Hi! Welcome to the Tom Coyote forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:
I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.
My posts to you will be checked by one of the Forum Admins, so my replies may take a little longer.
Download and Run OiUninstaller
Download and run this uninstaller: OiUninstaller
Delete bad services
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad. Save it as "All Files" and name it FixServices.bat Please save it on your desktop.
@echo off
sc stop "Viewpoint Manager Service"
sc delete "Viewpoint Manager Service"
del Fixservices.bat
exit
Double click FixServices.bat. A window will open and close. This is normal.
End malicious processes: (if they are present)
Press the CTRL+ALT+DEL keys simultaneously to open Task Manager
Click on the Processes tab to show running processes
Find ViewpointService.exe and click on it
Click End Process
Repeat steps 4 & 5 for each of the following processes: (if present)
ViewMgr.exe
Close Task Manager
Remove programs from Add/Remove Programs List
Please go to:
Start
Control Panel
Add/Remove Programs
Find and remove these programs (if they are present)
Viewpoint
Rename HijackThis
There is probably an infection which is hiding part of the HijackThis log because it's called hijackthis.exe.
Please rename hijackthis.exe to scanner.exe
Under Main choose: Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.
Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click NO at the prompt.
I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.
Delete the older versions of Java and download the newest. Please follow these steps to remove older version Java components.
Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.
Then download the latest version of Java Runtime Environment, which is JRE6u1, and install it to your computer.
This is my usual speech for when you are clean, which you appear to be.
Please follow these simple steps in order to keep your computer clean and secure:
Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable
and reenable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and reenable system restore here:
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine.
This alone can save you a lot of trouble with malware in the future.
See this link for a listing of some online & their stand-alone antivirus programs:
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
For a tutorial on Firewalls and a listing of some available ones see the link below:
Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.
This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
You should also scan your computer with this program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Install Ad-Aware - Download and install Ad-Aware.
You should also scan your computer with this program on a regular basis
just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.
Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
You have no anti-virus on your computer. It is important you install one now before we continue with your fix. Check this out for a list of free AV scanners, AVG is highly recommended
A firewall helps keep attackers at bay and keeps malicious processes from 'calling home'. It is important you install one now. Check this out for a list of free firewalls. Zone Alarm is considered the easiest to use.
If you have Spybot use the Resident and Teatimer for protection, as Ewido 4.0 is outdated and should be uninstalled.
To enable Resident, open Spybot S&D then click on Mode and then click on Advanced Mode. In Advanced Mode, select Tools, then Resident and put a check in the Resident and the Teatimer boxes.
Ensure both anti-virus and Spybot are up to date and run a scan with both. Also tell me what popups you are getting.