15 replies to this topic

[Dak]

Hello TimeSink, and welcome to TomCoyote forums. I'm dak, and I'll be helping you to fix your computer.

I'm sorry for the delay in replying to your log. If you still require assistance, please do the following:

----------

You are running HijackThis whilst it is still zipped; please right-click on the zipped file, and select "extract all"/"extract here" to unzip it.

Then, if HijackThis doesn't automatically put itself into its own folder, please right-click on an empty area of your desktop and select new > folder. Then, drag the HijackThis icon into the new folder.

----------

Now, please run HijackThis and click on the "Open the misc tools section".

Next, Click on "open uninstall manager"

Then Click "save list". This should create a log called "uninstall_list.txt".



Please post the contents of "uninstall_list.txt", along with a new HijackThis log, as a reply to this thread.

[Dak]

You may want to print out these instructions for reference, since you will have to restart your computer during the fix.

Please download AproposFix from here:
http://swandog46.gee.../aproposfix.exe

Save it to your desktop but do NOT run it yet.


Then please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.


Once in Safe Mode, please double-click aproposfix.exe and unzip it to the desktop. Open the aproposfix folder on your desktop and run RunThis.bat. Follow the prompts.

When the tool is finished, please reboot back into normal mode, and post a new HijackThis log, along with the entire contents of the log.txt file in the aproposfix folder.

[Dak]

Well, the main infection seems to have gone without a fuss

There are a few 'optionals' in this fix, so make sure to read the notes below, decide which (if any) of the optionals that you wish to keep, and skip any of the entries that relate to programs that you wish to keep.

wildtangent: Collects information from your PC (as it says it will in its licence); however, this can sometimes be installed without the users knowledge, which leads some to classify it as spyware. If you did not install it yourself and wish to uninstall it, please follow the instructions in

Viewpoint: Viewpoint is bundled with other software; unless you installed it yourself, I'd advise removing it

backweb: see here


----------

1) Deactivate realtime protection

We need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes that we need to make.

Open Microsoft AntiSpyware.
Click on Tools, Settings.
In the left pane, click on Real-time Protection.
Under Startup Options uncheck Enable the Microsoft AntiSpyware Security Agents on startup (recommended).
Under Real-time spyware threat protection uncheck Enable real-time spyware threat protection (recommended).
After you uncheck these, click on the Save button and close Microsoft AntiSpyware.
Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

We also need to deactivate your TrendMicro Anti-Spyware real-time protection:

Open TrendMicro Anti-Spyware
Click on 'options' (up the top)
Click on the little + next to 'venus spy trap'
Click on all of the green ticks, so that they become red x's (except for the 'open venus spytrap') to deactivate real-time protection
Click on OK


After all of the fixes are complete it is very important that you enable Real-time Protection again.


----------

2) Uninstalling with add/remove programs

Please go to start > settings > control panel, and double-click 'add/remove programs'.

Click the 'remove' button next to each of the following:

Viewpoint Manager (Remove Only)<--viewpoint
Viewpoint Toolbar (Remove Only)<--viewpoint
WildTangent Channel Manager<--wildtangent

Now please reboot before going on to step 2.

----------

3) Fixing with HijackThis

Please scan with HijackThis, and put a check-mark next to the following entries:


R3 - Default URLSearchHook is missing <--junk

O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program iles\Viewpoint\Viewpoint Toolbar\ViewBarBHO.dll <--viewpoint

O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll <--viewpoint

O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe <--viewpoint

O4 - Global Startup: hp centre.lnk = C:\Program Files\hp center\137903\Program\BackWeb-137903.exe <--Backweb

O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML <--viewpoint

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150...ip/RdxIE601.cab <--malware


Then, with all other windows and browsers closed (including this one), please click on the "fix checked" button.

----------

4) Show hidden files

Please set your computer to show hidden files, by doing this:

• Click Start.
• Open "My Computer"
• Select the "Tools" menu and click "Folder Options"
• Select the "View" Tab
• Under the "Hidden files and folders" heading select "Show hidden files and folders"
• Uncheck the "Hide protected operating system files (recommended)" option
• Click "Yes" to confirm
• Click "OK".

----------

5) Reboot into safe-mode

Please reboot into safe-mode by restarting your computer, and continually poking the F8 button whilst it is loading up.

In the menu that appears, use the arrows on your keyboard to select "safe mode" and press enter.

----------

6) Delete files and folders

Please delete any of the following files and folders, if they still exist:



C:\Program Files\Viewpoint<--folder<--viewpoint

C:\Program Files\hp center\137903\Program\BackWeb-137903.exe<--file<--backweb


C:\Program Files\WildTangent<--file <--Wild tangent

then reboot normally.

----------

7) Automatic scans


To finish cleaning, please update and scan with your anti-virus program (norton/symantec), microsoft anti-spyware and trendmicro antispyware, allowing them to fix anything that they find. Make a note of anything that they cannot fix

----------

Finally, please reboot, scan with HijackThis and make a new log. Post the new log as a reply to this thread.

Can you also check that ContextPlus is no longer present in your 'add/remove programs' list (accessable via start > settings > control panel)

[Dak]

Looking better

Please re-activate your real-time protection like this:

Open TrendMicro Anti-Spyware
Click on 'options' (up the top)
Click on the little + next to 'venus spy trap'
Click on all of the red x's, so that they become green ticks
Click on OK

----------

These HijackThis entries are not malware, but it may not be nessesary for them to start automatically when your computer boots, and they can slow down your computer; it is up to you wether you wish to keep or remove them. Any which you wish to remove, simply scan with HijackThis, put a check next to the entry(s) that you do not wish to retain, and (with all other windows shut), click "fix selected"


O3 - Toolbar: hp toolkit - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\HP\EXPLOREBAR\HPTOOLKT.DLL <--HP Explore Toolbar, leave it if you use it.

O4 - HKLM\..\Run: [BlockTracker] c:\hp\bin\BlockTracker.exe -<-If present on a HP machine it tracks all the processes and logs them to a blocklog.txt file

O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] c:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe <--"HP's exclusive Share-to-Web software makes it easy to share content with others through our affiliate Internet websites." In other words an application that allows users to upload scanned images to their personal webpages if desired. Available via Start -> Programs

O4 - HKLM\..\Run: [AutoTBar] C:\hp\bin\autotbar.exe <--If you disable the HP VIEW toolbar in IE and rarrange the toolbars on a reboot they will be back as they were before if this is left enabled

O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE <--Reminder to register Creative Labs SoundBlaster Live! cards

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime <--System Tray icon for Apple's "Quick Time" viewer

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot <--realplayer updater

O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook <--This is a DLL to enable multiple display monitors on a single computer. It can be a cause of numerous problems on some computers

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat7.0\Reader\reader_sl.exe <--Speeds up the time it takes to load the Adobe_Reader application. Your choice, but not required for Adobe Reader to function properly



How's your computer behaving now? Specifically, are you getting lots of pop-ups?

[Dak]

Happy Thanksgiving!

We don't celebrate thanksgiving over here in the UK... I'll have to wait untill christmas for the turkey-fest

Happy thanksgiving to you, though.

I haven't seen an unwanted popup since the initial run of HJT, I'm very impressed GREAT JOB!

My pleasure

And reguarding your latest HijackThis log...


All clean! Now, just a few steps to finish cleaning, some tidying up and some tips to prevent getting reinfected.


1) Flushing system restore

To remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

a. Turn off System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

b. Reboot.

c. Turn ON System Restore.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

-----------

2) Cleaning temp files

...incase some maliciouse files are hiding there.

Download and install CCleaner.

Double click the CCleaner icon, and make sure only the following are checked under the "windows" tab:

temporary internet files

empty recycle bin

temporary files

old prefetch data

Then click the 'applications' tab, and uncheck everything.


Now, click on "analyse" and then "run cleaner"

-----------

3) rehide hidden files

We need to make sure all hidden files are rehidden, to protect them from accidental harm.

Please:

* Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View Tab.
* Under the Hidden files and folders heading select "Do not show hidden files and folders".
* Check the "Hide protected operating system files (recommended)" option.
* Click Yes to confirm.
* Click OK.


-----------

4) Get rid of tools

You may as well delete the AproposFix folder, as you no longer need it.

-----------





Finally,

How to remain clean

If you have any questions about the steps below, please feel free to ask.

All of these programs are FREE. The writing in green is a brief explanation of why each step is necessary. It is not necessary for you to read the green writing to understand what to do, but it is included for if you wish to know what each program does.

Programs to download and install

Use a Firewall: Download and install either ZoneAlarm or Kerio.

These firewalls will ask for your permission before allowing a program to access the internet. Use common sense -- if you have just told a program to do something which involves accessing the internet (like updating, for example), then click 'allow'. Once you trust a program, click 'always allow'. Block programs which you are unsure of from accessing the internet.

***note -- be sure to turn off windows firewall, to stop it conflicting with your new firewall, by going to start > settings > control pannel, and double-clicking on 'windows firewall'; Click 'off; not reccomended', and then click 'OK' ***

Firewalls are important as they limit unauthorised remote-access to your computer over the internet and prevent, for example, a virus simply being sent strait to your PC. Two-way firewalls (like ZoneAlarm and Kerio) also limit the ability of programs on your computer accessing the internet without your permission. You should not run more than one firewall at once as they can interfere with each other, possibly preventing either of them from working.

Use a secure web-browser: There are two main ways to do this:

You can download and install Firefox

Or you can correctly configure internet explorer

Although of course there are many other browsers that you can chose from (Avant, Opera, K-melion, Slimbrowser, etc), I chose Firefox as the alternative browser to recommend simply because I find it very user friendly, very customisable and highly documented on the web (so that you can find help with any problems that you may have with it).

Secure web-browsers are important for two reasons: one, firewalls allow web-browsers to send and receive information over the internet, so they represent a possible way for malware to get past your firewall, and two, the majority of things that you do on the internet will be done with a web-browser, and for this reason malware often targets them, attempting to redirect your web-browser to advertisement sites, or to steal your bank details if you enter them. For these reasons, it is important to have a secure web-browser

Use anti-slyware programs: Download and install both of the following: Spywareblaster and Spyware Guard.

Make sure that you update these programs regularly.

Between them, TrendMicro AntiSpyware, spywareguard, spywareblaster and NoAdware will perform pretty-much the same function as an anti-virus program, but with one key difference -- whereas anti-virus programs are targeted at viruses, these programs are targeted at adware, spyware, diallers, browser-hijackers etc. Spyware Guard scans programs just before they run, and prevents any programs which it recognises as slyware from running, and Spywareblaster prevents your web-browser from downloading slyware active-x components and tracking cookies. Updating is important so that the anti-slyware programs have the latest lists of how to recognise slyware


Things you should do regularly

At least once a month (and preferably more frequently), do the following:

manually update your anti-virus and anti-slyware programs (TrendMicro, NoAdware, Spyware Guard and Spywareblaster_ by using the update button on the programs' main display. Once you have, Spywareblaster's 'enable all protection' button.

This is so that they have the latest list of how to recognise malware. Clicking on Spywareblaster's 'enable all protection' button will ensure that it is protecting you from the newer additions to there slyware lists.

Scan for malware: use your anti-virus software, NoAdware and TrendMicro to completely scan your computer for malware.

This is because, despite the protections which are in place on your computer, it is still possible to get infected by malware. Scanning every now-and-then should find any malware which has managed to 'slip through the net'.

Update windows: By visiting this site, or by the clicking 'windows update' in your start menu.

Security holes regularly get found in all different versions of windows. The update site releases 'patches', which fix the security holes, preventing malware from exploiting them


Extra things you can do, to prevent your computer slowing down to a crawl:

These aren't malware-related, but it is still advisable to do them regularly in order to keep your computer running smoothly.

Defragment your hard-drive: by clicking on the start menu, then going Programs --> Accessories --> System Tools --> Disk Defragmenter. Select 'analyse' and, if it suggests that you defragment your drive, click the 'defragment' button.

If a file on your computer needs to increase in size, but there is no free space near to it, then the file becomes split in two, being stored on two different locations on your hard-drive. This means that, when reading that file, the computer has to jump between two different locations on your hard-drive, slowing the computer down. 'Defragmenting' simply means moving files about so that the separate parts of a 'split' or 'fragmented' file are next to each other, forming one continuous file again.

Clean the junk off of your PC: Download CCleaner and, every now-and-then, run it.

Your PC accumulates a surprising amount of junk -- temporary files which are no longer needed, registry keys left behind by a poorly uninstalled program, information about a term you entered into a search box a year ago, etc etc etc. These bits of 'junk' can get in your way and possibly slow your computer down. CCleaner gets rid of them.

If the infection(s) which you originally had come back, please post again in this thread.

If, at any point in the future, you have reason to believe that you have become infected again, you can get rid of the infection by:

Updating TrendMicro, NoAdware, and your anti-virus program.

Scanning with the above three programs.

Telling the above programs to fix anything that they find.


If you still have reason to believe that you are infected, or if you get infected in the future, then please do not hesitate to use this forum again

Thank you.

[Dak]

Thanks you for additional information. Would you suggest the use of ZoneAlarm or Kerio over Microsoft's firewall? I am currently using MS Firewall which comes with the XP at Home system.

A firewall basically blocks unsolicited communication with computers over the internet; if your computer asks for, say, a website to be sent to it, then the firewall will allow the website to be sent to your computer for viewing -- if your computer doesnt, say, ask for a virus to be sent to it from a random infected computer, then the firewall will block the virus when it arrives.

i said 'if your computer asks for it' rather than 'if you ask for it' because an easy way around one-way firewalls (like the microsoft firewall) is to sneak a program onto someones computer that requests that the virus be delivered... the firewall would allow it to get onto your comupter, because 'your computer' has requested it.

Two-way firewalls -- like zonealarm and kiero -- ask for your permission before allowing programs to request that information be sent to your computer, thus going someway to thwarting the above trick.

short version: yes, id reccomend a two-way firewall like kiero or zonealarm over the windows firewall. like i said, remember to deactivate the windows firewall if you install another firewall, as multiple firewalls can conflict.

P.S. When I wished you a happy Thanksgiving, guess I should be "thankful" it wasn't the 4 of July

Yes, thats still a sore point in england, mainly due to what your doing to our language without our iron rule to stop you.

One more atrocity like the way you pronounce 'leisure' and 'aluminium', and we'll re-invade

[Dak]

I see that the ZoneAlarm has a ZoneAlarm Pro available for a fee which sounds like it might provide a similar service as Trend Micros spyware software. Do you have any recommendation along those lines?

You already have trendmicro, which is a very decent antislyware program.

Unfortunately, no antislyware program catches 100% of all slyware, so its advisable to have a second on-access and second on-demand slyware scanner.

ZonealarmPro would give you the second scanners... but you already have a second on-access scanner (spywareguard), and a second on-demand scanner (NoAdware), so you're already covered without any further expenditure.

The only other reccomendation that I'd make is to consider uninstalling NoAdware and replacing it with Adaware SE (free), simply because NoAdware used to give loads of false positives. They have apparently improved, but I'm not sure by how much; see here

The decision is yours, however.

And it's le-sher