What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trying To Get Rid Of Sp-servers

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 10:18:23 PM, on 4/23/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\essspk.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\PROGRA~1\COMMON~1\AOL\110894~1\EE\AOLHOS~1.EXE
C:\PROGRA~1\COMMON~1\AOL\110894~1\EE\AOLServiceHost.exe
C:\Program Files\WinZip\Wzqkpick.exe
C:\Program Files\America Online 9.0a\shellmon.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\administrator\Local Settings\Temp\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - Default URLSearchHook is missing
N3 - Netscape 7: user_pref("browser.startup.homepage", "yahoo.com"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\p9gepcez.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\p9gepcez.slt\prefs.js)
O1 - Hosts: 207.44.240.65 rad.msn.com
O1 - Hosts: 216.93.174.28 view.atdmt.com
O1 - Hosts: 216.93.174.28 ad.doubleclick.net
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1108941493\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0a\AOL.EXE" -b
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\SHDOCVW.DLL
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
Post #2
Hello dtydty and Welcome to Tom Coyote


I am going to look over your log and get back to you
as soon as I can.

In the meantime, do this,

* Go to MY CONTROLS/ EMAIL SETTINGS and
ENABLE EMAIL NOTIFICATIONS

* At the top of this post, click on TRACK THIS TOPIC

* Please reply to this post by clicking on the REPLY BUTTON
and not the NEW TOPIC BUTTON
Post #3
Hello Again dtydty, :D

This is Ken and I am going to help you clean up your system. You may want to print this out so you can refer to it as you go along.

We have a few issues we need to address…

Hijackthis is current but it is extremly important for it to reside in its own folder, when we make changes to your system with HJT, it creates backups and those backups could be lost if HJT is not in its own folder. Very easy to correct. Just go to MY COMPUTER > Your C:\ Drive > File/ New folder and name that folder HIJACKTHIS. Then scroll to where you have it currently and right click on the HJT icon and choose CUT, then open the new folder you just created and right click in that folder and choose PASTE. So it should look like C:\HIJACKTHIS\HIJACKTHIS.EXE.

You have two anti- virus programs running, not a good idea as they will conflict with one another. Your call but you need to uninstall one via the add-remove programs in the control panel.

Now download the HOSTER program to your desktop from this link

http://www.funkytoad.com/download/hoster.zip

* Unzip Hoster.zip to your Desktop
* Open Hoster.exe.
* Close all Open Windows.
* Then click on Restore Original Hosts
* Close program when complete.


I see you have SPYBOT SEARCH AND DESTROY on your system, make sure its the current version 1.3 , you can find out by opening the program and going to HELP>ABOUT and it will give you the version number. If you need to download the new version, you can find it in the link in my signature, here are instructions for setting up this fine program. After you have it set up, check for updates and do a scan.

If you have the older version 1.2, remove it via ADD-REMOVE PROGRAMS in the CONTROL PANEL

Go to START/ CONTROL PANEL/ PERFORMANCE AND MAINTAINENCE/ ADD-REMOVE
PROGRAMS scroll to that program and click on REMOVE.

* During Installation, just follow all the defaults.
* Go to MODE and click on ADVANCED MODE.
* Then to SETTINGS / IGNORE PRODUCTS and put a checkmark in DSO EXPLOITS.
* Then to SETTINGS / FILE SETS and take the checkmark out of USAGE TRACKS.
* Then to TOOLS/ HOSTS FILE and then on the top click on ADD SPYBOT S & D HOSTS FILES.
* Then to TOOLS/ IE TWEAKS and put a checkmark in LOCK THE HOSTS FILES
* Then check for UPDATES.
* Then to Immunize. then up at the top by the GREEN SIGN, click on IMMUNIZE.
* Then go to the top to SPYBOT and run a FULL SYSTEM SCAN.
* Then to FIX PROBLEMS and fix all it finds.

Then RE-BOOT your computer.


Now download and install AD-AWARE SE PERSONAL 1.05

If you have an older version of AD-AWARE You can remove it via
the ADD-REMOVE PROGRAMS IN THE CONTROL PANEL

* During installation, follow all the defaults.
* Start the program and CHECK FOR UPDATES
* Choose PERFORM FULL SYSTEM SCAN
* Take the checkmark out of SEARCH FOR NEGLIGIBLE RISK FILES
* Run the scan
* When it is done, RIGHT CLICK ON ONE OF THE ENTRIES/ SELECT ALL/ NEXT and let it remove all that if finds.

Reboot your computer

Now run a couple of online virus scans, have them set to AUTO-CLEAN or to FIX WHAT IT FINDS. Please post any results that it could not fix in your next reply.

http://housecall.trendmicro.com/
http://www.pandasoftware.com/activescan/

Now open HJT (SCAN ONLY) and put a checkmark in the following entries, close all open windows and browsers and click on FIX CHECKED.

* R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = about:blank
* R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
* R3 - Default URLSearchHook is missing

Run HJT and post a new log please.
Post #4
Ken,

Thank you so much for your assistance! I followed all the steps that you've suggested.

When I did the trendmicro scan, it couldn't delete the JAVA BYTEVER.A virus.

This is the log from the pandaSW scan:


Incident Status Location

Spyware:Spyware/ISTbar No disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-27234ef6.zip[InstallerApplet.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\menu.jr-4d8b0a19-3b11e79c.zip[Beyond.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\menu.jr-4d8b0a19-3b11e79c.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\menu.jr-4d8b0a19-3b11e79c.zip[NudeBox.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\menu.jr-4d8b0a19-3b11e79c.zip[Worker.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\menu.jr-4d8b0a19-3b11e79c.zip[VerifierBug.class]
Virus:Trj/Bancos.M Disinfected C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\menu.jr-4d8b0a19-3b11e79c.zip[javautil.zip]
Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\administrator\Application Data\Sskknwrd.dll
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-77bfce81-66264bfe.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-77bfce81-66264bfe.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-77bfce81-66264bfe.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-77bfce81-66264bfe.zip[Installer.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-784c249c-5978ccb6.zip[GetAccess.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-784c249c-5978ccb6.zip[InsecureClassLoader.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-784c249c-5978ccb6.zip[Dummy.class]
Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\administrator\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-784c249c-5978ccb6.zip[Installer.class]
Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\administrator\Local Settings\Temp\i44.tmp
Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\administrator\Local Settings\Temp\SskUpdater.exe
Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\administrator\Local Settings\Temp\U4D4.tmp
Spyware:Spyware/SurfSideKick No disinfected C:\Documents and Settings\administrator\Local Settings\Temporary Internet Files\Ssk.log
Adware:Adware/PortalScan No disinfected C:\Program Files\Common Files\Presentia\pmr.exe
Adware:Adware/FunWeb No disinfected C:\WINDOWS\Downloaded Program Files\f3initialsetup1.0.0.6.inf
Possible Virus. No disinfected C:\WINDOWS\SYSTEM32\in10b6s.dll
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\mac80ex.idf
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\mac80ex.idf[msbe.dll]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\mac80ex.idf[Uninstall.exe]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\mac80ex.idf[bargains.exe]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\mac80ex.idf[adv.exe]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\mac80ex.idf[adx.exe]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\netut80ex.vxd
Adware:Adware/ExactSearch No disinfected C:\WINDOWS\SYSTEM32\netut80ex.vxd[exdl.exe]
Adware:Adware/ExactSearch No disinfected C:\WINDOWS\SYSTEM32\netut80ex.vxd[mqexdlm.srg]
Adware:Adware/ExactSearch No disinfected C:\WINDOWS\SYSTEM32\netut80ex.vxd[exul.exe]
Adware:Adware/ExactSearch No disinfected C:\WINDOWS\SYSTEM32\netut80ex.vxd[javexulm.vxd]
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\netut80ex.vxd[msexreg.exe]
Adware:Adware/FastFind No disinfected C:\WINDOWS\SYSTEM32\sub2b.exe
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\vx0.nls
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\vx1.nls
Spyware:Spyware/BargainBuddy No disinfected C:\WINDOWS\SYSTEM32\vx1x.nls
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\TEMP\biJ.inf

And below is the HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 8:14:41 PM, on 5/3/2005
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\atiptaxx.exe
C:\WINDOWS\essspk.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe
C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe
C:\PROGRA~1\COMMON~1\AOL\110894~1\EE\AOLHOS~1.EXE
C:\Program Files\WinZip\Wzqkpick.exe
C:\PROGRA~1\COMMON~1\AOL\110894~1\EE\AOLServiceHost.exe
C:\WINDOWS\system32\ntvdm.exe
C:\HIJACKTHIS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by America Online
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
N3 - Netscape 7: user_pref("browser.startup.homepage", "yahoo.com"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\p9gepcez.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Administrator\Application Data\Mozilla\Profiles\default\p9gepcez.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [EssSpkPhone] essspk.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AOL Spyware Protection] "C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1108941493\EE\AOLHostManager.exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Pure Networks Port Magic] "C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" -Run
O4 - HKCU\..\Run: [AOLCC] "C:\Program Files\AOL Computer Check-Up\ACCAgnt.exe" /startup
O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPN Dialer (OnStartup).lnk = C:\Program Files\Cisco Systems\VPN Client\ipsecdialer.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\SHDOCVW.DLL
O10 - Broken Internet access because of LSP provider 'connwsp.dll' missing
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Thank you again for all your great help!
Post #5
Hi Again dtydty, :D

Your log is looking much better, But I want to analyze it a little more to make sure we didn't miss anything. It looks like the online scan got rid of this one–> ByteVerify Disinfected

Go into your ADD-REMOVE PROGRAMS in the CONTROL PANEL and see if there is anything related to both BargainBuddy and SurfSideKick and if there is remove them both.

Now enable windows to show all files and folder and boot into Safemode, Instructions here……


* Click on MY COMPUTER
* Then on your C: Drive
* Then to TOOLS/ FOLDER OPTIONS/ VIEW
* Choose the radio button to SHOW HIDDEN FILES AND FOLDERS
* Take the checkmark out of HIDE EXTENSIONS FOR KNOWN FILE TYPES
* Then APPLY/ OK

* Don't forget to reverse this once your computer is clean

To enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART

* As the computer starts to boot-up, Tap the F8 KEY
somewhat rapidly, this will bring up a menu.

* Use the UP AND DOWN ARROW KEYS to scroll
up to SAFEMODE

* Then press the ENTER KEY ON YOUR KEYBOARD

While in Safemode, look for these two folders and if present, delete them.

* C:\Program Files\ Bargain Buddy <– This folder in Bold
* C:\Program Files\ SurfSideKick <– This folder in Bold

While in Safemode….

* click on START/ RUN , and type %temp% and press the ok button.

This should open up the temp directory that your machine uses. Please delete all files that are found there.
If you get an error when deleting a file, skip that file and delete all the others.
* Do this same process for %windir%\temp.

NOW RE-BOOT NORMALLY


Step 2 - DELETE TEMPORARY INTERNET FILES


* Now I want you to open up INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB, (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
When it is done, your Temporary Internet Files will now be deleted.

Ok Kiddo, hang in and I will be back……..
Post #6
dtydty,

Your log looks very clean, :D but to be on the safeside, do this

Please download MicroWorld scanner for the link below. Make sure that you choose all files and directories. I warn that the scan will tak a long time and will not fix anything. Once the scan is completed in the LOWER box hilight all the files there then copy (ctrl +c) and paste it into the thread please.

Here >>>> http://www.mwti.net/antivirus/mwav.asp
Post #7
Ken, Sorry for replying so late. I was trying to figure out a way to get the error messages from the log without posting the gadzillion lines. I didn't find Bargain Buddy or SurfSideKick on my system. These are the error messages after running the MicroWorld Scan: Thu May 05 17:29:10 2005 => System found infected with iemenuextension Spyware/Adware! Action taken: No Action Taken. Thu May 05 17:29:10 2005 => File System Found infected by "iemenuextension Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:29:29 2005 => System found infected with ezula Spyware/Adware (vx0.nls)! Action taken: No Action Taken. Thu May 05 17:29:29 2005 => File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:29:29 2005 => System found infected with ezula Spyware/Adware (netut80ex.vxd)! Action taken: No Action Taken. Thu May 05 17:29:29 2005 => File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:29:31 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken. Thu May 05 17:29:31 2005 => File System Found infected by "cws.therealsearch Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:29:31 2005 => System found infected with cws.smartsearch Spyware/Adware (C:\WINDOWS\Start.exe)! Action taken: No Action Taken. Thu May 05 17:29:31 2005 => File System Found infected by "cws.smartsearch Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:30:44 2005 => System found infected with iemenuextension Spyware/Adware! Action taken: No Action Taken. Thu May 05 17:30:44 2005 => File System Found infected by "iemenuextension Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:31:02 2005 => System found infected with ezula Spyware/Adware (vx0.nls)! Action taken: No Action Taken. Thu May 05 17:31:02 2005 => File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:31:02 2005 => System found infected with ezula Spyware/Adware (netut80ex.vxd)! Action taken: No Action Taken. Thu May 05 17:31:02 2005 => File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:31:03 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken. Thu May 05 17:31:03 2005 => File System Found infected by "cws.therealsearch Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:31:03 2005 => System found infected with cws.smartsearch Spyware/Adware (C:\WINDOWS\Start.exe)! Action taken: No Action Taken. Thu May 05 17:31:03 2005 => File System Found infected by "cws.smartsearch Spyware/Adware" Virus. Action Taken: No Action Taken. Thu May 05 17:33:27 2005 => File C:\WINDOWS\system32\in10b6s.dll infected by "Trojan-Dropper.Win32.Mudrop.k" Virus. Action Taken: No Action Taken. Thu May 05 17:33:54 2005 => File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. Thu May 05 17:34:28 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. Thu May 05 17:35:52 2005 => File C:\WINDOWS\system32\sub2b.exe infected by "Trojan-Dropper.Win32.Inflator.b" Virus. Action Taken: No Action Taken. Thu May 05 17:37:13 2005 => File C:\AOL Downloads\aolsetup90\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu May 05 17:41:43 2005 => File C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-27234ef 6.zip infected by "Trojan-Downloader.Java.OpenStream.t" Virus. Action Taken: No Action Taken. Thu May 05 17:56:32 2005 => File C:\Program Files\America Online 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu May 05 17:58:35 2005 => File C:\Program Files\America Online 9.0a\backup\restore\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu May 05 17:58:40 2005 => File C:\Program Files\America Online 9.0a\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Thu May 05 18:12:25 2005 => File C:\Program Files\Common Files\Presentia\pmr.exe infected by "not-a-virus:AdWare.Suggestor.b" Virus. Action Taken: No Action Taken. Thu May 05 19:34:11 2005 => File C:\Program Files\Logitech\Resource Center\installers\wildtangent\blastrb2.exe infected by "not-a-virus:AdWare.WildTangent.a" Virus. Action Taken: No Action Taken. Fri May 06 14:30:17 2005 => System found infected with iemenuextension Spyware/Adware! Action taken: No Action Taken. Fri May 06 14:30:17 2005 => File System Found infected by "iemenuextension Spyware/Adware" Virus. Action Taken: No Action Taken. Fri May 06 14:30:36 2005 => System found infected with ezula Spyware/Adware (vx0.nls)! Action taken: No Action Taken. Fri May 06 14:30:36 2005 => File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Fri May 06 14:30:36 2005 => System found infected with ezula Spyware/Adware (netut80ex.vxd)! Action taken: No Action Taken. Fri May 06 14:30:36 2005 => File System Found infected by "ezula Spyware/Adware" Virus. Action Taken: No Action Taken. Fri May 06 14:30:37 2005 => System found infected with cws.therealsearch Spyware/Adware (waol.exe)! Action taken: No Action Taken. Fri May 06 14:30:37 2005 => File System Found infected by "cws.therealsearch Spyware/Adware" Virus. Action Taken: No Action Taken. Fri May 06 14:30:37 2005 => System found infected with cws.smartsearch Spyware/Adware (C:\WINDOWS\Start.exe)! Action taken: No Action Taken. Fri May 06 14:30:37 2005 => File System Found infected by "cws.smartsearch Spyware/Adware" Virus. Action Taken: No Action Taken. Fri May 06 14:33:01 2005 => File C:\WINDOWS\system32\in10b6s.dll infected by "Trojan-Dropper.Win32.Mudrop.k" Virus. Action Taken: No Action Taken. Fri May 06 14:33:28 2005 => File C:\WINDOWS\system32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. Fri May 06 14:34:02 2005 => File C:\WINDOWS\system32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. Fri May 06 14:35:26 2005 => File C:\WINDOWS\system32\sub2b.exe infected by "Trojan-Dropper.Win32.Inflator.b" Virus. Action Taken: No Action Taken. Fri May 06 14:36:42 2005 => File C:\AOL Downloads\aolsetup90\comp01.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Fri May 06 14:41:13 2005 => File C:\Documents and Settings\administrator\.jpi_cache\jar\1.0\javainstaller.jar-4514e5ea-27234ef 6.zip infected by "Trojan-Downloader.Java.OpenStream.t" Virus. Action Taken: No Action Taken. Fri May 06 14:55:58 2005 => File C:\Program Files\America Online 9.0\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Fri May 06 14:58:01 2005 => File C:\Program Files\America Online 9.0a\backup\restore\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Fri May 06 14:58:06 2005 => File C:\Program Files\America Online 9.0a\Jiti\Jiti_mm.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Fri May 06 15:11:51 2005 => File C:\Program Files\Common Files\Presentia\pmr.exe infected by "not-a-virus:AdWare.Suggestor.b" Virus. Action Taken: No Action Taken. Fri May 06 16:33:33 2005 => File C:\Program Files\Logitech\Resource Center\installers\wildtangent\blastrb2.exe infected by "not-a-virus:AdWare.WildTangent.a" Virus. Action Taken: No Action Taken. Fri May 06 18:38:34 2005 => File C:\RECYCLER\S-1-5-21-1390067357-1993962763-854245398-500\Dc371.tmp infected by "not-a-virus:AdWare.SurfSide.a" Virus. Action Taken: No Action Taken. Fri May 06 18:38:35 2005 => File C:\RECYCLER\S-1-5-21-1390067357-1993962763-854245398-500\Dc372.exe infected by "not-a-virus:AdWare.SurfSide.c" Virus. Action Taken: No Action Taken. Fri May 06 18:38:36 2005 => File C:\RECYCLER\S-1-5-21-1390067357-1993962763-854245398-500\Dc402.tmp infected by "not-a-virus:AdWare.SurfSide.c" Virus. Action Taken: No Action Taken. Fri May 06 19:23:30 2005 => File C:\WIN98\WIN98_66.CAB tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Fri May 06 19:34:34 2005 => File C:\WINDOWS\All Users\Application Data\AOL Downloads\lpkw_setupSTUS\comp02.000 tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken. Fri May 06 19:38:45 2005 => File C:\WINDOWS\All Users\Application Data\Spybot - Search & Destroy\Recovery\eXactAdvertisingBargainsBuddy1.zip infected by "Password-protected-EXE" Virus. Action Taken: No Action Taken. Fri May 06 21:18:20 2005 => File C:\WINDOWS\SYSTEM32\in10b6s.dll infected by "Trojan-Dropper.Win32.Mudrop.k" Virus. Action Taken: No Action Taken. Fri May 06 21:18:47 2005 => File C:\WINDOWS\SYSTEM32\mac80ex.idf infected by "not-a-virus:AdWare.BargainBuddy.l" Virus. Action Taken: No Action Taken. Fri May 06 21:19:28 2005 => File C:\WINDOWS\SYSTEM32\netut80ex.vxd infected by "not-a-virus:AdWare.BargainBuddy.n" Virus. Action Taken: No Action Taken. Fri May 06 21:21:05 2005 => File C:\WINDOWS\SYSTEM32\sub2b.exe infected by "Trojan-Dropper.Win32.Inflator.b" Virus. Action Taken: No Action Taken. Should I go ahead and buy their anti-virus software? Thank you so much!
Post #8 last edited
Hello again dtydty, I don't think there is much to worry about, but you do have 2 anti-virus programs running and that could cause you problems. You need to uninstall one of them, your call. I have a bunch of tips and free anti spyware programs for you to install, but before I post them to you, run HJT and post a new log please.
Post #9
dtydty,

I just went over your previous log and there won't be any changes with posting a new one, I don't see anything to worry about, your log looks very clean. :D

Just follow all the info in this post to clean out all the gar-barge in your system and to help block all that crappola from instlalling in the first place.

Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.
clean out your TEMP FILES

* This procedure should be run from SAFEMODE for better results.

To Enter SAFEMODE

* Go to START/ SHUT OF YOUR COMPUTER/ RESTART
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the UP AND DOWN ARROW KEYS to scroll up to SAFEMODE
* Then press the ENTER KEY ON YOUR KEYBOARD

Now, while in SAFEMODE,

* click on START/ RUN , and type %temp% and press the ok button.

This will open up the temp directory that your machine uses. GO TO EDIT/ SELECT ALL and delete all the contents of that folder.
* Do this for each user of your computer.
* Do this same process for %windir%\temp.

NOW RE-BOOT NORMALLY

DELETE TEMPORARY INTERNET FILES

* Open INTERNET EXPLORER
* Click on the TOOLS MENU
* Then INTERNET OPTIONS
* At the GENERAL TAB, (which should be the first tab you are currently on),
* click on the DELETE FILES BUTTON and put a checkmark in DELETE ALL OFFLINE CONTENT.
* Then press the OK BUTTON . This may take quite a while, so do not be alarmed with how long it takes.
* When it is done, your Temporary Internet Files will now be deleted.

Now we need to TURN OFF and then TURN BACK ON SYSTEM RESTORE.

This will remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent
any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points
which are likely to be infected)


Turn off System Restore.

* On the Desktop, right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore.
* Click Apply, and then click OK.


Reboot your System


Turn ON System Restore.

* On the Desktop, right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* UN-Check Turn off System Restore.
* Click Apply, and then click OK.
* Now while in System Restore, create a new Restore Point.

* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.
* If you want to use a free program, try this one –> http://free.grisoft.com/doc/1

* Run SPYBOT SEARCH AND DESTROY/ CHECK FOR UPDATES/ IMMUNIZE and run a full system scan on a regular basis.

* Run AD-AWARE SE PERSONAL/ CHECK FOR UPDATES and run a FULL SYSTEM SCAN on a regular basis.

* Download and run SPYWARE BLASTER,
http://www.javacoolsoftware.com/
* Check for updates and enable all protection. This program will just sit in the background and help keep all the bad guys out.


* Download and install WINPATROL
http://www.winpatrol.com/download.html
* This program will warn you when any changes are being made to your system and give you the option to deny the change.


* IE-SPYAD is a one time install, it will put 1000s of bad sites in your IE Restricted Zone.
http://www.pcworld.com/downloads/file_down…23332&fileidx;=1



* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/ GO TO PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button
DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.

* Consider surfing the net with the FireFox Browser You can download via my signature.It has more features and is a lot
more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.
When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you
use this for awhile, you will want to make it your default.

* There companion THUNDERBIRD MAIL program was highly favored in PCWorld Magazine,, this to has a good spam filter
and is more secure than Outlook Express.
http://www.mozilla.org/products/thunderbird/

* Download and install CCleaner
http://www.ccleaner.com/
This is a very safe program that you should run about once a week to clean up your system. It will delete all your cookies as well, so if there are some that you need, the program has an option to save the ones you want.

* Now go to START/ CONTROL PANEL/ PERFORMANCE AND MAINTENANCE/ REARRAINGE PROGRAMS ON MY HARD DISK This is the disk defragmenter, it will put all your files in order so that your system will run faster. You should run it at least every 2 or 3 weeks.

Any questions, please post back. I will leave this thread open for you for a few days in case you need some help with the above programs.

Thanks for using Tom Coyote….and enjoy safe surfin….

Ken
Post #10
If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI