-44A1-9F4543D34545} - C:\WINDOWS\System32\vbsys2.dll

You could also have Hijackthis fix thses entries as they are not needed and they can slow down your PC when starting up
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE


CLOSE ALL PROGRAMS and BROWSERS that are running, except HijackThis and then click the "fix" button.


7. Reboot in safe mode.


8. Useing Windows Explorer delete the following Files while in Safe Mode.

c:\eied_s7.cab
c:\ex.cab
C:\WINDOWS\System32\vbsys2.dll


9. IMPORTANT Your windows XP and Internet Explorer are out of date.
Go to Windows update . Update to at least Service Pack 1 and add all the security patches.


10. * Close ALL windows except HJT
* SCAN with HJT
* POST the new log in this thread using "Add Reply" or "Post Reply".

Well done, your log looks clean.

Now that your computer is free of malware, I want you to take some precautions to avoid being re-infected.

Settings and maintenance

1. Clean out temporary files.
Download System Security Suite . Place the zip file into a folder of its own. Extract it to this folder.

Run System Security Suite by clicking the 3S icon in program manager.
Under "items to clear" check mark all. Then click "clear selected items"
This will cause your system to reboot.
You should do this every few weeks to avoid buildup of unnecessary junk.


2. Clean Out System Restore.
Malware could get backed up in System Restore.
For Win XP follow these instructions to delete all restore points.
1. Go to "Start" > "Control Panel".
2. Make sure the Control Panel is in "Classic View". If it is not, click "Switch to Classic View" towards the top-left of the screen.
3. Double-click "System" and go to the "System Restore" tab.
4. Check "Turn off System Restore" and click "OK" and then "Yes".

After restarting your computer you should turn it back on by following the above procedure and uncheck "Turn off System Restore".

You can find out more about this subject at
Managing Windows Millennium System Restore

or at

How to turn off or turn on Windows XP System Restore


3. You reconfigured Windows to show hidden files and you should reset this to its original state useing the instructions from here except that
1. Under the "Hidden files and folders" heading put a mark for "Do not show hidden files and folders".
2. Uncheck "Display content of system folders"
3. Check the "Hide protected operating system files (recommended)" option.


4. Adjust your browser settings: Change your(active x) settings in IE. With IE open go to tools, internet options, security tab. Click on the internet globe, then custom level. Set the first option "download signed active x controls" to prompt, the next two to disable. Read more in
Internet Explorer Privacy & Security Settings
Working with Internet Explorer 6 Security
Many exploits are directed at Internet Explorer, you don't have to use it. Try a different browser like
Firefox . It is also worth trying
Thunderbird for controlling spam in your e-mail.



These are a must to protect yourself from malware.
1. Get a good anti-virus if you don't have one. A lot of people like AVG .
KEEP IT UPDATED

2. Get a good firewall if you don't have one.
Many like ZoneAlarm. You can download a free copy here

Be restrictive with access to the internet. If you are unsure if the program really needs the access, test it by denying the access and see if this has any negative effects. If not make the block permanent.

3. MOST IMPORTANT: You Need to UPDATE and then keep “Windows” and "Internet Explorer” updated. Your Windows and Internet Explorer are far behind in updates.
Open ‘Internet Explorer” and go to”Start”> "Tools" > "Windows Update" or go to Microsoft Windows and Internet Explorer Updates to get the critical updates.

If you are running Microsoft Office, or any portion thereof you must keep it updated as well. Go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed. Update MS Office here.

4. Download and install “SpywareBlaster”
Run it. Click "Updates" at the left and click "Check for Updates". After updating click "Protection" at the left and towards the bottom click "Enable All Protection". You should now be protected from all known bad ActiveX. You should occasionally check for updates.

5. Download and install "SpywareGuard"

Further tools

I highly recommend downloading and installing the newest versions of “AdAware SE Personal” and “Spybot Search and Destroy”
After installing remember to update the definition files for each program.
I also suggest that you visit this website and follow the instructions on how to configure both programs for best detection. These instructions are the best even though they refer to a cleanup of an infected computer.

There are many other programs that will add extra layers of protection to your computer as well.
I recommend “IE-Spyad” By default, it is unzipped to "C:\ie-spyad". Find out how to install it by going to the "ReadMe.txt". You should occasionally get updates by using the bat file or by uninstalling and deleting the old files and returning to the site to get the new version.

A Trojan scanner would be also be helpful. You can download a trial version of “Trojan Hunter” and run it to remove any traces of trojans.

The ”a Squared” trojan Scanner has a free version. It is an onboard trojan scanner that is installed much like Spybot/AdAware but handles trojans. Nice to add to your armor if you wish.
Download free from “a Squared” (The download button is at the bottom of the page). Install it.
Run and activate your free version with a Squared and then select
Scan your computer for malware infections .
Then select any/all drives.
Finally Scan selected folders.

It is worth while to take a look at "So how did I get infected in the first place? for some good advice.

A good source of information about computer secutiy can be found at this website . ChrisRLG has been an Administrator and Classroom Teacher at Tom Coyote and today has his own forum.


If you want to update Windows XP with SP2, you should know that there has been a small group of users who have had problems with it. The risks are the least if your computer is clean of malware and you are running an updated software firewall such as ZoneAlarm. You can download SP2 from http://support.microsoft.com/kb/322389
If you have a high-speed internet connection, you can let Windows Update do it. However if you have a dialup connection I would advise you to order the CD as the download is huge and will take a VERY long time to download. There has also been some reports that there is less problems when SP2 is installed from a CD.
You can get the CD here .


Update all protective programs regularly - Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Best of luck and clean computing
Elrond

Thanks so much Elrond This is great advice. The only thing I am confused about is why my Windows is so out of date. I have ran so many updates. Also I did try to install SP2 when u told me to run the updates but it failed. No idea why But thank you so much for your help and the follow-up advice. You are doing an outstanding job!

wrong forum sorry

update : I have now successfully installed SP 2 by responding to the automatic update prompt (it didnt work when i tried to do it rom the microsoft site).

Good to hear that everything is OK now. SP 2 can be finicky. It is a pleasure to be able to help you.