What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Outerinfo And Other Adware Popup Removal

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
A. We need to get ris of a lot of infected files as you have probably guessed. Some are in your Java Cache which we will be cleaning next, others, in different programs. The latter will be deleted through ComboFix and many are in your System Restore Cache which we will be cleaning as part of our final cleanup procedures.

B. Clearing Java Cache
Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)[external image: Posted Image]
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.


C. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\Documents and Settings\ANN KLOPP\install.exe
C:\Documents and Settings\ANN KLOPP\nek.exe
C:\Documents and Settings\ANN KLOPP\setup9x.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\mock\CPSFC.EXE
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\activate_crack.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\activate_crack.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\CRACKS_AM - Page H2.htm
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\dap53.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\InsaniquariumDeluxeSetup-dm.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\New Folder (2)\SSRecSetup.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b122.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer\Install Desktop Destroyer FREE.exe
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer.zip
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6P89ABUV\user9[1].exe
C:\Program Files\TvInternet\ActiveX\ads.exe
C:\Program Files\TvInternet\ActiveX\ads0.exe
C:\Program Files\TvInternet\ActiveX\ads1.exe
C:\Program Files\TvInternet\ads.exe
C:\Program Files\TvInternet\ads0.exe
C:\Program Files\TvInternet\ads1.exe
C:\WINDOWS\Downloaded Program Files\speedtest.dll

Registry::
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Start Page"= "http://go.microsoft.com/fwlink/?LinkId=69157"


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

D. Please tell me how your system is now running. If everything is OK, just give me the OK and we will start our final cleanup procedures.

Trevuren
Post #17
hi, here is the combo log followed by the hijackthis. And, everything looks great. I haven't had a single popup, and my computer is faster than it was. thanks for everything you're doing.

ComboFix 07-08-10.8 - "ANN KLOPP" 2007-08-12 20:42:33.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.367 [GMT -5:00]
Command switches used :: C:\Documents and Settings\ANN KLOPP\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\Documents and Settings\ANN KLOPP\install.exe
C:\Documents and Settings\ANN KLOPP\nek.exe
C:\Documents and Settings\ANN KLOPP\setup9x.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\mock\CPSFC.EXE
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\activate_crack.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\activate_crack.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\CRACKS_AM - Page H2.htm
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\dap53.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\InsaniquariumDeluxeSetup-dm.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\New Folder (2)\SSRecSetup.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b122.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer\Install Desktop Destroyer FREE.exe
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer.zip
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6P89ABUV\user9[1].exe
C:\Program Files\TvInternet\ActiveX\ads.exe
C:\Program Files\TvInternet\ActiveX\ads0.exe
C:\Program Files\TvInternet\ActiveX\ads1.exe
C:\Program Files\TvInternet\ads.exe
C:\Program Files\TvInternet\ads0.exe
C:\Program Files\TvInternet\ads1.exe
C:\WINDOWS\Downloaded Program Files\speedtest.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Documents and Settings\ANN KLOPP\install.exe
C:\Documents and Settings\ANN KLOPP\nek.exe
C:\Documents and Settings\ANN KLOPP\setup9x.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\mock\CPSFC.EXE
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\activate_crack.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\frostyhandeyeV2free.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\sandboxofgod.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\computer2\pirates\Downloads\ww2rescue.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\activate_crack.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\CRACKS_AM - Page H2.htm
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\dap53.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\InsaniquariumDeluxeSetup-dm.exe
C:\Documents and Settings\JONATHAN KLOPP\Desktop\USB Super Link\New Folder\New Folder (2)\SSRecSetup.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b104.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b122.exe
C:\Documents and Settings\JONATHAN KLOPP\Local Settings\Temp\b136.exe
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer.zip
C:\Documents and Settings\JONATHAN KLOPP\My Documents\DesktopDestroyer\Install Desktop Destroyer FREE.exe
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\6P89ABUV\user9[1].exe
C:\Program Files\TvInternet\ActiveX\ads.exe
C:\Program Files\TvInternet\ActiveX\ads0.exe
C:\Program Files\TvInternet\ActiveX\ads1.exe
C:\Program Files\TvInternet\ads.exe
C:\Program Files\TvInternet\ads0.exe
C:\Program Files\TvInternet\ads1.exe
C:\WINDOWS\Downloaded Program Files\speedtest.dll


((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))


2007-08-12 11:55 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-08-12 11:55 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-08-10 13:40 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-09 22:25 d——– C:\Program Files\Trend Micro
2007-08-09 22:15 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\AdobeAUM
2007-08-09 12:50 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Earthlink
2007-08-08 13:54 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\InstallShield
2007-08-08 13:43 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\ErrorSmart
2007-08-08 12:54 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\ErrorSmart
2007-08-08 11:22 d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\EarthLink Toolbar
2007-08-08 11:05 d——– C:\Program Files\WinPoET Broadband Connection
2007-08-08 10:35 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\EarthLink Toolbar
2007-08-08 10:33 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Visual Networks
2007-08-08 10:23 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Earthlink
2007-08-07 17:32 d——– C:\DOCUME~1\Owner\APPLIC~1\EarthLink
2007-08-07 17:32 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\EarthLink
2007-08-07 17:31 d——– C:\Program Files\EarthLink
2007-08-04 15:12 d——– C:\DOCUME~1\JONATH~1\APPLIC~1\Symantec
2007-08-02 11:26 d——– C:\Program Files\XoftSpySE
2007-07-31 19:40 d——– C:\Temp


