Help Needed

Hi rhanania alsocom is having problems with is internet connection, so I will help you until he gets back. Locate and delete thes files. C:\Documents and Settings\SNIFF\Start Menu\erostars.exe C:\Documents and Settings\SNIFF\.jpi_cache\jar\1.0\archive.jar-2feca29b-1fad4f2b.zip C:\Documents and Settings\Administrator.RAMRASH\My Documents\Data\Data\MemWatcher2.exe C:\Documents and Settings\Administrator.RAMRASH\My Documents\Data\Data\all_files4.exe Then reboot and run mwavscan again and post the new log.

Thanks for your help I deleted the files you asked for and here is the log: File System Found infected by "Lycos Sidesearch Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "180Solutions Spyware/Adware" Virus. Action Taken: No Action Taken. File System Found infected by "VX2 Spyware/Adware" Virus. Action Taken: No Action Taken. File C:\pet_prog\HLNT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\SNIFF\My Documents\porsche manuals\cd PET5\PETSETUP.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\SNIFF\My Documents\porsche manuals\cd PET5\PET_PROG.NT4\HLNT.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\Documents and Settings\SNIFF\My Documents\porsche manuals\cd PET5\PRICE\ZIPSERVE.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. File C:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP4\A0000067.exe infected by "not-a-virus:PornWare.Dialer.Generic" Virus. Action Taken: No Action Taken. File F:\System Volume Information\_restore{11B4CBB0-31B0-483C-A4FE-D6E9E8C1A928}\RP17\A0001900.exe infected by "not-a-virus:PornWare.Dialer.Generic" Virus. Action Taken: No Action Taken.

Looks good.

Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)

1. Right-click My Computer, and then click Properties.
2. On the Performance tab, click File System, or press ALT+F.
3. On the Troubleshooting tab, put a check mark in the 'Turn Off System Restore' check box.
4. Click OK twice, and then click Yes when you are prompted to restart the computer.
5. Repeat steps 1 - 3, this time clearing the box beside 'Turn Off System Restore'


Now that everything is fixed, I suggest that you get these programs to help keep the computer clean:

Spyware Blaster - Blocks bad ActiveX items from installing on your computer.
SpywareGuard - Real-time protection from spyware installation attempts
ie-spyad - Puts over 8,000 bad URLs into your restricted sites for Internet Explorer.
Google Toolbar - Blocks many unwanted pop-ups in Internet Explorer.
Firefox - Safer alternative to the Internet Explorer web browser.

ZoneAlarm - Free firewall program if you currently are not using one.

Here are three very good and free malware scanners:

Spybot Search and Destroy 1.3
AdAware SE v1.05
Set-up Instructions for Spybot S&D; and Adaware SE
A2 Squared

If you have them already, check to make sure that they are the newest version.

Update these regularly.

You may also want to read "How did I get infected in the first place" to learn how to better secure your computer.

Be sure to keep Windows and your Anti-virus updated.

Thanks for everything! (I'lm also thanking you with a donation ) I'm runing counterspy and AVG Free adition. Also I'm using Firefox instead of IE. I'm running windows firewall, but I think I'll switch to zone alarm. Thanks again alsocom. and God bless! rami

Your welcome. Glad the computer is working well now.

As this topic has been resolved, the thread will be closed.

If you need this topic reopened, please request this by sending an email to us at the following link: (Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.