Internet explorer hijacked

Susan I used Kilbox. The file unist.exe is gone. Here is the Kapersky log Wednesday, July 05, 2006 10:22:32 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 6/07/2006 Kaspersky Anti-Virus database records: 192751 Scan Settings Scan using the following antivirus database standard Scan Archives true Scan Mail Bases true Scan Target My Computer A:\ C:\ D:\ E:\ F:\ Scan Statistics Total number of scanned objects 75578 Number of viruses found 1 Number of infected objects 1 / 0 Number of suspicious objects 0 Duration of the scan process 01:04:16 Infected Object Name Virus Name Last Action C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd001.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\McAfee.com\VSO\OASLogs\OAS.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Max Parris\Application Data\Microsoft\Outlook\Microsoft Outlook Internet Settings.srs Object is locked skipped C:\Documents and Settings\Max Parris\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Application Data\ApplicationHistory\NotifyAlert.exe.83a8f8c0.ini.inuse Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Application Data\ApplicationHistory\RssReader.exe.d1c9b1ec.ini.inuse Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Application Data\Microsoft\Outlook\mailbox.PAB Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\History\History.IE5\MSHist012006070520060706\index.dat Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Temp\Perflib_Perfdata_8b8.dat Object is locked skipped C:\Documents and Settings\Max Parris\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Max Parris\ntuser.dat Object is locked skipped C:\Documents and Settings\Max Parris\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\itouch_crash_info.txt Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\00000002.ps1 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\00000002.ps2 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\00010003.ci Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\cicat.fid Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\cicat.hsh Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiCL0001.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiP10000.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiP20000.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiPT0000.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiSL0001.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiSP0000.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiST0000.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\CiVP0000.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\INDEX.000 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\propstor.bk1 Object is locked skipped C:\Program Files\Dell\Support\UI\Search\catalog.wci\propstor.bk2 Object is locked skipped C:\System Volume Information\catalog.wci\00000002.ps1 Object is locked skipped C:\System Volume Information\catalog.wci\00000002.ps2 Object is locked skipped C:\System Volume Information\catalog.wci\00010002.ci Object is locked skipped C:\System Volume Information\catalog.wci\cicat.fid Object is locked skipped C:\System Volume Information\catalog.wci\cicat.hsh Object is locked skipped C:\System Volume Information\catalog.wci\CiCL0001.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiP10000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiP20000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiPT0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiSL0001.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiSP0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiST0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\CiVP0000.000 Object is locked skipped C:\System Volume Information\catalog.wci\INDEX.000 Object is locked skipped C:\System Volume Information\catalog.wci\propstor.bk1 Object is locked skipped C:\System Volume Information\catalog.wci\propstor.bk2 Object is locked skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP942\A0203050.exe Infected: Trojan-Downloader.Win32.Zlob.vv skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP947\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Susan did you see this one C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP942\A0203050.exe Infected: Trojan-Downloader.Win32.Zlob.vv skipped Max

It looks good! We will get rid of that infected _restore file. I have got to call it a night and I will give you instructions tomorrow. The worst is over!

Good morning tenspeed23,

Here are the final clean-up instructions. Step 3 will take care of that infected _restore file. Enjoy your life in Chattanooga. We visited Chattanooga once and thought it was a wonderful place.

STEP 1.
======
Cleanmgr
To clean temporary files:

• Go > start > run and type cleanmgr and click OK
• Scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
• Click OK to remove those files.
• Click Yes to confirm deletion.

STEP 2.( Windows XP only)
======
Prefetch Folder
Open C:\Windows\Prefetch\
Delete All files in this folder but not the Prefetch folder

STEP 3.
======
System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

• Turn off System Restore.
• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

STEP 4.
======
DON’T BECOME OVERCONFIDENT WITH ANTIVIRUS APPLICATIONS INSTALLED!!!

http://forum.malwareremoval.com/viewtopic….39eba6ea0b5e8ee

Stay up to date on security patches and be extremely wary of clicking on links and attachments that arrive unbidden in instant messages and e-mail.

"The number one thing the majority of the malicious code we're seeing now does is disable or delete anti-virus and other security software," Dunham said. "In a lot of cases, once the user clicks on that attachment, it's already too late."

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
• Test your Firewall - Please test your firewall and make sure it is working properly.
  Test Firewall
  
  
• Visit Microsoft's Update Site Frequently - It is important that you visit Windows Updates regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  A tutorial on installing & using this product can be found here:
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  A tutorial on installing & using this product can be found here:
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  A tutorial on installing & using this product can be found here:
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
  
  
• More info on how to prevent malware you can also find here (By Tony Klein)

Follow this list and your potential for being infected again will reduce dramatically.

Thank you for allowing me to assist you.

Susan

Hi Susan I want to thank you for all your TIME in repairing my problem. You did a better than GREAT job in gettiing rid of the problem. Everything is back to normal. This is the first time that I can remember that I have had this kind of a problem. Most of the time I spend on the computer is buying closed end funds. I do a lot of research on the funds. There are around 635 closed end funds. I keep ss on all the funds updating them with a product named XLQ. This program goes to Yahoo or MSN and brings back all sort of data for my ss. Example. If I want the current mkt price for all 635 funds I can get that data in a few seconds from Yahoo. If I need some historical data that too can be brought over from Yahoo. There are many features that I use to let me keep up the all the funds. I have been buying closed end funds for around three years. I buy the funds for the dividends that each pays. Is there a way to rate this thread. I would like to give you 5 stars. If there are more I would give those. Again thanks. Max P.S. I have some of the products you recommended. Should I buy Ewido? That program looks good to me

Thank you very much! I am glad that I could help. I must also give credit to those who have spent much time teaching and training us and to TomCoyote and those who maintain this site. The teachers here are very knowledgeable and supportive in our efforts and also help us when we have questions. I would not be doing this without the support of them.

I like ewido since it complements the anti-virus program. I also like SpySweeper. You can view other the threads and see that we use these two a lot. We take advantage of using the free trials. Although because no application seems to get everything, I think it is also wise to do online scans once in awhile to check.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php