[Resolved] Cyberlog.x and PSW.x-VIr

A. Warning. Please note that this fix is specific for this poster and should not be used by anyone else:

1. Before we make changes to your registry, we need to make a back up of the key that we are going to work on:

To back up the key please do the following

• Copy the contents of the Code Box below to Notepad.
• Name the file export.reg
• Change the "Save as Type" to All Files
• and Save it on the desktop

regedit /e C:\export-run.reg "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"

Double-click the expor-run.reg file
The backup file will be placed in your C:\ directory as export-run.reg .

If there is a fatal error you can simply double click on the export.reg you just created to restore the registry to the state it was in before you began.
Warning. Do not click it except if I tell you to do so. Double clicking it will reintroduce the malware to your computer and can have other unexpected effects.

2. Please do this:

• Copy the contents of the Code Box below to Notepad.
• Name the file as fix.reg
• Change the Save as Type to All Files
• and Save it on the desktop

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]
"1"=-

Make sure there are NO blank lines before REGEDIT4

Then double-click on the fix.reg file, and when it prompts to merge say yes.


B. Using Internet Explorer, please do a Kaspersky Online Scan

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure as follows:
  • Scan using the following Anti-Virus database:
    
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  [external image: Posted Image]
  
  
• Click the Save as Text button to save the file to your desktop and post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

when i double clicked the "export.reg" file i made on the desktop, it asked me "are you sure you want to add the information in C:\Documents and Settings\gvk\Desktop\export.reg to the registry?" to which i clicked yes. then this error message came up: "cannot import C:\Documents and Settings\gvk\Desktop\export.reg: The specified file is not a registry script. You can only import binary registry files from within the registry editor." what did i do wrong? I will wait for your reply before i make the fix.reg file.

Warning. Do not click it except if I tell you to do so.

Please read the instructions more attentively, we are playing with the registry here.

Continue with the fix.reg portion followed by the Kaspersky scan.

