This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved]Hijacked Browser And Startup

524 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Your log looks clean. If you have no more malware-related problems that you are aware of, just give me the OK and we can start the final but essential cleanup procedures and recommendations.

Trevuren
Congratulations, your log looks CLEAN

There are a few things you must do once you are completely clean:

1. Time for some housekeeping

Please download the OTMoveIt by OldTimer
  • Save it to your desktop.
  • Run the tool by clicking on the icon.
  • Click the Cleanup button.
  • The tools that we used as well as this one will be removed from your system.

2. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

3. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:
  • Go to Start > Programs > Accessories > System Tools and click "System Restore".
  • Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
  • Then go to Start > Run and type: Cleanmgr
  • Click "OK".
  • Click the "More Options" Tab.
  • Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.
Here are some tips to reduce the potential for spyware infection in the future:

Make sure you keep your Windows OS current by visiting Windows update
regularly to download and install any critical updates and service packs. With out these you are leaving the backdoor open.

I strongly recommend installing the following applications:
  • Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
  • Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
  • How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
  • How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.
To protect yourself further:
  • Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
And also see TonyKlein's good advice
So how did I get infected in the first place?

Regards,

Trevuren
Trevuren, First of all I want to thank you for all of your help!!! I have been too busy to get a reply posted. I have performed most of the taskes in the previous post but have not installed Spyad because I am not sure how well it plays with IE 7, SpywareBlaster, and Spywareguard. I have also not installed MVPS hosts file yet. Any thoughts on this? Adaware, Spybot, and CA Pest patrol found and removed several Trojans and other lesser invasive malware after the PC looked clean. The only websites I had been to at that point were the ones referenced in your last post to clean up and the one page I had loaded as my homepage, which I don't think is too bad as far as malware goes. The only issue I seem to have at this point is a slow startup into windows. I believe this is due to all tha applications that are loaded at startup. Off the top of my head I have SG; Spywareblaster; the CA suite of Pestpatrol, firewall, etc.; AVG anti-spyware, Google updater. I also allowed google toolbar to load Picasa and Spyware Doctor, but cant figure out how to keep Picasa and Spyware doctor from loading at startup. I will likely uninstall AVG anti-spyware when I get a chance since it is a 30-day trial. Do you know of a good utility to manage th programs that run at startup? I have used sysinternals in the past but some programs seem to get back into the starup somehow. How I got infected in the first place. Probably my kids as they were running pretty out of control. I had the CA associates suite installed, Google toolbar popup blocker, Windows defender, and ran adaware weekly as well as a firewall in my router. Obviously there are/were some major holes there, some of which have been plugged, some probably not. I have access to McAfee Enterprise edithion through work and am likely to install this in place of the CA suite (freebe through Time Warner) that i am not impressed with. What are your thoughts on CA and McAffee? Regards, Andy

I have performed most of the taskes in the previous post but have not installed Spyad because I am not sure how well it plays with IE 7, SpywareBlaster, and Spywareguard. I have also not installed MVPS hosts file yet. Any thoughts on this?


They are all on my machine and have been since I started to learn about the subject of malware.

AVG AV 7.5 turns into a Free version after 30 days. You only lose the automatic update features. You must update manually.


What are your thoughts on CA and McAffee?


I really don't care for either one of them. I spent the $40.00 and got NOD32 by Eset which is one of the best with the other being Kaspersky (No free versions from either company). NOD32 is lighter on resources and a litle less expensive. They are the best on the market right now, in my opinion.

A hardware firewall is not enough (Firewall through your router) and Microsoft's product is not that great. You need good protection from both incoming and unwanted outgoing information. Sunbelt Kerio have a version that becomes free for personal use after their trial period. That is what I use.


Startup speed: The more protection programs you have running at startup the slower the startup. One good one would be enough.

You are currently running, Ewido (No longer useful since it has been replaced by AVG AS (which you also have running, Spyware Doctor, and CA. Pick one from AVG AS, CA and Spyware Doctor and use its shields the others are not required. I missed Windows Defender. Protection does not come from quantity but quality and safe surfing habits.


All the following items may stopped from starting up automatically by Starting HJT , running a Scan and placing a checkmark beside the following ithens. Then with all windows closed, you click on Fix checked and exit the program. then restart your machine. These programs will still be availablr to you on demand whem/if you ever need them, they just will not start for nothing.

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [Winzip Compression Utility] Winzip32.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [OM_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe



I hope this helps,

Trevuren
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI