A. Please delete the content of the following folder, not the folder itself:
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\
B. Please delete the following folder AND all its content: C:\Qoobox
C. Delete the following file:
C:\Documents and Settings\John Owen Burt Cole\My Documents\Azureus Downloads\Myspace Password Hacker.exe
D.Your log looks good. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.
Congratulations, your log shows that your SYSTEM IS CLEAN
There are a few things you must do once you are completely clean:
1. First, a little housecleaning to remove some of the tools that we have been using:
Please download Toolmop.zip that I have provided as an attachment to this post.
Download the file to your desktop
Open the zipped file by clicking on it
Extract the enclosed file Toolmop.bat to your desktop.
Click on Toolmop.bat to run the file.
Respond to all prompts.
When the tool has finished its work, it should auto-destruct.
Now delete Toolmop.zip from your desktop.
2. Please downloadATF Cleanerby Atribune. This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button. If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.
4. Now Set a New Restore Pointto prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.
The easiest and safest way to do this is:
Go to Start > Programs > Accessories > System Tools and click "System Restore".
Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
Then go to Start > Run and type: Cleanmgr
Click "OK".
Click the "More Options" Tab.
Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
Here are some tips to reduce the potential for spyware infection in the future:
Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.
I strongly recommend installing the following applications:
Spywareblaster<= SpywareBlaster will prevent spyware from being installed.
Spywareguard<= SpywareGuard offers realtime protection from spyware installation attempts.
How to use Ad-Aware to remove Spyware<= f you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
How to use Spybot to remove Spyware<= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
Spyad<= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file<= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar<= Get the free google toolbar to help stop pop up windows.
And also see TonyKlein's good advice So how did I get infected in the first place?
Hey I tried to download the Toolmop file but keep getting this message. I am logged in.
Board MessageSorry, an error occurred. If you are unsure on how to use a feature, or don't know why you got this error message, try looking through the help files for more information.
The error returned was:
Sorry, but you do not have permission to use this feature. If you are not logged in, you may do so using the form below if available.
