What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Help! HOSTS locked, SmitFraud and many Browser popups

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Need some help here, I battled Look2me about 1 month ago, and now have issues again: Internet Explorer popping open a slew of Adwindows about every 5 mins. Funny part is one User profile is really badly affected the one I am curerntly posting from appears to not be.

HOSTS file says I do not have permission to do anything with it (I can't open it, modify it etc and I am Admin). HiJack this errored when trying to read it.

Finally a scan with Spybot showed SmitFraud found and claimed it removed it…system is crawlingly slooow when in the one user profile but acceptable in the current one I'm using.

Here is my Hijack this and SmitFraudFix files, any help is greatly appreciated. Thnx.

Logfile of HijackThis v1.99.1
Scan saved at 9:45:34 PM, on 11/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AVENGINE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe
c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE
C:\Program Files\Panda Software\Panda Internet Security 2007\SRVLOAD.EXE
c:\program files\panda software\panda internet security 2007\WebProxy.exe
C:\Disks\Malware Removal\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Software\Panda Internet Security 2007\APVXDWIN.EXE" /s
O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Software\Panda Internet Security 2007\Inicio.exe"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} -
O16 - DPF: {09ADBEAD-9044-48DC-B047-ED711C68B50C} -
O16 - DPF: {12B127F7-CC36-4A39-A334-AA39689155CE} (TwainPRO Class) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} -
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} -
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} -
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hollyleppert.spaces.live.com//Photo…ad/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} -
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -
O16 - DPF: {7B0207CE-7FF6-11D4-A13A-004005FA6275} (Pegasus ImagXpress Control v6.0) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_03) -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) -
O16 - DPF: {B54921F7-5A9C-4A5D-AFCA-DE91F8DD3A2F} -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} -
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.5.0_03) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{A087BD9A-003A-4E10-BB3F-17DB4F08F755}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: avldr - C:\WINDOWS\SYSTEM32\avldr.dll
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\
O20 - Winlogon Notify: Group Policy - C:\WINDOWS\
O20 - Winlogon Notify: RunServices - C:\WINDOWS\
O20 - Winlogon Notify: Setup - C:\WINDOWS\
O20 - Winlogon Notify: Telephony - C:\WINDOWS\
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\pavsrv51.exe
O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Software\Panda Internet Security 2007\AntiSpam\pskmssvc.exe
O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program files\panda software\panda internet security 2007\firewall\PNMSRV.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program Files\Panda Software\Panda Internet Security 2007\PsImSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program Files\Panda Software\Panda Internet Security 2007\TPSrv.exe




SmitFraudFix v2.119
Scan done at 22:29:54.90, Fri 11/03/2006
Run from C:\Documents and Settings\Adminastrator\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Adminastrator


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Adminastrator\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINA~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32


»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End
Post #2
ttt It's been more than 5 days…lots of lookers but no ideas ?? Since posting I seem to have been compromised and taken over even worse :-( Panda AV and HiJack this were both uninstalled and no one here did it. An Internet Connection Sharing Service was mysteriously setup and was running continuously, it had firewall exceptions for BitLord and about a dozen port variations of MSN Messenger and Plus. I managed to stop this thing and diasabled everything in it after diabling my own LAN connection first. I downloaded new Router s/w and updated my firmware and reset things with some non standard IP addresses to make guessing my default gateway etc tougher. Notepad has disappeared from the list of programs available whenever I go to open a .txt file it doesn't know what to do?? I have to use Wordpad instead to open things. PS The HOSTS file is now sorted, it was read only, but I could not view it for some reason. I was able to take ownership of permissions etc and finally open it. It appeared to only have sample data in it. AVG anti spyware doesn't find anything, Spybot and Adaware came up clean under my profile….I still haven't sorted out my daugters profile or run scans under her user session (2 users on system), I've been trying to get this other one sorted out first. Any help is appreciated thanx!
Post #3 last edited
BAD35th :D

Welcome to Tom Coyote sorry for the delay in responding, just so you know how the forums work, by replying to yourself you took yourself out of the zero reply category that we search in for logs to work, this is most likely why you got overlooked.


Right click on the Icon by the clock for WinPatrol, and disable it, it may stop us from making changes to your system.



Please download ComboFix by sUBs from either of these two locations

BleepingComputerComboFix
TechSupportForumComboFix
  • Double click combofix.exe & follow the prompts.
  • When finished, it shall produce a log for you. Post that log in your next reply along with a new HJT log please.
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.



Download and install the 30 day trial of AVG Anti Spyware to your desktop.
  • Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
  • Once the setup is complete you will need run AVG and update the definition files.
  • On the main screen select the icon Update then select the Update now link.
  • Next select the Start Update button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the Scanner icon at the top of the screen, then select the Settings tab.
  • Once in the Settings screen click on Recommended actions and then select Quarantine <– Dont forget this
  • Under Reports
  • Select Automatically generate report after every scan
  • Un-Select Only if threats were found
  • Close AVG Anti-Spyware <– Do not run the scan yet.
Boot your computer into Safemode
  • Go to Start> Shut Off your Computer> Restart
  • As the computer starts to boot-up, Tap the F8 KEY somewhat rapidly.
  • This will bring up a menu.
  • Use the Up and Down Arrow Keys to scroll up to SAFEMODE
  • Then press the Enter on your Keyboard
IMPORTANT: Do not open any other windows or programs while AVG is scanning, it may interfere with the scanning process:
  • Launch AVG-Anti-Spyware by double-clicking the icon on your desktop.
  • Select the Scanner icon at the top and then the Scan tab then click on Complete System Scan.
  • AVG will now begin the scanning process, be patient this may take a little time.
  • Once the scan is complete do the following:
  • If you have any infections you will prompted, then select Apply all actions
  • Next select the Reports icon at the top.
  • Select the Save report as button in the lower left hand of the screen and save it to a text file on your system
  • make sure to remember where you saved that file, this is important
  • Close AVG


Open HJT Scan Only, close your browser and all open windows, check these and click on Fix Checked. These may be gone

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} -
O16 - DPF: {09ADBEAD-9044-48DC-B047-ED711C68B50C} -
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} -
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} -
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} -
O16 - DPF: {B54921F7-5A9C-4A5D-AFCA-DE91F8DD3A2F} -

O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\
O20 - Winlogon Notify: Group Policy - C:\WINDOWS\
O20 - Winlogon Notify: RunServices - C:\WINDOWS\
O20 - Winlogon Notify: Setup - C:\WINDOWS\
O20 - Winlogon Notify: Telephony - C:\WINDOWS\



Please download ATF Cleaner by Atribune.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Now go to where you have HJT installed and right click on hijackthis.exe and rename it to Analyze.exe, run the scan to Scan and Save a log File and post the new log and the AVG report and the Combofix log into this thread.
Post #4
Hi Ken, thanks for your assistance :thumbup:

Ok, I ran Combo fix as instructed and it found some remnants of Look2Me that got cleaned up. Here is its log:

Adminastrator - 06-11-14 0:13:10.12 Service Pack 2
ComboFix 06.11.9 - Running from: "C:\Disks\Malware Removal"

((((((((((((((((((((((((((((((((((((((((((((( Look2Me's Log ))))))))))))))))))))))))))))))))))))))))))))))))))

REGISTRY ENTRIES REMOVED:

[HKEY_CLASSES_ROOT\clsid\{48B7DE4C-E764-4DC5-A66D-8857303F7512}]
@=""

[HKEY_CLASSES_ROOT\clsid\{48B7DE4C-E764-4DC5-A66D-8857303F7512}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\clsid\{48B7DE4C-E764-4DC5-A66D-8857303F7512}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\clsid\{48B7DE4C-E764-4DC5-A66D-8857303F7512}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


Granting sedebugprivilege to Administrators … successful


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\{B0C47900-06FF-1033-0319-040003270001}


((((((((((((((((((((((((((((((( Files Created from 2006-10-14 to 2006-11-14 ))))))))))))))))))))))))))))))))))


2006-11-05 23:09 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-11-03 22:29 1,392 –a—— C:\WINDOWS\system32\tmp.reg
2006-11-03 21:31 73,728 –a—— C:\WINDOWS\system32\pv.exe
2006-11-03 21:31 39,184 –a—— C:\WINDOWS\system32\Ntrights.exe
2006-11-03 21:31 175,616 –a—— C:\WINDOWS\system32\strings.exe
2006-11-03 21:31 16,384 –a—— C:\WINDOWS\system32\restart.exe
2006-11-03 21:31 126,976 –a—— C:\WINDOWS\system32\zip.exe
2006-11-03 21:31 11,254 –a—— C:\WINDOWS\system32\locate.com
2006-11-02 21:32 9,488 –a—— C:\WINDOWS\system32\sporder.dll
2006-11-02 21:32 24,576 –a—— C:\WINDOWS\system32\msxml3a.dll
2006-10-29 17:09 87,824 -ra—— C:\WINDOWS\system32\drivers\w300mgmt.sys
2006-10-29 17:08 96,352 -ra—— C:\WINDOWS\system32\drivers\w300mdm.sys
2006-10-29 17:08 9,264 -ra—— C:\WINDOWS\system32\drivers\w300mdfl.sys
2006-10-29 17:08 85,696 -ra—— C:\WINDOWS\system32\drivers\w300obex.sys
2006-10-29 17:08 6,208 -ra—— C:\WINDOWS\system32\drivers\w300cmnt.sys
2006-10-29 17:08 6,208 -ra—— C:\WINDOWS\system32\drivers\w300cm.sys
2006-10-26 22:29 60,800 -ra—— C:\WINDOWS\system32\drivers\w300bus.sys
2006-10-26 22:29 5,840 -ra—— C:\WINDOWS\system32\drivers\w300whnt.sys
2006-10-26 22:29 5,840 -ra—— C:\WINDOWS\system32\drivers\w300wh.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-11-14 00:14 ——– d——– C:\Program Files\Common Files
2006-11-12 00:26 ——– d——– C:\Program Files\Internet Explorer
2006-11-09 20:02 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-11-09 20:02 ——– d——– C:\Program Files\Common Files\Panda Software
2006-11-09 19:01 ——– d——– C:\Program Files\Incomplete
2006-11-09 17:46 ——– d——– C:\Program Files\LimeWire
2006-11-07 21:32 ——– d——– C:\Program Files\SpywareBlaster
2006-11-07 20:09 ——– d——– C:\Program Files\MSN Messenger
2006-11-07 20:09 ——– d——– C:\Program Files\DAEMON Tools
2006-11-06 01:34 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Lavasoft
2006-11-06 00:16 ——– d——– C:\Program Files\Adobe
2006-11-06 00:16 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Leadertech
2006-11-06 00:16 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Adobe
2006-11-05 23:57 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Sun
2006-11-05 23:09 ——– d——– C:\Program Files\MyEido
2006-11-04 16:21 ——– d——– C:\Program Files\Grisoft
2006-11-04 00:37 ——– d——– C:\Program Files\Windows Media Player
2006-11-03 21:30 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Help
2006-11-03 01:02 ——– d——– C:\Program Files\Yahoo!
2006-11-02 20:15 ——– d——– C:\Program Files\Panda Software
2006-11-02 20:10 ——– d——– C:\Program Files\ZA
2006-11-01 19:50 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Apple Computer
2006-10-27 16:35 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\Teleca
2006-10-26 22:39 ——– d——– C:\Program Files\Sony Ericsson
2006-10-26 22:39 ——– d——– C:\Program Files\Common Files\Teleca Shared
2006-10-26 22:37 ——– d——– C:\Program Files\QuickTime
2006-10-26 16:27 ——– d——– C:\Program Files\Disc2Phone
2006-10-19 08:16 ——– d—s—- C:\Documents and Settings\Adminastrator\Application Data\Microsoft
2006-10-03 07:08 ——– d——– C:\Documents and Settings\Adminastrator\Application Data\WinPatrol
2006-10-03 06:32 ——– d——– C:\Program Files\Outlook Express
2006-10-02 00:25 ——– d——– C:\Program Files\Microsoft AntiSpyware
2006-09-30 20:54 ——– d–h—– C:\Program Files\WindowsUpdate
2006-09-30 20:29 ——– d——– C:\Program Files\Lavasoft
2006-09-30 12:04 ——– d——– C:\Program Files\NetworkView3
2006-09-30 11:13 1233 –a—— C:\WINDOWS\system32\khh22e39.sys
2006-09-13 00:01 1084416 –a—— C:\WINDOWS\system32\msxml3.dll
2006-08-25 10:45 617472 –a—— C:\WINDOWS\system32\comctl32.dll
2006-08-21 07:21 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 –a—— C:\WINDOWS\system32\fltmc.exe
2006-08-16 06:58 100352 –a—— C:\WINDOWS\system32\6to4svc.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"WinPatrol"="\"C:\\PROGRA~1\\BILLPS~1\\WINPAT~1\\WinPatrol.exe\""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,b9,00,00,00,7c,00,00,00,72,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"UPnPMonitor"="{e57ce738-33e8-4c51-8354-bb4de9d215d1}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Microsoft Office.lnk"
"backup"="C:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\MICROS~2\\Office\\OSA9.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="atiptaxx"
"hkey"="HKLM"
"command"="atiptaxx.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="pccguide"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Trend Micro\\PC-cillin 2002\\pccguide.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="qttask"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="SMTray"
"hkey"="HKLM"
"command"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMTray.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"helpsvc"=dword:00000002
"Ati HotKey Poller"=dword:00000002
"Alerter"=dword:00000003
"Messenger"=dword:00000002
"FastUserSwitchingCompatibility"=dword:00000003
"Eventlog"=dword:00000002
"cisvc"=dword:00000003

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-14 0:15:50.17
C:\ComboFix.txt … 06-11-14 00:15


Next the AVG log:

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 1:39:49 AM 11/14/2006

+ Scan result:



Nothing found.


::Report end

And finally the new HiJackThis..I mean Analzethis log:


Logfile of HijackThis v1.99.1
Scan saved at 1:50:44 AM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MyEido\AS_7.5\guard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Disks\Malware Removal\AnalyzeThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {12B127F7-CC36-4A39-A334-AA39689155CE} (TwainPRO Class) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} -
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} -
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hollyleppert.spaces.live.com//Photo…ad/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -
O16 - DPF: {7B0207CE-7FF6-11D4-A13A-004005FA6275} (Pegasus ImagXpress Control v6.0) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_03) -
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} -
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.5.0_03) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{A087BD9A-003A-4E10-BB3F-17DB4F08F755}: NameServer = 192.168.5.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\MyEido\AS_7.5\guard.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe


Just curiousity what was I infected with and what were the sections you had me remove doing ?

Note: there wasn't anything in section 020 to remove or clean. I also ran the ATFCleaner as indicated. Do you think we got everything?

Thanks again!
Post #5 last edited
BAD35th :D

You said at the beginning of your post that you where battleing Look2me, well whatever you did you did not get rid of it. It looks likes its gone now, :thumbup: but it also looks like you ran HJT from Safemode and its not showing me everything. Rerun it in normal mode and post a new log. Those 020 entries that you could not find where related to Look2me and Combofix removed them :thumbup:


Run this free Panda online virus scanner, it sometimes picks up things that don't show up on your HJT log.
Panda ActiveScan <<


I have some homework for you to do. You have a couple of suspicious files in the combofix log Go to each file I have listed, right click on the file and go to Properties and it should tell you what company the file is from. If its a known company like Microsoft or one that you recognize, make a notation and let me know. If the file has no information on it, I would like you to upload that file to Jotti, its a quick scan and it will give you a report stating with the file is a virus or not, just upload the ones with no info and post the reports. When you go to Jotti, use the browse feature to find the file and then Submit it. These files may be ok but I am getting back mixed results on them.

Jotti Upload

We need to make sure all hidden files are showing :
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Under the Hidden files and folders heading select Show hidden files and folders.
  • Uncheck the Hide file extensions for known types option.
  • Uncheck the Hide protected operating system files (recommended) option.
  • Click Yes to confirm.
  • Click OK.
C:\WINDOWS\system32\locate.com
C:\WINDOWS\system32\sporder.dll
C:\WINDOWS\system32\strings.exe
C:\WINDOWS\system32\restart.exe
C:\WINDOWS\system32\msxml3a.dll



So let me see a new HJT log in normal mode and the Panda report and any report from Jotti
Post #6
Ok, here is the results of the homework <_<

File: locate.com

MS-DOS Application
Modified 1/13/2005 9:41 pm
10.9 KB

Status: MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.)
MD5 321e0b208545a9c4610a2146417e7e2c
Packers detected: UPX


File: sporder.dll

Winsock2 reorder service providers
Microsoft Corporation
5.0.1641.1
11/2/2006 9:32pm
9.26KB

Status: OK (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 e2050130c7c0ec056a44237bbb8feb43
Packers detected: -


File: strings.exe

11/3/2006 9:31pm
171 KB

Status: MIGHT BE INFECTED/MALWARE (Sandbox emulation took a long time and/or runtime packers were found, this is suspicious. Normally programs aren't packed and don't force the sandbox into lengthy emulation. Do realize no scanner issued any warning, the file can very well be harmless. Caution is advised, however.) (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 d732540c90f9d528de698b296c6a98a6
Packers detected: UPX


File: restart.exe

WareSoft Software
V 1.0.0.0
11/3/2006 9:31pm
16.0 KB

Status: INFECTED/MALWARE
MD5 31be79d660fc1da409f1c48a46cbd57b
Packers detected: -
Scanner results
AntiVir Found SecurityPrivacyRisk/Tool.Hardoff.A riskware
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found Tool.ShutDown.11
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VirusBuster Found nothing
VBA32 Found Trojan.Shutdown


File: msxml3a.dll

XML Resources
Microsoft Corporation
8.20.8730.1
11/2/2006 9:32pm
24 KB

Status: OK
MD5 5fefd614bbd3ffa3712b172f70b1fde2
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VirusBuster Found nothing
VBA32 Found nothing


Panda Active Scan Pro showed nothing

HJT Log: (no errors when running this time!)
Logfile of HijackThis v1.99.1
Scan saved at 9:33:43 PM, on 11/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\MyEido\AS_7.5\guard.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Disks\Malware Removal\AnalyzeThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.com
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [WinPatrol] "C:\PROGRA~1\BILLPS~1\WINPAT~1\WinPatrol.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\npjpi150_03.dll
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} -
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {12B127F7-CC36-4A39-A334-AA39689155CE} (TwainPRO Class) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} -
O16 - DPF: {32505657-9980-0010-8000-00AA00389B71} -
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} -
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://hollyleppert.spaces.live.com//Photo…ad/MsnPUpld.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -
O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} -
O16 - DPF: {7B0207CE-7FF6-11D4-A13A-004005FA6275} (Pegasus ImagXpress Control v6.0) -
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.5.0_03) -
O16 - DPF: {A4639D2F-774E-11D3-A490-00C04F6843FB} (IEAnimBehaviorFactory Class) -
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} -
O16 - DPF: {CAFEEFAC-0015-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.5.0_03) -
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} -
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} (ASPRO Installer Class) - http://acs.pandasoftware.com/activescanpro/as5/asproinst.cab
O16 - DPF: {EDFCDAF5-95D9-40E9-BBE6-10C33190C3EF} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{A087BD9A-003A-4E10-BB3F-17DB4F08F755}: NameServer = 192.168.5.5
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\MyEido\AS_7.5\guard.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Let me know if I should delete the suspicious files.

Thanks! :D
Post #7
I think at this point I would leave those files be unless you are having some sort of problem. My gut feeling is that there ok. You need to run HJT in normal windows, I am not looking at the complete log. Parts of it are missing like all your Panda entries . If your log is ok, I have some free tools for you to install to help keep you more secure.
Post #8
Free tools = great! :) HJT Log and Normal Windows…I am running it in regular windows, and not in Safe Mode. The Panda is missing because it was uninstalled somehow, only the Folder remains from it in Program Files…and no-one here says they did it. I will re-install it in next day or so..a few DLL's are still in the SYSTEM32 from Panda so thats why I think it was not uninstalled properly. Thanks for the ongoing assistance!
Post #9
Here are a few things to do….

Your Java is out of date and leaving your system vunerable. Update your Java:
  • Go to Start > Control Panel > Add-Remove Programs.
  • Search in the list for all previous installed versions of Java. (J2SE Runtime Environment)

    It should have an icon next to it:

    [external image: Posted Image]
    Select it and click Remove.
  • The current version can be downloaded from Sun here:
    http://java.sun.com/javase/downloads/index.jsp
    Scroll down the page to 'Java Runtime Environment (JRE) 5.0 Update 9 and press the Download' button. On the new web page, click the Accept License Agreement' button.
    Then select 'Windows Offline Installation, Multi-language' in the Windows Platform
    area just below the Accept button.



C:\Program Files\MyEido\AS_7.5 <- is this a legit program that you use??


C:\WINDOWS\system32\locate.exe <– see if you have a this file and delete it


What you might try doing with these is to rename them one at a time to strings.old and restart.old, just do them one at a time and check all your programs and make sure there all working, then in a few days do the second one and check everything again. After a week or so if everything is ok, then delete them

C:\WINDOWS\system32\strings.exe
C:\WINDOWS\system32\restart.exe





How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.

System Restore <– Do this first to prevent reinfecting yourself.
TonyKlein CastleCops
Grinler BleepingComputer
Geeks To Go


* Make sure that your ANTI-VIRUS SOFTWARE is up to date and run a full scan at least once aweek.

* Here are Free Anti-Virus Programs if you need one. Just install one because with AV software…MORE IS NOT BETTER.

AVG Free Edition
AntVir Personal Edition


* Spybot Search and Destroy 1.4
Check for Updates/ Immunize and run a Full System Scan on a regular basis.

* Ad-Aware SE Personal 1.06
Check for Updates and run a Full System Scan on a regular basis.

* Spyware Blaster It will prevent most spyware from ever being installed.

* Spyware Guard It offers realtime protection from spyware installation attempts.

* Win Patrol This program will warn you when any changes are being made to your system and give you the option to deny the change.

* IE- Spyad IE-Spyad places over 4000 web sites and domains
in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

* Firefox Browser
It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both. When it asks you if you want it to be your default browser, say NO and take the checkmark out of the box to ask you again. After you use this for awhile, you will want to make it your default.

* Thunderbird Mail There companion mail program was highly favored in PCWorld Magazine, this has a good spam filter and is more secure than Outlook Express.

* Zone Alarm Here is a free Firewall from Zone Labs, I wouldn't access the internet without it.

* WINDOWS UPDATES - Enable Automatic Updates
Right click on MY COMPUTER/Click on PROPERTIES/ AUTOMATIC UPDATES and put a mark in the radio button
DOWNLOAD UPDATES FOR ME BUT LET ME CHOOSE WHEN TO INSTALL THEM.

* Go to START/ CONTROL PANEL> PERFORMANCE AND MAINTENANCE> REARRANGE ITEMS ON YOUR HARD DISK TO MAKE PROGRAMS RUN FASTER
This is the Windows Disk Defragger, run this maybe once or twice a month to keep your system running good. The first time you run it, it may take awhile.

Thanks for stopping by Tom Coyote
Post #10
Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI