Your Windows files in the log are double? – Windows\Windows
Do you know when this happened?
Run hijackthis. Click Do a System Scan Only. Put a Check in the box on the left side on these: R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
Close ALL windows and browsers except HijackThis and click Fix checked and exit.
Download SmitfraudFix (by S!Ri) to your Desktop. http://siri.urz.free.fr/Fix/SmitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.
[external image: Posted Image]
______________________________
Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter
[external image: Posted Image]
This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.
IMPORTANT: Do NOT run any other options until you are asked to do so!
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
Please post:
C:\rapport.txt
and a fresh hijackthis log.
Answer Yes, when prompted to install an ActiveX component.
The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure to:
Scan using the following Anti-Virus database: Extended
Scan Options: Scan Archives Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
**Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, two text files will open - main.txt<- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply
Please post (reply) with the results from Kaspersky and Deckard’s scanner.
Hello Susan, sorry but I have forgotten to mention that I use Mozilla Firefox.
I went to run Kaspersky and I coudn't as it only seems to run on Internet Explorer.
What else can I do now to provide the right information?
Hello Susan, here is the list:
Agere Systems PCI Soft Modem
AVG Anti-Rootkit Free
AVG Anti-Spyware 7.5
AVG Free Edition
Browser Protection Volume
DeepBurner v1.7.1.213
EncryptOnClick
FinePixViewer Ver.4.3
FireTune
FUJIFILM USB Driver
Google Earth
HijackThis 1.99.1
Internet Explorer Secure Plug-in
J2SE Runtime Environment 5.0 Update 11
Java™ SE Runtime Environment 6 Update 1
MGI PhotoSuite SE (Remove Only)
Microsoft Office 2000 Premium
Mozilla Firefox (1.5.0.9)
Mozilla Firefox (2.0.0.3)
Mozilla Thunderbird ([removed])
Norton AntiVirus Help
Numbers Up! VP V1.2.2
pdfFactory Pro
RealPlayer
Security Messenger
Security Update for Windows XP (KB923789)
The Magic of the Alphabet
Windows Installer 3.1 (KB893803)
ZoneAlarm
=============================
FYI
the scanner I have been using is AVG which detected the trojan, but for some reason seems to be coming back
Hello again, I have just done another scan with AVG antispyware and this was the report:
AVG Anti-Spyware - Scan Report
———————————————————
+ Created at: 1:09:11 p.m. 11/05/2007
+ Scan result:
C:\System Volume Information\_restore{112078F9-2B5C-4146-B792-9312A7068784}\RP64\A0009255.exe -> Adware.SpySheriff : No action taken.
C:\System Volume Information\_restore{112078F9-2B5C-4146-B792-9312A7068784}\RP65\A0009406.exe -> Downloader.Zlob.avn : No action taken.
::Report end
You need to clear your restore points. You do not appear to have Window Updates installed and therefore your system is very susceptible to infection.
System Restore for Windows XP Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
Please follow this WGA troubleshooting procedure:
. Download and install the WGA Diagnostic Tool:
http://go.microsoft.com/fwlink/?linkid=56062
. After running the WGA Diagnostic Tool, click
on the "Validation" tab and then click on "Copy to Clipboard".
Your Windows did not appear to be genuine. You will not be able to do Windows Updates until you get this straightened out with Microsoft.
Go to the following website and create a post in the
"WGA Validation Problems" forum and paste the
results of the WGA Diagnostic Data in a detailed post. http://forums.microsoft.com/Genuine/default.aspx?SiteID=25
A WGA troubleshooting specialist will analyze the data and
recommend an appropriate solution.
If you have an illegal copy of Windows, you have an option to pay for it and make it good, uninstall and go to a free version of Linux, or just deal with all the insecurities and problems you now have, TC does not support the use of illegal software.
