[Resolved] hijackthis log, norton can't fix?

Try QuickTime now and get back to me please

Still seems scrambled.. I'm going to view movie trailers and its just a scrambled screen on all the previews… Edit… Actually, it's the high def trailers that I cant see, I can see the normal trailers.

Well that is out of my league. I'm a malware person. I would strongly recommend that you do the following and post back the results before we proceed with final cleanup procedures:


We STRONGLY RECOMMEND that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware now or some time in the future. Some infections already require that this approach be used.

Installing the Recovery Console

1.Go to Microsoft's website => http://support.microsoft.com/kb/310994

2. Select the download that's appropriate for your Operating System.

[external image: Posted Image]



Microsoft Windows XP Home Edition
Service Pack 1
http://www.microsoft.com/downloads/details…05-719F45C382A4

Service Pack 2
http://www.microsoft.com/downloads/details…3D-81C2137FF464

Microsoft Windows XP Professional
Without Service Packs

http://www.microsoft.com/downloads/details…B7-4FED408EA73F

Service Pack 1
http://www.microsoft.com/downloads/details…C2-631504EF5E26

Service Pack 2
http://www.microsoft.com/downloads/details…0C-0A0205368124



3. Download the file & save it as it's originally named. Place it next to ComboFix.exe.

[external image: Posted Image]

4. Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it (As illustrated in the above animation). Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

Does your system meet these specs? QuickTime 7 for Windows: * - 2.0 GHz Intel Pentium 4 or faster processor * - At least 512MB of RAM * - 64MB or greater video card * - Windows XP Service Pack 2 or Vista

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons Haven't rebooted yet.

Probably doesn't meet the standards on the video card, it's a laptop notebook so I guess there is no video card in it. Guess that's the reason for the High Def video not working.

Reboot and tell me what difference you see. Choose normal Windows though.

I don't see any problems thus far, I mean the system is responding well. Should I try to install IE 7 and see if it sticks now or is there more to clean?

The final cleanup procedures need to be done. Then if you want to try IE7 again, go for it. I prefer FireFox myself. I will be closing the topic in a couple of hours.

Congratulations, your logs look CLEAN

There are a few things you must do once you system is completely clean:

Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK
  
  
  
• [external image: Posted Image]

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
  
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Use and Update an Anti-Virus Software - I can not overemphasize the need for you to use and update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. FIREWALL
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

Do not install more than one firewall program because they will conflict with each other


4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

8. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Thanks for all your help, it looks like all the trojans and viruses are gone and I can return this laptop to the owners. They have a young child and had windows update off with no virus or trojan protection. He was downloading every game he could find and the computer was the owner's work computer. As you can imagine, it was a disaster for them. My only problem now is getting the windows updater to work, it doesn't seem to work anymore.. I've been trying to surf microsoft's website to see if they have some way to fix this, but the updater says there are files missing, it goes to fix it, but it never actually fixes. Rinse and repeat.. Thanks again for your help, I appreciate it and I'm sure the owner's of the laptop will as well! Many thanks!! I know this took a lot of your free time.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.