——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Tuesday, April 22, 2008 8:12:45 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 21/04/2008 Kaspersky Anti-Virus database records: 719519 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ Scan Statistics: Total number of scanned objects: 212929 Number of viruses found: 16 Number of infected objects: 50 Number of suspicious objects: 0 Duration of the scan process: 04:49:38 Infected Object Name / Virus Name / Last Action C:\Deckard\System Scanner\20080418235524\backup\DOCUME~1\gvkudav\LOCALS~1\Temp\zfe1.exe Infected: not-virus:Hoax.Win32.Renos.bry skipped C:\Deckard\System Scanner\20080418235524\backup\DOCUME~1\gvkudav\LOCALS~1\Temp\zfe2.exe Infected: Trojan-Downloader.Win32.Zlob.ljr skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_193E.tmp\upgrade.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_193E.tmp\upgrade.exe/stream Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_193E.tmp\upgrade.exe NSIS: infected - 2 skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_305.tmp\upgrade.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.NewDotNet.l skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_305.tmp\upgrade.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_305.tmp\upgrade.exe/stream Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_305.tmp\upgrade.exe NSIS: infected - 3 skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_BA7.tmp\upgrade.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.OneStep.e skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_BA7.tmp\upgrade.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_BA7.tmp\upgrade.exe/stream Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Deckard\System Scanner\20080418235524\backup\WINDOWS\temp\NN_BA7.tmp\upgrade.exe NSIS: infected - 3 skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\08f8194d54dc445522ae64668200a35b_3ffe4398-0cfd-4600-a75d-7e469a03576b Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20080420_Time-100400234_EnterceptExceptions.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20080420_Time-100400234_EnterceptRules.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_SKUDAV.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_SKUDAV.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\cert8.db Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\flashgot.log Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\history.dat Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\key3.db Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\parent.lock Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\search.sqlite Object is locked skipped C:\Documents and Settings\gvkudav\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\gvkudav\Cookies\index.dat Object is locked skipped C:\Documents and Settings\gvkudav\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\gvkudav\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\gvkudav\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\gvkudav\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped C:\Documents and Settings\gvkudav\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Application Data\Mozilla\Firefox\Profiles\3iha9hqv.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\History\History.IE5\MSHist012008042120080422\index.dat Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Temp\hsperfdata_gvkudav\848 Object is locked skipped C:\Documents and Settings\gvkudav\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\gvkudav\NTUSER.DAT Object is locked skipped C:\Documents and Settings\gvkudav\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\gvkudav.ECS\NTUSER.DAT Object is locked skipped C:\Documents and Settings\gvkudav.ECS\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8I1TUD5F\upgrade[1].cab/upgrade.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.OneStep.e skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8I1TUD5F\upgrade[1].cab/upgrade.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8I1TUD5F\upgrade[1].cab/upgrade.exe/stream Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8I1TUD5F\upgrade[1].cab/upgrade.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\8I1TUD5F\upgrade[1].cab CAB: infected - 4 skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9JKUMN6Y\upgrade[1].cab/upgrade.exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.NewDotNet.l skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9JKUMN6Y\upgrade[1].cab/upgrade.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9JKUMN6Y\upgrade[1].cab/upgrade.exe/stream Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9JKUMN6Y\upgrade[1].cab/upgrade.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\9JKUMN6Y\upgrade[1].cab CAB: infected - 4 skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BIBNJ7JV\upgrade[1].cab/upgrade.exe/stream/data0002 Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BIBNJ7JV\upgrade[1].cab/upgrade.exe/stream Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BIBNJ7JV\upgrade[1].cab/upgrade.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\BIBNJ7JV\upgrade[1].cab CAB: infected - 3 skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$INVENTORCONTENT\LOG\ERRORLOG Object is locked skipped C:\Program Files\Network Associates\System Compliance Profiler\PtchScan.log Object is locked skipped C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\RMErrorLog0.txt Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP200\A0017398.dll Infected: not-a-virus:AdWare.Win32.NewDotNet.l skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP200\A0017399.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP224\A0019261.dll Infected: not-a-virus:AdWare.Win32.OneStep.e skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP224\A0019262.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP248\A0020166.exe Infected: not-a-virus:AdWare.Win32.OneStep.c skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP253\A0020415.exe Infected: Trojan-Downloader.Win32.Zlob.lka skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP254\A0020523.exe Infected: Trojan-Downloader.Win32.Zlob.lja skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP254\A0020530.exe Infected: Trojan-Downloader.Win32.Zlob.lja skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP254\A0020531.exe Infected: Trojan-Downloader.Win32.Zlob.lka skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0020699.dll Infected: Trojan-Downloader.Win32.Zlob.ljw skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0020700.exe Infected: Trojan-Downloader.Win32.Zlob.ljl skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021089.exe Infected: Trojan-Downloader.Win32.Zlob.ljz skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021090.exe Infected: Trojan-Downloader.Win32.Zlob.lka skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021091.exe Infected: not-virus:Hoax.Win32.Gavec.bc skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021092.exe Infected: Trojan-Downloader.Win32.Zlob.lja skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021093.exe Infected: Trojan-Downloader.Win32.Zlob.lkd skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021095.exe Infected: Trojan-Downloader.Win32.Zlob.ljx skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021101.exe Infected: not-a-virus:AdWare.Win32.NewDotNet skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP257\A0021102.exe Infected: not-a-virus:AdWare.Win32.NewDotNet.e skipped C:\System Volume Information\_restore{D4D126DA-587D-4E0A-BE5D-DF44CC681A0F}\RP258\change.log Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_7e0.dat Object is locked skipped Scan process completed.

Things are looking much better The infections picked up by Kaspersky are all in Quarantine or will be removed by the following procedure.

A. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


B. Please post a final HijackThis log for confirmation and tell he how your system is running. If all is OK, we will proceed with the final cleanup procedures.


Regards,

Trevuren

the ATFcleaner does not work for some reason…I downloaded it from that link and it's a tiny file. when i double click the exe, the program doesn't start.

We will then proceed the old way:

Clean out your Temporary Internet files. Proceed as follows:

• Quit Internet Explorer and quit any instances of Windows Explorer.
• Click Start, click Control Panel, and then double-click Internet Options.
• On the General tab, click Delete Files under Temporary Internet Files.
• In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
• On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
• Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
• Click OK.

Congratulations, your log looks CLEAN

There are a few things you must do once you system is completely clean:

1. DELETE SmitfraudFix from your desktop.

2. Now Set a New Restore Point to prevent possible reinfection from an old one. Some of the malware you picked up could have been saved in System Restore. Since System Restore is a protected directory, your tools can not access it to delete these bad files which sometimes can reinfect your system. Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next". Give the R.P. a name then click "Create". The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Then go to Start > Run and type: Cleanmgr
• Click "OK".
• Click the "More Options" Tab.
• Click "Clean Up" in the System Restore section to remove all previous restore points except the newly created one.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
  
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

4. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

5. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

6. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

7. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.