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-12 20:45 ——— d——– C:\Program Files\TvInternet
2007-08-08 13:54 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-08-08 11:37 ——— d——– C:\DOCUME~1\ANNKLO~1\APPLIC~1\Corel
2007-08-08 10:37 ——— d——– C:\Program Files\Common Files\EarthLink
2007-08-08 10:33 ——— d——– C:\Program Files\EarthLink TotalAccess
2007-07-02 15:48 ——— d——– C:\Program Files\Microsoft Picture It! PhotoPub
2007-06-29 19:13 ——— d——– C:\Program Files\iTunes
2007-06-15 14:32 ——— d——– C:\Program Files\Apple Software Update
2007-05-16 10:12 86528 ——— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 10:12 85504 ——— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 10:12 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 10:12 683520 ——— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 10:12 510976 ——— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 10:12 1314816 ——— C:\WINDOWS\system32\dllcache\msoe.dll
2007-03-12 20:48 496 –a—— C:\Program Files\Common Files\quca
2005-01-12 20:55 37918 –a—— C:\Program Files\remove.exe
2003-02-05 12:41 207759 –a–c— C:\Program Files\INSTALL.LOG


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" []
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-19 08:59]
"BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 04:59 C:\WINDOWS\BCMSMMSG.exe]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2003-02-05 12:36]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 17:44]
"LXSUPMON"="C:\WINDOWS\system32\LXSUPMON.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-03-14 19:05]
"IPInSightMonitor 01"="C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe" [2005-08-10 21:10]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [2000-08-08 15:00]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"E6TaskPanel"="C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" [2005-09-01 15:24]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"=C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

C:\Documents and Settings\ANN KLOPP\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DESKTOP.INI [2002-09-03 10:00:00]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2003-02-05 12:32:49]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2000-06-29 18:15:10]
MySoftware NewsFlash.lnk - C:\Program Files\Common Files\MySoftware\NewsFlsh.exe [2003-02-27 20:29:35]

R1 ATMhelpr;ATMhelpr;C:\WINDOWS\system32\drivers\ATMhelpr.sys
R1 cdudf_xp;cdudf_xp;C:\WINDOWS\system32\drivers\cdudf_xp.sys
R1 pwd_2k;pwd_2k;C:\WINDOWS\system32\drivers\pwd_2k.sys
R1 UdfReadr_xp;UdfReadr_xp;C:\WINDOWS\system32\drivers\UdfReadr_xp.sys
R3 BCMModem;BCM V.92 56K Modem;C:\WINDOWS\system32\DRIVERS\BCMSM.sys
R3 mmc_2K;mmc_2K;C:\WINDOWS\system32\drivers\mmc_2K.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
S2 CoachCap;Concord EyeQ Duo 2000 USB Video Capture V1.00;C:\WINDOWS\system32\drivers\CoachCap.sys
S3 dvd_2K;dvd_2K;C:\WINDOWS\system32\drivers\dvd_2K.sys
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys
S3 usbsermptxp;Motorola USB Modem Driver for MPT XP;C:\WINDOWS\system32\DRIVERS\usbsermptxp.sys
S3 WrKPoET2000;WrKPoET2000;\??\C:\Program Files\WinPoET Broadband Connection\WrKPoET2000.sys


Contents of the 'Scheduled Tasks' folder
2007-04-21 13:54:33 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-08 18:43:56 C:\WINDOWS\Tasks\ErrorSmart Scheduled Scan.job - C:\Program Files\errorsmart\ErrorSmart.exe
2007-08-08 18:00:56 C:\WINDOWS\Tasks\XoftSpy.job - C:\Program Files\XoftSpy\XoftSpy.exe
2007-08-13 01:47:34 C:\WINDOWS\Tasks\XoftSpySE 2.job
2007-08-02 16:26:37 C:\WINDOWS\Tasks\XoftSpySE.job - C:\Program Files\XoftSpySE\XoftSpy.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-12 20:47:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-12 20:49:30 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-12 20:49
C:\ComboFix2.txt … 2007-08-12 11:47
C:\ComboFix3.txt … 2007-08-10 20:48



Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:32 PM, on 8/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WinPoET Broadband Connection\WrOS.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\BCMSMMSG.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie…ton/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost;
O2 - BHO: EarthLink ScamBlocker V2 - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program Files\EarthLink TotalAccess\Toolbar\EScamBlk.dll
O2 - BHO: EarthLink PopUp Blocker V2 - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program Files\EarthLink TotalAccess\Toolbar\ElnkPuB.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Earthlink Protection BHO - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program Files\EarthLink TotalAccess\Toolbar\ProtctIE.dll
O2 - BHO: Uninstall Legacy Earthlink Toolbar - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program Files\EarthLink TotalAccess\Toolbar\uninsttb.dll
O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program Files\EarthLink TotalAccess\Toolbar\Toolbar.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [LXSUPMON] C:\WINDOWS\system32\LXSUPMON.EXE RUN
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IPInSightMonitor 01] "C:\Program Files\EarthLink TotalAccess\FastLane2\IPMon32.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\GetFlash.exe (User 'Default user')
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: MySoftware NewsFlash.lnk = C:\Program Files\Common Files\MySoftware\NewsFlsh.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.5.107.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/d…/ITDetector.cab
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: WinPPPoverEthernet - iVasion, a Routerware Company - C:\Program Files\WinPoET Broadband Connection\WrOS.EXE

–
End of file - 6597 bytes
Post #18
Your log looks clean. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren
Post #20
Congratulations, your log looks CLEAN

There are a few things you must do once you are completely clean:

1. Time for some housekeeping

Please download the OTMoveIt by OldTimer
  • Save it to your desktop.
  • Run the tool by clicking on the icon.
  • Click the Cleanup button.
  • The tools that we used as well as this one will be removed from your system.

2. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

3. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
And also see TonyKlein's good advice
So how did I get infected in the first place?

Regards,

Trevuren
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI