How do I kill this thing?

Hi. I would love some help on how to kill this trojan once and for all. Virtually everytime I use the computer my AVG software alerts me to a virus infection: Trojan Horse Clicker.6.BK The software does heal sn quarantine the trojan, but it simply comes back the next time I use the computer. How can I kill this thing and prevent it from coming back. I appreciate any help you could give. Thanks.

Go to: http://www.tomcoyote.org/hjt/
Click on the button on the left to download HijackThis.
Extract it to a permanent folder.
I use c:\Program Files\HJT\HijackThis.exe

It needs to be run from it's own folder so It can make backups.

Start HijackThis, click on "Do a system scan and save a log file".
A window should pop up that has you log file in it.
Copy and paste this into your reply.

Do not fix anything in Hijack this yet. Most of it is not harmful and fixing something needed can do damage.

m

Hi safelrdev,

I am done looking over your log.

You are running multiple anti-virus programs (AVG and Bit Defender), which is a problem because they may interfere with each other.
Please choose one to keep and set the other not to run at startup or uninstall it.

Your appears to be clean. I have noticed that you have run several online scans.

Are you still having trojan problems?

Can you tell me the full path and name of the file being detected as a trojan?

• Clean out temporary files:
  • ClickStart->Run
  • Type cleanmgr and press enter.
  • Let it scan your system for files to remove.
  • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
  • Click "OK" to remove them.
  • Click "Yes" to confirm the deletion.
• Let's take a more thorough look with an MWAV scan.
  
  Click here to download mwavscan.
  • Double-click it to run it.
  • Read then accept the agreement.
  • Check Drive, and select all local drives, scan all files, then press 'scan'. (This may take a while and will not fix anything)
  • Once it finds something, it will prompt you so click OK.It is not necessary to buy the program
  • When it is completed, anything found will be displayed in the lower pane.
  • Highlight the lower pane only, copy it (CTRL+C), and paste (CTRL+V) it in your next reply. Along with a new HijackThis Log

m

Dear M. First of all, thanks. Second, the exact virus that AVG keeps finding is C:\_RESTORE\ARCHIVE\FS794.CAB Trojan horse Clicker.6.BK Third, I ran cleanmgr Finally, I ran the the MicroWave Scan. Scary results, but here they are. Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Roings Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VM.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VMInstaller.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\roing17.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\jao.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\SYSTEM\a.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\mfc42.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\msvcrt.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\olepro32.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\bitdefender.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTSVCCDA.EXE". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTSVCCTL.EXE". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWIN32.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWLIB.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWRITR.DRV". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\ECBTEG.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\EBPPORT.DAT". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VM.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VMInstaller.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\roing17.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\jao.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\a.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\bitdefender.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\Update_OB\realsched.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\bullet.gid". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\AIFFFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\AUFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\MOVFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\MPEGFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\Cdooff.ItemType.1" refers to invalid object "{9EFBF860-5685-11D3-AA3D-00C04F4C5275}". Action Taken: No Action Taken. Entry "HKCR\Cdooff.ItemType" refers to invalid object "{9EFBF860-5685-11D3-AA3D-00C04F4C5275}". Action Taken: No Action Taken. Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\RealDownloadExpress.InfoWindow.1" refers to invalid object "{56336BCA-3D8A-11d6-A00B-0050DA18DE71}". Action Taken: No Action Taken. Entry "HKCR\RealDownloadExpress.InfoWindow" refers to invalid object "{56336BCA-3D8A-11d6-A00B-0050DA18DE71}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken. File C:\WINDOWS\QHVU.0LL infected by "Trojan-Downloader.Win32.Lemmy.u" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Inl.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Knk.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Ias.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Nkc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Acq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Sbc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Rka.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Ado.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Idh.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Tmm.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Rls.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Vfp.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Aqq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Pug.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Tjc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Tlh.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\mskplb.dll tagged as "not-a-virus:AdWare.Ipend". Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\msjpok.dll infected by "Trojan-Dropper.Win32.Siboco.d" Virus! Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\msiaih.dll tagged as "not-a-virus:AdWare.Ipend". Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\mscjjn.dll tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\mskplb.dll tagged as "not-a-virus:AdWare.Ipend". Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\msjpok.dll infected by "Trojan-Dropper.Win32.Siboco.d" Virus! Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\msiaih.dll tagged as "not-a-virus:AdWare.Ipend". Action Taken: No Action Taken. File C:\WINDOWS\SYSTEM\mscjjn.dll tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\calc.exe infected by "Trojan-Downloader.Win32.Small.apd" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Downloaded Program Files\MediaAccX.dll tagged as "not-a-virus:AdWare.WinAD.ak". Action Taken: No Action Taken. File C:\WINDOWS\QHVU.0LL infected by "Trojan-Downloader.Win32.Lemmy.u" Virus! Action Taken: No Action Taken. File C:\WINDOWS\wt\wtvh.dll tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken. File C:\WINDOWS\Inl.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Knk.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Ias.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Nkc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Acq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Sbc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Rka.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Ado.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Idh.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Tmm.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Rls.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Vfp.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Aqq.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Pug.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Tjc.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\WINDOWS\Tlh.html infected by "Trojan-Clicker.Win32.Spywad.b" Virus! Action Taken: No Action Taken. File C:\My Documents\My Documents old files\MALIA\1.exe infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\My Documents\My Documents old files\MALIA\2.exe infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\My Documents\My Documents old files\MALIA\3.exe infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\Program Files\Yahoo!\YPSR\Quarantine\20040905190030570.zip infected by "Trojan-Downloader.Win32.Adroar" Virus! Action Taken: No Action Taken. File C:\Program Files\Yahoo!\YPSR\Quarantine\20040905190032050.zip tagged as "not-a-virus:AdWare.DelphinMediaViewer.h". Action Taken: No Action Taken. File C:\Program Files\Yahoo!\YPSR\Quarantine\ppq7331.TMP tagged as "not-a-virus:AdWare.WinAD.am". Action Taken: No Action Taken. File C:\TEMP\sahagent-cdt1004.exe tagged as "not-a-virus:AdWare.Sahat.m". Action Taken: No Action Taken. File C:\Wildmedia324.exe infected by "Trojan-Downloader.Win32.Agent.ac" Virus! Action Taken: No Action Taken. Let me know what's next. I appreciate everything. Safelrdev

Don't Panic

MicroWave scans are indeed scary looking, but it's nothing we can't handle.

3 of the problems are in Yahoo's quarantined items.
Emptying the quarantined items should take care of those.

For the rest, Please follow these instructions.

If you have any questions, please ask before running these steps.


Please download Killbox by Option^Explicit and save it to your desktop.

We are going to use this program to get rid of these hard to delete files.

• Run Killbox.exe.
• Select "Delete on Reboot".
• Copy the file names below to the clipboard by highlighting everything in the code box below then press CTRL + C
  
  

  C:\WINDOWS\QHVU.0LL
  C:\WINDOWS\Inl.html
  C:\WINDOWS\Knk.html
  C:\WINDOWS\Ias.html
  C:\WINDOWS\Nkc.html
  C:\WINDOWS\Acq.html
  C:\WINDOWS\Sbc.html
  C:\WINDOWS\Rka.html
  C:\WINDOWS\Ado.html
  C:\WINDOWS\Idh.html
  C:\WINDOWS\Tmm.html
  C:\WINDOWS\Rls.html
  C:\WINDOWS\Vfp.html
  C:\WINDOWS\Aqq.html
  C:\WINDOWS\Pug.html
  C:\WINDOWS\Tjc.html
  C:\WINDOWS\Tlh.html
  C:\WINDOWS\SYSTEM\mskplb.dll
  C:\WINDOWS\SYSTEM\msjpok.dll
  C:\WINDOWS\SYSTEM\msiaih.dll
  C:\WINDOWS\SYSTEM\mscjjn.dll
  C:\WINDOWS\SYSTEM\mskplb.dll
  C:\WINDOWS\SYSTEM\msjpok.dll
  C:\WINDOWS\SYSTEM\msiaih.dll
  C:\WINDOWS\SYSTEM\mscjjn.dll
  C:\WINDOWS\Downloaded Program Files\calc.exe
  C:\WINDOWS\Downloaded Program Files\MediaAccX.dll
  C:\WINDOWS\QHVU.0LL
  C:\WINDOWS\wt\wtvh.dll
  C:\WINDOWS\Inl.html
  C:\WINDOWS\Knk.html
  C:\WINDOWS\Ias.html
  C:\WINDOWS\Nkc.html
  C:\WINDOWS\Acq.html
  C:\WINDOWS\Sbc.html
  C:\WINDOWS\Rka.html
  C:\WINDOWS\Ado.html
  C:\WINDOWS\Idh.html
  C:\WINDOWS\Tmm.html
  C:\WINDOWS\Rls.html
  C:\WINDOWS\Vfp.html
  C:\WINDOWS\Aqq.html
  C:\WINDOWS\Pug.html
  C:\WINDOWS\Tjc.html
  C:\WINDOWS\Tlh.html
  C:\My Documents\My Documents old files\MALIA\1.exe
  C:\My Documents\My Documents old files\MALIA\2.exe
  C:\My Documents\My Documents old files\MALIA\3.exe
  C:\TEMP\sahagent-cdt1004.exe
  C:\Wildmedia324.exe

• Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
• Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt. If your computer does not restart automatically, please restart it manually.

After this please post a new MWAV scan as you did before. As well as a current HijackThis log.

m

Dear M. I emptied the quarantine file on Yahoo and I used the KillBox as you directed. Here is the new MWV scan. It still looks scary to me, but it listed "only" 15 viruses this time, down from over 50 the first time. Again, thanks. Safelrdev Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Roings Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VM.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VMInstaller.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\roing17.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\jao.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\SYSTEM\a.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\mfc42.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\msvcrt.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\olepro32.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\bitdefender.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTSVCCDA.EXE". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTSVCCTL.EXE". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWIN32.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWLIB.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWRITR.DRV". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\ECBTEG.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\EBPPORT.DAT". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VM.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VMInstaller.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\roing17.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\jao.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\a.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\bitdefender.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\Update_OB\realsched.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\bullet.gid". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\AIFFFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\AUFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\MOVFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\MPEGFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\Cdooff.ItemType.1" refers to invalid object "{9EFBF860-5685-11D3-AA3D-00C04F4C5275}". Action Taken: No Action Taken. Entry "HKCR\Cdooff.ItemType" refers to invalid object "{9EFBF860-5685-11D3-AA3D-00C04F4C5275}". Action Taken: No Action Taken. Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\RealDownloadExpress.InfoWindow.1" refers to invalid object "{56336BCA-3D8A-11d6-A00B-0050DA18DE71}". Action Taken: No Action Taken. Entry "HKCR\RealDownloadExpress.InfoWindow" refers to invalid object "{56336BCA-3D8A-11d6-A00B-0050DA18DE71}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\MSKPLB.0 tagged as "not-a-virus:AdWare.Ipend". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\MSJPOK.0 infected by "Trojan-Dropper.Win32.Siboco.d" Virus! Action Taken: No Action Taken. File C:\_RESTORE\TEMP\MSIAIH.0 tagged as "not-a-virus:AdWare.Ipend". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\MSCJJN.0 tagged as "not-a-virus:AdWare.180Solutions". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\CALC.0 infected by "Trojan-Downloader.Win32.Small.apd" Virus! Action Taken: No Action Taken. File C:\_RESTORE\TEMP\MEDIAA~1.0 tagged as "not-a-virus:AdWare.WinAD.ak". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\WTVH.0 tagged as "not-a-virus:AdWare.WildTangent.b". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\WILDME~1.0 infected by "Trojan-Downloader.Win32.Agent.ac" Virus! Action Taken: No Action Taken. File C:\My Documents\My Documents old files\MALIA\1.exe infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\My Documents\My Documents old files\MALIA\2.exe infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\My Documents\My Documents old files\MALIA\3.exe infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken.

It still looks scary to me, but it listed "only" 15 viruses this time, down from over 50 the first time.

Actually, It's even better than that. Most of what's left is in a System restore point which we'll flush out after we are done with the fixing process.

Looks like Killbox had trouble with a few , lets give it another try.

• Run Killbox.exe.
• Select "Delete on Reboot".
• Copy the file names below to the clipboard by highlighting everything in the code box below then press CTRL + C
  
  

  C:\My Documents\My Documents old files\MALIA\1.exe
  C:\My Documents\My Documents old files\MALIA\2.exe
  C:\My Documents\My Documents old files\MALIA\3.exe
  

• Return to Killbox, go to the File menu, and choose "Paste from Clipboard".
• Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt. If your computer does not restart automatically, please restart it manually.

Do you know what this folder is?
C:\My Documents\My Documents old files\MALIA\

If not, after the Kill box step please delete the entire folder.

After theses steps, please post a new MWAV scan, so we can see whats left.
m

Dear M, I ran KillBox to get rid of the files you told me to. Then, I deleted the Malia folder from old files. Finally, I re-ran MWAV and here is the log. Let me know what's next. Thanks for the help and the optimism. Safelrdev Object "HuntBar Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "AltNet Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "Roings Spyware/Adware" found in File System! Action Taken: No Action Taken. Object "iSearch Spyware/Adware" found in File System! Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VM.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VMInstaller.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\roing17.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\jao.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\SYSTEM\a.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\mfc42.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\msvcrt.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINNT\System32\olepro32.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\bitdefender.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\ModuleUsage" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTSVCCDA.EXE". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\CTSVCCTL.EXE". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\RdxIE.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWIN32.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWLIB.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\PDFWRITR.DRV". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\ECBTEG.DLL". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\EBPPORT.DAT". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VM.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\VMInstaller.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\roing17.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\jao.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\SYSTEM\a.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\bitdefender.ocx". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\Update_OB\realsched.exe". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\Real\GToolbar\BarControl.dll". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\Program Files\Common Files\AOL\AOL Toolbar\bullet.gid". Action Taken: No Action Taken. Entry "HKLM\Software\Microsoft\Windows\CurrentVersion\SharedDlls" refers to invalid object "C:\WINDOWS\Downloaded Program Files\MediaAccX.dll". Action Taken: No Action Taken. Entry "HKCR\CLSID\{C1A8AF25-1257-101B-8FB0-0020AF039CA3}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{1EFD6A40-3999-11CF-9150-00AA0059F70D}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{3775D2E0-7C5D-11CF-899E-00AA00688B10}" refers to invalid object "E:\PROGRAM\32\MCI32.OCX". Action Taken: No Action Taken. Entry "HKCR\CLSID\{FA010552-4A27-4cb1-A1BB-3E2D697F1639}" refers to invalid object "C:\PROGRAM FILES\INTERMUTE\SPYSUBTRACT\SSHOOK.DLL". Action Taken: No Action Taken. Entry "HKCR\AIFFFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\AUFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\MOVFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\MPEGFILE" refers to invalid object "{00022601-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic.1" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\Plenoptic.Plenoptic" refers to invalid object "{607C27E9-AB27-11d3-A116-A0EA50C10801}". Action Taken: No Action Taken. Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer.1" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\WMDMPDAExplorer.WMDMPDAExplorer" refers to invalid object "{939438A9-CF0F-44d8-9140-599736F0D3A2}". Action Taken: No Action Taken. Entry "HKCR\Cdooff.ItemType.1" refers to invalid object "{9EFBF860-5685-11D3-AA3D-00C04F4C5275}". Action Taken: No Action Taken. Entry "HKCR\Cdooff.ItemType" refers to invalid object "{9EFBF860-5685-11D3-AA3D-00C04F4C5275}". Action Taken: No Action Taken. Entry "HKCR\MailFileAtt" refers to invalid object "{00020D05-0000-0000-C000-000000000046}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\mapifvbx.object.1" refers to invalid object "{41116C00-8B90-101B-96CD-00AA003B14FC}". Action Taken: No Action Taken. Entry "HKCR\RealDownloadExpress.InfoWindow.1" refers to invalid object "{56336BCA-3D8A-11d6-A00B-0050DA18DE71}". Action Taken: No Action Taken. Entry "HKCR\RealDownloadExpress.InfoWindow" refers to invalid object "{56336BCA-3D8A-11d6-A00B-0050DA18DE71}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\ComPlusMetaData.MsCorHost.2" refers to invalid object "{727CDF4F-3BA0-11D3-8738-00C04F79ED0D}". Action Taken: No Action Taken. Entry "HKCR\SymWriter.pdb" refers to invalid object "{520DC67A-752E-11D3-8D56-00C04F680B2B}". Action Taken: No Action Taken. File C:\_RESTORE\TEMP\A0284833.CPY infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\_RESTORE\TEMP\A0284834.CPY infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken. File C:\_RESTORE\TEMP\A0284835.CPY infected by "Trojan.Win32.Dialer.k" Virus! Action Taken: No Action Taken.

Your MWAV scan looks good to me. Please post a HijackThis log for me to look at. After which, provided we find nothing new in your log, I will post some recommendations for keeping your system clean. m

Your Hijack This log looks clean too!

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

1. Right-click My Computer and then click Properties.
2. On the Performance tab, click File System
3. On the Troubleshooting tab, click to select Disable System Restore
4. Click OK twice
5. Restart your computer.

6. Right-click My Computer and again click Properties
7. On the Performance tab, click File System
8. Clear the check mark in Disable System Restore check box.
9. System Restore is now be active again.


Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. You should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Dear M. I have finished up. As to your suggestions, I do have adaware, spybot, spyguard, spyblaster already installed and use them regularly. I have Symantec's antivirus program. These work a bit, but still I keep having issues from time to time. As to the firewall, I will set one up. I have had one before, but I kept having problems with it. It blocked out things I wanted as well as things I didn't. I guess I have to spend more time learning to use it, but it's heard to learn them on the fly. Thanks for all your help. I appreciate it. safelrdev

Your Welcome.

I find Zone Alarm by Zonelabs is pretty easy to use.

http://www.zonelabs.com/store/content/home.jsp

Cheers,

m

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418