Check the path to the CWS files that are reported by Trend Housecall. I suspect that they are in the Recycle Bin. If they are then that are all the files that we have deleted during the cleanup.
To get rid of them please go to Recycle Bin and right click it. Select Empty Recycle Bin Click Yes. We wil do a more thorough cleanup in a little while.
Step#2:Scan With HijackThis and Post In Forum
1. Scan again with HijackThis
2. POST your log file to see if there is anything left to fix
There is an optional fix that can be done but otherwise it looks clean.
Viewpoint is showing up on this new log. Viewpoint Manager is a media player often bundled with AIM software. It is not technically considered malware, but is borderline adware and is often installed without a user's knowledge. ViewPoint Toolbar will hijack your search queries and also transmits non personally identifiable information back to their servers
I recommend that you remove it.
Here we go:
End process C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE using Ctrl+Alt+Delete.
Go to Add/Remove Programs and remove Viewpoint.
Then go to C:\PROGRAM FILES\VIEWPOINT and delete the folder.
Reboot.
Now I want you to clean up some loose ends and take some precautions to avoid being re-infected
If you reconfigured Windows to show hidden files you should reset this to its original state using the instructions from here
Clean out Temporary Files etc. Download System Security Suite from http://www.igorshpak.net/software/3ssetup104.zip. Extract it from the zip file into a folder and double click on sss.exe. Check the boxes under the 'Items to Clear' tab and click 'Clear Selected Items'. Reboot when prompted. It is a good idea to do this every few weeks as a lot of junk collects there over time.
. Disable and Enable System Restore.
You are using Windows ME and you should disable and re-enable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
You can find instructions on how to enable and re-enable system restore here:
Always use a anti-virus program and KEEP IT UPDATED
It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
This alone can save you a lot of trouble with malware in the future.
Always use a firewall.
I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is susceptible to being hacked and taken over. I am very serious about this and see it happen to often with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
Be restrictive with granting access to the internet. If you are unsure if the program really needs the access, test it by denying the access and see if this has any negative effects. If not, make the block permanent.
Never run two Antivirus programs or two Firewalls at the same time. They can interfere with each other and cause problems.
MOST IMPORTANT : You Need to keep “Windows” and "Internet Explorer” updated. Open ‘Internet Explorer” and go to”Start”> "Tools" menu > "Windows Update" or go to Microsoft Windows and Internet Explorer Updates to get the critical updates.
If you are running Microsoft Office, or any portion thereof you must keep it updated as well. Go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed. Update MS Office here.
You will find more about how to protect yourself as well as suggested programs for this purpose HERE. PLEASE READ IT AND FOLLOW THE RECOMMENDATIONS TO PROTECT YOURSELF.
Update all these programs regularly - Make sure you update all the the protection programs regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
It is worth while to take a look at "So how did I get infected in the first place? for some good advice.
Follow this list and your potential for being infected again will reduce dramatically.
I would also advise you to cahnge any passwords that you have used with this computer. Some programs from CoolWebSearch have been found to steal information and sending it back to outside servers. CoolWebSearch is the group behind the infection that we just got rid of. :rant:
It has been a pleasure to work with you and I am glad if I was able to help you.
Hey E….
So happy to be rid of all of that!
I really appreciate all of your hard work! I know that I am only one of the many that you were likely working with. You did a great job and all of the time you committed is very much appreciated!
I have printed out all the different steps to protect my laptop and will work on that tonight.
Thanks for the tip to use mozilla. My husband tells me that all the time and I have begun to do so. It is different, of course, and we all hate change…..but I will persist….
What a wonderful service you and this website provides to all of us strugging through virus land out here….
It's been a pleasure working with you as well….
Take care……off to make a donation!
kmount
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.
Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.
No spyware found when I ran Trend Micro program….
Also, nothing there is recycle bin….
Here's log from Hijackthis….
Logfile of HijackThis v1.99.1
Scan saved at 2:38:48 PM, on 8/8/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\SYSTEM\MSTASK.EXE
C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\IRMON.EXE
C:\WINDOWS\SYSTEM\RESTORE\STMGR.EXE
C:\PROGRAM FILES\LINKSYS\ODYSSEY CLIENT FOR LINKSYS\ODTRAY.EXE
C:\PROGRAM FILES\VIEWPOINT\VIEWPOINT MANAGER\VIEWMGR.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\PROGRAM FILES\LINKSYS\WIRELESS-G NOTEBOOK ADAPTER\WPC54CFG.EXE
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\WBEM\WINMGMT.EXE
C:\WINDOWS\SYSTEM\PSTORES.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE
C:\HIJACKTHIS.EXE
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IrMon] irmon.exe
O4 - HKLM\..\Run: [PCHealth] C:\WINDOWS\PCHealth\Support\PCHSchd.exe -s
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [OdTray.exe] "C:\Program Files\Linksys\Odyssey Client for Linksys\OdTray.exe"
O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [*StateMgr] C:\WINDOWS\System\Restore\StateMgr.exe
O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE
O4 - HKCU\..\Run: [Tracks Eraser Pro] C:\Program Files\Acesoft\Tracks Eraser Pro\te.exe min
O4 - Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Ada pter\WPC54CFG.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: MSN Messenger Service - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\MESSEN~1\MSMSGS.EXE
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 4.2.2.1,4.2.2.2,4.2.2.3
Could it be we've slayed the virus????? 
Here's hoping…….kmount
