ADWARE_BHOT_IEHELPER and Microsoft.Windows.Security.Internet Explorer

OK Obe, we worried for nothing, but Its better to be safe than sorry. There is no malware associated with that program, if that file were attached to another program, then it could be trouble.



So go ahead an enable the TeaTimer, here are some free tools and tips to help keep you more secure.


How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
Tom Coyote
TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


Thanks for using Tom Coyote I will keep this thread open for you for a few days in case you need to post back.

Glad I could help you,
Ken

Hi Ken, I was awaiting a response from you over this past week - up until until now - and had thought that events had overtaken you over there. I hadn't noticed (until tonight) that your last post on the 29th was on "page 2" … duh !!! OK … funnily enough I'd had to do a sytem restore mid-week to a point a few days earlier (but well after the two "infections" were noticed) and I noticed that somehow these two infection enties (the one with Trendmicro, and the other with Spybot) now seem to have disappeared and that "checked" box now remains permanently unchecked after the appropriate scans !!! (I had temporarily re-enabled TeaTimer for the Spybot scan) Not sure what happened but glad it did ! Have re-enabled teatimer permanently and further subsequent scans with the relevant anti-virus/malware software show no problems. The PandaScan had shown (and still shows those) three entries but the on-line scanner doesn't have a clean facility for them. Is there any way I can remove them manually ? Obe One Incidentally I couldn't originally "restore" to a previous infection-free state to solve the problem because System Restore didn't go back far enough !

This is the one program you kept and its ok HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C9-189F-421A-88CD-07CFE51CFF10}
Possible Virus. Not disinfected C:\Program Files\AOL\Active Security Monitor\SetupDLL.dll


The program is gone, these are leftover entries in the Registry, Potentially unwanted tool:application/mywebsearch Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Potentially unwanted tool:application/funweb Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Potentially unwanted tool:application/myway Not disinfected


What I would do is to download and install CCleaner, run the cleaner and than run the Issues scan that may clean out those entries since the program is gone.

If you don't want the Yahoo Toolbar, be sure to uncheck it during installation
Download and Install CCleaner
* Click on Run Cleaner
* Run the Issues Scan < – After it scans your system, when you click on the Fix button and it asks you to backup the Registry..Say Yes
Tutorial for CCleaner


Reboot your system and do this..

Go to Start> Run and type in regedit and hit enter on your keyboard.
Expand the window to make it more readable and navigate to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\

look for both these entries and delete them if present…be very careful and don't delete anything else.
{07B18EAB-A523-4961-B6BB-170DE4475CCA}
{98D9753D-D73B-42D5-8C85-4469CDA897AB}


Ken

Hi Ken, All your instructions actioned … CCleaner run etc … and registry entries deleted (I was VERY careful). I rebooted and re-ran the PandaScan and am still finding two (slightly) different entries from before … in addition to the AOL entry. Should I also delete these two using regedit as previously ? Obe The last PandaScan log is as follows … Incident Status Location Potentially unwanted tool:application/mywebsearch Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA} Potentially unwanted tool:application/myway Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{014DA6C9-189F-421A-88CD-07CFE51CFF10} Possible Virus. Not disinfected C:\Program Files\AOL\Active Security Monitor\SetupDLL.dll

You can download Easy Cleaner and run the registry cleaner. There may be many entries pointing to that program. You can try removing the new entry with Regedit like you did before. Run Panda again and see if its gone.

{07B18EA1-A523-4961-B6BB-170DE4475CCA}

EasyCleaner




The reason that this is showing up SetupDLL.dll is because depending on what program its running it could be bad, but with the AOL program your using, its ok.

Good Evening Ken (Well evening here in NI) Again, all your advices actioned … The PandaScan threw up another couple of entries which I deleted as before with RegEdit. A subsequent further PandaScan again threw up a further two entries which I again deleted with RE. I'm delighted to say that yet a further PandaScan was clear … as was a scan by all the other AV and anti-malware software on my PC. So …. I am now a happy bunny ! I found your link through to the Kenz page both helpful and interesting and I'm now working my way through that … to see if there's anything I'm missing or not already doing. So … very very many thanks from the Emeral Isle for all your patience, help and advices. Kind regards Obe

Hey Obe

Glad all is well I hope you learned something here about safe surfin, you need to be so careful what you download and the sites you go into. File sharing sites like Kazaa, Limewire and MySpace are are all bad news. When you download something you never know whats attached to it.


Here is my own cleanup list and somemore free programs to install. Install them all, keep them updated and you should be ok, just remember that you only want one AV program, the rest of the Spyware programs are all good to install, they won't bog you down and they all get along.



Here are some free programs and tips for keeping your system up to date, and to help keep all the riff raff out of your system.

Be sure to follow the instructions for System Restore because everything we removed is backed up in that program and if you ever use it to revert your system to an earlier date, you can reinfect your self all over again.


Download and Install CCleaner

* Click on Run Cleaner
* Run the Issues Scan < When it asks you to backup the Registry..Say Yes Tutorial for CCleaner


Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.

* Clean out your Temp Files
* This procedure should be run from Safemode for better results.


Boot into Safemode

* Go to Start> Shut off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to Safemode
* Then press the Enter Key on your Keyboard




* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.



Reboot your system normally


Close any instance of Internet Explorer and Windows Explorer.

• Go to Start> Control Panel> Internet Options . You shoud be on the General Tab
• Delete Cookies
• Delete Files > and offline content as well

Now Empty your Recycle Bin


System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

• Right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore on all Drives.
• Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

• Right-click My Computer.
• ClickProperties.
• Click the System Restore tab.
• UN-Check Turn off System Restore on all Drives.
• Click Apply, and then click OK.

• Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
  You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this

Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

Here are Free Anti-Virus Programs if you need one. Just install one because with AV software…MORE IS NOT BETTER.
* AVG Free Edition
* AntVir Personal Edition


* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.

* Spyware Blaster It will prevent most spyware from ever being installed.

* Spyware Guard It offers realtime protection from spyware installation attempts.

* Win Patrol This program will warn you when any changes are being made to your system and give you the option to deny the change.

* IE- Spyad IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

* Firefox Browser It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.

* Windows Updates Go to Start> Control Panel> Security Center> Windows Updates and check the radio button that says " Notify me but don't automatically download and install them "

* Go to Start> All Programs> Assessories > System Tools> Disk Defragmenter. This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.



Thanks for stopping by Tom Coyote , I'm glad I was able to help you.

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php