What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Newbie needing help !

35 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #46
  • Open Hijackthis > Click Misc Tools Section
  • Click Open Uninstall Manager
  • Scroll down to the yahoo entry that you want to remove and highlight it
  • click "delete this entry"
  • close hijackthis
==========================
I'im beginning to think that your problems are not malware related at all. Let's try uninstalling panda first and replace it with another AV for a while and see if your system's performance would do any better.

You could grab ONE of these

» Avast!
» AVG AntiVirus
» AntiVir
==========================
then please post back how your machine is doing after the changes. Thanks.
Post #47
Hi Sorry I didn't get back straight away but I did as you said and un installed panda and I wanted to give it a few days with my new anti virus before letting you know how my pc is behaving. Guess what ? It's like a ferrari !!! No sticking no lagging everything seems fine. I have asked panda for my money back but they are ignoring me. I have opted for the avg free anti virus but will upgrade at some point. Is there any particular anti virus you could reccomend me ? Once again thank you so much for your time and patience
Post #48
Hi, the AV program you have there performs well. If you would go for a paid one, I recommend Kaspersky AV or Nod32 can you post a final hijackthis log for final checkup and to see if panda didn't leave any left overs?
Post #49
Hi
Latest hjt log
Logfile of HijackThis v1.99.1
Scan saved at 15:23:01, on 11/09/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\ewido anti-spyware 4.0\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
C:\Program Files\Labtec Wireless Desktop\MulMouse.exe
C:\Program Files\Labtec Wireless Desktop\OSD.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SYSTEM32\cidaemon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\JON\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\nbj.exe"
O4 - Global Startup: Enable Labtec Wireless Desktop.lnk = C:\Program Files\Labtec Wireless Desktop\MagicKey.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137692788537
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC2BD0DA-2129-40C3-9DB6-9E55272C43EC}: NameServer = 62.241.162.200 62.241.163.201
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

Thanks for the advice on the anti virus.
Could you also tell me which of the programs I have downloaded whilst being helped by yourselves I should keep and which ones I need to remove I seem to have rather alot now !
What is the best way to keep my pc clean which programs should I be using regularly ?
Once again thank you for your help.
Post #50
Open hijackthis > choose scan only > tick the boxes beside these entries in bold

O20 - Winlogon Notify: avldr - C:\WINDOWS\

close ALL browsers and windows/programs that are running, leave only hijackthis running then click "Fix Checked"

Reboot
==========================
You can delete combofix.exe, haxfix.exe and hijackthis.exe from your desktop.

Open Windows Explorer by hitting your windows key + E at the same time.
*If you do not have a windows key, double click my computer > click the folders icon

Then navigate to these folders and delete them:

C:\WinPFind2
C:\RKR
C:\fixwareout

Empty your recycle bin

As for the other tools like ATF cleaner, you can also delete it but I suggest you keep it and use it regularly to clean up your temp files so you can free up some spaces that have been occupied by unnecessary programs and files.

As for Ewido, you can use its on demand scanner for free but you will not have the monitoring feature unless you'll buy it.

What is the best way to keep my pc clean which programs should I be using regularly ?


take a look at my post below.
==========================
Now that you're clean, we need to erase all possible older infected files that may still be lurking on your system.

System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.
  • Right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Reboot your System

Turn ON System Restore.
  • Right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • UN-Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
* Go to Start > Accessories > System Tools > System Restore > Create a New Restore Point
You can name the restore point anything you like, something that you can remember.

*hide system files:

Windows XP
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View Tab.
  • Under the Hidden files and folders heading select Do not show hidden files and folders.
  • Check the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.
================================================
Here are some free programs that can help you improve your pc's security.
  • Firewall Application - Systems nowadays really need a firewall to secure the over 65,000 ports in your system. Here are some free and good firewalls.

    » ZoneAlarm

    Note:**It is easy to setup and it is indeed a very good firewall**

    » Kerio

    Note: **Also a very good firewall and it almost uses NO resources.**

  • If you are using IE then I think it is time to change to Mozilla FireFox. Mozilla FireFox offers not only better security but it also has more features than IE
    Remember that sometimes you still need to use IE for certain sites like Microsoft Updates

  • AntiSpyWare Applications - This programs will deal with the Adwares, Spywares, hijackers and dialers in your system. It is recommended that you download, install and run at least 2 Antispyware applications.

    ­ »Adaware - This is a great free program by Lavasoft. It deals with spyware cookies, spywares, hijackers, dialers in your system. This is a must have program to keep your computer secure.
    ~You can download it from here
    ~There is a tutorial on how to use Adaware properly here

    »Spybot Search and Destroy - This is also a great Antispyware program by Patrick Kolla. It has a Tea-Timer feature which works like Spyware Guard. Use Tea-Timer only when you don't choose to install Spyware Guard.
    ~You can download it from here . Just choose a mirror and off you go.
    ~There is also a tutorial on how to use Spybot properly here

    Note: Make sure you update them at least once every two weeks or once a week.
  • Anti-Trojans- Trojans are programs that appear clean, good and entertaining on the outside but are very destructive when you open it. Here are some free programs that deals with trojans:

    »Ewido Anti-Malware- A very very good trojan detector. It is only a trial program and it offers realtime protection for 15 days and after that you can use its on-demand scanner for free. Remember to update its database after installing it.
    ~You can download it from here
    ~If automatic updates wont work you can download the manual updates here

    »A-squared- This is also a great program from Emsisoft. This is a freeware and you can use it to scan your systems for trojans and other forms of malware.
    ~You can download it here
  • MVPS Hosts file- The MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    ~You can get MVPS hosts file here
*****FOR MORE REALTIME PROTECTION*****

» Install SpyWare Blaster- It prevents the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
~You can download it from here
~You can read the tutorial on how to use Spyware Blaster here

» Install Spyware Guard- This is one of the best realtime protection programs that stops spyware before it is executed. It also prevents spyware from downloading in your system.
~You can download it from here
~You can read the tutorial on how to use Spyware Guard here

» Install WinPatrol - Also a necessary programs because this alerts you if an unknown program tries to install and run in your computer with your notice/approval. Mostly detects malicious Active X and malicious java script files.
~You can download it from here

» IESpyAds- A nice little program that can add almost 5000 restricted sites to IE so you will not be redirected to those "bad" sites.
~You can download it from here
~If you want to know how IEspyads work you can take a look at it here
~Please not that IESpyAds only works with IE

» Windows Update- Always check for updates of your operating system to keep yourself protected from its vulnerabilities.
~Get the updates from here

Pls. check out Tony Klein's article "How did I get infected in the first place?"

Remember: It is alright to have more than 3 antispyware applications and realtime protection but never more than 1 AntiVirus or more than 1 Firewall in your system. Always UPDATE your AntiVirus application and do a scan at least once a week together with your AntiSpyware applications to ensure that your system is clean.

Happy Safe Surfing
Post #51
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI