What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

gOHGKOG/IOGuYou infection

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
This doesn't cause any noticeable symptoms, I presume because it's a keylogger or PW stealer. After a reboot, there is a bunch of svchost.exe activity followed by a couple executables being created and executed (usually gOHGKOG.exe). Running misc spyware/malware/adware/virus scanners hasn't picked up anything. Most just delete the offending executable, which does nothing since it's regenerated on next boot.

At first glance, this HJT log looks similar to our other computer (which works fine). Any insight?

LeChuck

Logfile of HijackThis v1.99.1
Scan saved at 9:09:03 PM, on 11/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Prevx1\PXConsole.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: Loadout Manager.lnk = C:\Program Files\GameToys\nost_LM.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162530397109
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O21 - SSODL: System - {C661813C-2787-4456-83E4-C2BB13215B95} - dgflib.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
Post #2
LeChuck :D

Welcome to Tom Coyote


Do this…

Open HJT Scan Only, close your browser and all open windows, check this and click on Fix Checked.

O21 - SSODL: System - {C661813C-2787-4456-83E4-C2BB13215B95} - dgflib.dll (file missing)




Download Pocket Killbox to your desktop, unzip it to a folder that you can find

C:\windows\system32\dgflib.dll


Highlight the file with the complete path inside the Quote Box and press Ctrl C on your keyboard.
  • Open Pocket Killbox
  • Go to File > Paste from clipboard
  • Set it to Delete on Reboot
  • Tick the box that says End Explorer shell while killing file
  • If its not greyed out..Click the radio button that say Unregister .dll before deleting.
  • Make sure Single File is selected
  • Click on the Red circle with the white X
  • It will ask you to confirm the deletion…Say yes
  • It will ask you to reboot, say yes


Outside of that, your log doesn't look to bad :thumbup:



Run this system cleaner

Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up



Run this free online virus scanner from Panda, it may pick up some bad entires that are not showing up on your HJT log. It's important that I see the log so copy and paste it into your next reply along with a new HJT log please.
Panda ActiveScan <—-Accept default settings
Post #3
Hi there!

Prevx happened to randomly notice the dgflib.dll today and deleted it .. so that's taken care of. I've verified this file has been deleted and does not reappear across boot cycles. Anyway, here's the logs from the other steps you mentioned:

HJT log:
======
Logfile of HijackThis v1.99.1
Scan saved at 10:59:05 PM, on 11/6/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\Program Files\GameToys\nost_LM.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - Startup: Loadout Manager.lnk = C:\Program Files\GameToys\nost_LM.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162530397109
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: HDYZMBOCDL - Unknown owner - C:\DOCUME~1\VALENT~1\LOCALS~1\Temp\HDYZMBOCDL.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)

ActiveScan log:
==========
Incident Status Location

Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.advertising.com/]
Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.belnk.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.peel.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.errorsafe.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.terra.com.br/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.atwola.com/]
Virus:Bck/HacDef.EQ Disinfected C:\WINDOWS\rundll.exe
Post #4
LeChuck :D

Your HJT log is very lean, are you running the program in normal windows or safemode, I need to see it in normal windows.
  • Go to Start> Run and type in services.msc then press Enter
  • Scroll down to HDYZMBOCDL
  • Double Click that service to open it.
  • Click on Stop Service.
  • Then change the Startup Type to Disabled.
  • OK your way out of the program.
  • Open HJT > Misc Tools > Delete an NT Service
  • Type in HDYZMBOCDL
  • Then click on OK, it will ask you to reboot, do so.


Then with your browser closed as are all open windows, remove this entry with HJT
O23 - Service: HDYZMBOCDL - Unknown owner - C:\DOCUME~1\VALENT~1\LOCALS~1\Temp\HDYZMBOCDL.exe (file missing)



Download and install the 30 day trial of AVG Anti Spyware to your desktop.
  • Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
IMPORTANT: Do not open any other windows or programs while AVG is scanning, it may interfere with the scanning process:
  • Launch AVG-Anti-Spyware by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG

Let me see the AVG report and a New HJT log please
Post #5
Hello again,

Looks like my initial logs were before I uninstalled the AVG virus/spyware utilities .. so that may account for some of the missing entries in my second log posting (sorry for potential confusion). All of these logs are coming from normal mode (as opposed to safe mode). The updated logs are below, per your request.

BTW - What is the name of this infection we're dealing with? I can't seem to find any meaningful results when searching for these exe/dll names. I'm also curious which of these files we're cleaning off are the root cause of the infection, and which ones are just symptoms of the infection. Any info on this would be great.

AVG spyware scan log:
===============
———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 4:12:52 PM 11/7/2006

+ Scan result:



:mozilla.45:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Valentine\Cookies\valentine@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.84:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Addynamix : Cleaned.
:mozilla.151:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.152:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Adserver : Cleaned.
:mozilla.170:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.171:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.172:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.173:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.16:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.100:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.20:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.21:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.22:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.23:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.24:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.83:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.96:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.97:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.98:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.99:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.17:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.18:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.19:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.176:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.178:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.179:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.180:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.189:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.190:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.
:mozilla.191:C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt -> TrackingCookie.Zedo : Cleaned.

::Report end

HJT log:
======
Logfile of HijackThis v1.99.1
Scan saved at 4:16:37 PM, on 11/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Prevx1\PXConsole.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\GameToys\nost_LM.exe
C:\WINDOWS\system32\ati2sgag.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Startup: Loadout Manager.lnk = C:\Program Files\GameToys\nost_LM.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162530397109
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
Post #6

BTW - What is the name of this infection we're dealing with?

From what I can see its some sort of downloader trojan, but its gone now :thumbup:


Lets do a couple of things, I would like you to run the Combofix tool, it most likely wont clean anything because your log looks fine, but I need to see the report. Post the whole report, what I am interested in seeing is files that have been created in the last 30 days.


Please download ComboFix by sUBs from either of these two locations

BleepingComputerComboFix
TechSupportForumComboFix
  • Double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply along with a new HJT log please.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.




Run this free online virus scanner from Panda, it may pick up some bad entires that are not showing up on your HJT log. It's important that I see the log so copy and paste it into your next reply.
Panda ActiveScan <—-Accept default settings
Post #7
The latest logs are below, per your request.

So for my understanding, what is the general process that was causing these files to get executed after boot? From the steps we've done, it seems like we've mainly just deleted the offending files. Not sure I see what was actually causing them to get executed. I presume it's indirect somehow (or possibly related to the entry in HJT, which I don't fully understand), but any info would be great.


Valentine - 06-11-07 19:49:58.93 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Valentine\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-10-07 to 2006-11-07 ))))))))))))))))))))))))))))))))))


2006-11-07 15:44 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-03 16:17 9,728 –a—— C:\WINDOWS\system32\drivers\pxscinst.dll
2006-11-03 16:17 7,680 –a—— C:\WINDOWS\system32\drivers\pxinst.dll
2006-11-03 16:17 7,552 –a—— C:\WINDOWS\system32\drivers\pxcom.sys
2006-11-03 16:17 272,256 –a—— C:\WINDOWS\system32\drivers\pxfsf.sys
2006-11-03 16:17 18,560 –a—— C:\WINDOWS\system32\drivers\pxtdi.sys
2006-11-03 16:17 13,568 –a—— C:\WINDOWS\system32\drivers\pxrd.sys
2006-11-03 16:17 11,648 –a—— C:\WINDOWS\system32\drivers\pxscrmbl.sys
2006-11-03 16:17 100,864 –a—— C:\WINDOWS\system32\drivers\PxEmu.sys
2006-11-02 23:08 22,752 –a—— C:\WINDOWS\system32\spupdsvc.exe
2006-11-02 23:07 18,200 –a—— C:\WINDOWS\system32\wups2.dll
2006-10-08 14:20 28,672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-07 19:47 ——– d——– C:\Program Files\Prevx1
2006-11-07 15:31 ——– d——– C:\Program Files\Trillian
2006-11-06 22:43 ——– d——– C:\Program Files\SmartFTP
2006-11-06 22:37 ——– d——– C:\Program Files\Internet Explorer
2006-11-06 22:35 ——– d——– C:\Program Files\GameToys
2006-11-06 22:18 ——– d—s—- C:\Documents and Settings\Valentine\Application Data\Microsoft
2006-11-03 16:42 ——– d——– C:\Documents and Settings\Valentine\Application Data\Prevx
2006-11-03 00:01 ——– d——– C:\Program Files\Lavasoft
2006-11-03 00:01 ——– d——– C:\Documents and Settings\Valentine\Application Data\Lavasoft
2006-11-02 22:50 ——– d——– C:\Documents and Settings\Valentine\Application Data\SmartFTP
2006-09-26 12:01 ——– d——– C:\Program Files\World of Warcraft


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"PrevxOne"="\"C:\\Program Files\\Prevx1\\PXConsole.exe\""
"UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\
6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00
"!AVG Anti-Spyware"="\"C:\\Documents and Settings\\Valentine\\Desktop\\Home system\\Software\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,40,01,00,00,00,00,00,00,00,05,00,00,8e,04,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Digital Imaging Monitor.lnk"
"backup"="C:\\WINDOWS\\pss\\HP Digital Imaging Monitor.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqtra08.exe "
"item"="HP Digital Imaging Monitor"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone Fast Start.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\HP Image Zone Fast Start.lnk"
"backup"="C:\\WINDOWS\\pss\\HP Image Zone Fast Start.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\HP\\DIGITA~1\\bin\\hpqthb08.exe -s"
"item"="HP Image Zone Fast Start"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpcmpmgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SOUNDMAN"
"hkey"="HKLM"
"command"="SOUNDMAN.EXE"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="jusched"
"hkey"="HKLM"
"command"="C:\\Documents and Settings\\Valentine\\Desktop\\Home system\\Software\\Int Browser Plugin\\bin\\jusched.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-07 19:50:33.00
C:\ComboFix.txt … 06-11-07 19:50


Logfile of HijackThis v1.99.1
Scan saved at 7:52:31 PM, on 11/7/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Prevx1\PXConsole.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\GameToys\nost_LM.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\Documents and Settings\Valentine\Desktop\Home system\Software\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Startup: Loadout Manager.lnk = C:\Program Files\GameToys\nost_LM.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1162530397109
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Documents and Settings\Valentine\Desktop\Home system\Software\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)



Incident Status Location

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.belnk.com/]
Spyware:Cookie/Peel Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.peel.com/]
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/ErrorSafe Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.errorsafe.com/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.terra.com.br/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Valentine\Application Data\Mozilla\Firefox\Profiles\byzmxebr.default\cookies.txt[.atwola.com/]
Post #8
Prevx happened to just come up with red flag on these files it found:
Screenshot

Looking it up in their database, it links back to the original filename (GOHGKOG.EXE). Hmm?

Also FYI, the only file that seems unaccounted for in that Combofix list of created files is the last driver (CO_MON.sys).
Post #9
LeChuck,

The files in the screenshot are backed up in your System Restore Program, lets flush it out and create a new Restore Point <– Important



System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.

* Right-click My Computer.
* Click Properties.
* Click the System Restore tab.
* Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

Reboot your System

Turn ON System Restore.

* Right-click My Computer.
* ClickProperties.
* Click the System Restore tab.
* UN-Check Turn off System Restore on all Drives.
* Click Apply, and then click OK.

* Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this



Your doing your homework :thumbup: All the files in Combofix are ok, this one may or maynot be.
C:\WINDOWS\system32\drivers\CO_Mon.sys

I searched about 6 forums that they had people run Combofix and that file was ignored. I also read in one forum that the file was uploaded to a site for analysis and it came back as clean. What you can do is scroll in Windows Explorer to that file, right click it and go to properties and it may give you some insite as to what the file is.


The rest of your log looks good :thumbup: How is your system running now?
Post #10
Hello,

System restore point items done. Everything seems to be running fine and I don't notice any suspicious activities/processes/etc. I would agree that it seems like things are cleaned up now.

I got another screen capture of the events Prevx captures after boot (actually a few minutes after, since it takes that long for its console to appear … I presume because it's scanning or doing something otherwise useful). Does any of this activity seem questionable?
Screenshot

From searching, it seems the NetBIOS broadcast is some sort of normal Windows networking traffic. Not sure about all the svchost.exe events. I would guess this is related to Prevx, since this wasn't happening initially. Anyway, the log is quiet after the above items, and stays quiet while the system is running (previously the events to create and execute ~.exe, gOHGKOG.exe, etc happened immediately after).

Couple more questions:
o) Do you know a good lightweight utility that does the kind of event logging I'm using Prevx for? My impression of Prevx so far is that it's a lot of baggage that doesn't work so well – but the event logging is nice.
o) Do you have any info on the questions I posted in my next-to-last post (regarding how these files were getting started up / executed)? Engineer's curiousity indeed .. *g*

thanks,

LeChuck
Post #11
LeChuck

The screenshot is a little hard to read but I could detect a few instances of svchost running , and thats perfectly normal.

As far as an event logger, don't know of one, you will have to do some research for one.


As how those files got on your system, nowadays you have to be so careful what sites you go on and links you click on. File sharing sites like Kazaa, Limewire, MySpace are a hotbed of getting yourself infected. They even have something called drive by now, you don't even have to click on a bad link, just to into a bad site and you get whacked.


I am going to list somethings for you to do and free programs to install to help keep you more secure. You may have aleady done some on my list so just do them again or ignore them.


Here are some free programs and tips for keeping your system up to date, and to help keep all the riff raff out of your system.

Be sure to follow the instructions for System Restore because everything we removed is backed up in that program and if you ever use it to revert your system to an earlier date, you can reinfect your self all over again.


Download and Install CCleaner

* Click on Run Cleaner
* Run the Issues Scan < When it asks you to backup the Registry..Say Yes Tutorial for CCleaner


Now that your clean, we need to erase all possible older infected files that may still be lurking on your system.

* Clean out your Temp Files
* This procedure should be run from Safemode for better results.


Boot into Safemode

* Go to Start> Shut off your Computer> Restart
* As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly, this will bring up a menu.
* Use the Up and Down Arrow Keys to scroll up to Safemode
* Then press the Enter Key on your Keyboard




* Go to My Computer/ C: Drive/ Documents and Settings/ Every User on this Computer Local Settings and delete all the contents of the Temp Folder and the Temporary Internet Files Folder <–Just the contents, not the folder itself.

* Go to My Computer/ C:/ Windows/ Temp and delete all the contents of the Temp Folder <– But not the temp folder itself.

* Go to My Computer/ C:/ Windows/ Prefetch and remove all the contents of the Prefetch Folder. <–But not the Prefetch folder itself.



Reboot your system normally


Close any instance of Internet Explorer and Windows Explorer.
  • Go to Start> Control Panel> Internet Options . You shoud be on the General Tab
  • Delete Cookies
  • Delete Files > and offline content as well

Now Empty your Recycle Bin


System Restore makes regular backups of all your settings, if you ever had to use this program to restore your
system to a previous date, you will be infected all over again so we need to clean out the previous Restore Points

Turn off System Restore.
  • Right-click My Computer.
  • Click Properties.
  • Click the System Restore tab.
  • Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
Reboot your System

Turn ON System Restore.
  • Right-click My Computer.
  • ClickProperties.
  • Click the System Restore tab.
  • UN-Check Turn off System Restore on all Drives.
  • Click Apply, and then click OK.
  • Go to Start/ Control Panel/ Performance and Maintenance/ System Restore/ Create a New Restore Point
    You can name the restore point anything you like, something that you can remember, You will have to be in Catagory View to see this


Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

Here are Free Anti-Virus Programs if you need one. Just install one because with AV software…MORE IS NOT BETTER.
* AVG Free Edition
* AntVir Personal Edition


* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.

* Spyware Blaster It will prevent most spyware from ever being installed.

* Spyware Guard It offers realtime protection from spyware installation attempts.

* Win Patrol This program will warn you when any changes are being made to your system and give you the option to deny the change.

* IE- Spyad IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

* Firefox Browser It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.

* Windows Updates Go to Start> Control Panel> Security Center> Windows Updates and check the radio button that says " Notify me but don't automatically download and install them "

* Go to Start> All Programs> Assessories > System Tools> Disk Defragmenter. This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.



Thanks for stopping by Tom Coyote , I'm glad I was able to help you.
Post #12
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI