[Resolved]Something Is Not Right

Your logs look good.

The "system recovery" message should not appear anymore. (tell me if it does)

Now that the bugs are out, you need to clear out any old restore points.


Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
  
  A tutorial on installing & using this product can be found here:
  
  Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

i really aprecciate your help rigacci (what problem did i hava at last?) i just have a couple of questions about the last fix that we did..the entry in the HJT log that you told me to delete (O17 - HKLM\System\CCS\Services\Tcpip\..\{A32D8D26-54F8-44A7-A74B-3C983091DEE0}: NameServer = 195.251.25.60 194.177.210.211) still exists in the new HJT log…just tell me if that's ok …the second thing i would like to tell you is that when i look at norton history i still see that some IP's are blocked from accesing my computer ..that's all…big thanks again

Mostly you had some Active-X components that were dropped from the two 016 sites but you didn't have a lot.

As far as blocked IPs, you can go HERE to see who owns any particular IP address.

The 2 that are stil listed in your HJT don't present a serious problem but you could run HJT and select them and click on Fix Checked.

Why don't you try that while I ask some others about them and whether they present a danger. Let me know if they are still there after you do a reboot.

well, i tried to delete again the entry:
O17 - HKLM\System\CCS\Services\Tcpip\..\{A32D8D26-54F8-44A7-A74B-3C983091DEE0}: NameServer = 195.251.25.60 194.177.210.211

but after the reboot it still exist exists…you told me to try to delete again 2 entries …what 's the second??
as for the IPs the result was: RIPE http://www.ripe.net/whois…it seems to do the same job as the ARIN site…does it to want my add my IP to its database???
i really don't know..thanks

Tell me this. Is it true you are in Greece? If so, those addresses (there were 2, [removed] & [removed]) are not to worry about. If you are not in Greece, then we need to address them.

yes i am in grrece…so everything ok?

Yes everything is good. It is your own provider. I'm glad that is resolved. You are good to go. We'll be traveling to Italy in September, to stay a while with relatives. Always wanted to get over to Greece but we never have the time.

ok i really thank you for what you did…i really admire all the people in this forum…they know so much!!!personally,i am in the department of informatics(1st year) at the economics university of athens…i am really looking forward to learn about security issues and get the knowledge to help people like you do…but i have to wait to get a specific course at my university… well,thanks again and find a little time to visit greece…you won't regret it …

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php