What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Please help Spools.exe

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi there… I was able to install the recovery console….but, when I loaded it to ComboFix….Combofix restarted after it ran thru its stuff. It did that on its own….so, I hope thats okay. Here's the log file from it.

ComboFix 08-06-16.5 - Owner 2008-06-19 9:01:42.6 - NTFSx86
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-05-19 to 2008-06-19 )))))))))))))))))))))))))))))))
.

2008-06-18 19:07 . 2008-06-18 21:17 d——– C:\fixwareout
2008-06-17 22:11 . 2008-06-17 22:11 d——– C:\WINDOWS\ERUNT
2008-06-17 22:03 . 2008-06-18 06:34 d——– C:\SDFix
2008-06-16 21:51 . 2008-06-16 17:36 94,208 –a—— C:\WINDOWS\exwd.exe
2008-06-16 21:43 . 2008-06-16 21:43 577,024 –a—— C:\WINDOWS\SYSTEM32\dllcache\user32.dll
2008-06-16 21:43 . 2008-06-16 21:43 93,696 –a—— C:\qnprukh.exe
2008-06-16 21:43 . 2008-06-16 21:43 69,120 –a—— C:\amtbnr.exe
2008-06-16 21:43 . 2008-06-16 21:43 10,000 –a—— C:\WINDOWS\SYSTEM32\jfiehayd.dll
2008-06-16 21:43 . 2008-06-16 21:43 7,680 –a—— C:\heam.exe
2008-06-16 21:43 . 2008-06-16 21:43 705 –a—— C:\d1.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2003-04-07 01:46 226 —-a-w C:\Program Files\INSTALL.LOG
2001-07-22 02:45 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 07:56 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-04 07:56 1,028,096 –sha-w C:\WINDOWS\SYSTEM32\mfc42.dll
2004-08-04 07:56 54,784 –sh–w C:\WINDOWS\SYSTEM32\msvcirt.dll
2004-08-04 07:56 413,696 –sha-w C:\WINDOWS\SYSTEM32\msvcp60.dll
2004-08-04 07:56 553,472 –sh–w C:\WINDOWS\SYSTEM32\oleaut32.dll
2004-08-04 07:56 83,456 –sha-w C:\WINDOWS\SYSTEM32\olepro32.dll
2004-08-04 07:56 11,776 –sh–w C:\WINDOWS\SYSTEM32\regsvr32.exe
.
Infected C:\WINDOWS\system32\user32.dll hex repaired


((((((((((((((((((((((((((((( snapshot@2008-06-19_ 8.23.51.98 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-19 12:49:04 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-19 14:10:14 2,048 –s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2007-10-11 16:48 212992]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\McAgent.exe" [2005-09-22 18:29 311296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I263"= i263_32.drv
"VIDC.I420"= i263_32.drv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXM6Patch_981116]
–a—— 1998-11-30 19:04 497376 C:\WINDOWS\p_981116.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
——— 2001-08-07 18:36 90112 C:\WINDOWS\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv]
——— 1998-05-07 11:04 52736 c:\windows\system\hpsysdrv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iestart]
–a—— 2006-10-18 21:46 64000 C:\Program Files\Windows Media Player\wmplayer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
——— 2000-08-15 19:25 28739 C:\Program Files\Microsoft Works\WkDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a—— 2002-07-16 12:16 372736 C:\WINDOWS\SYSTEM32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2]
——— 2001-07-03 16:13 81920 C:\WINDOWS\system32\ps2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2008-02-01 00:13 385024 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
–a—— 2002-07-21 14:31 146432 C:\Program Files\Common Files\Real\Update_OB\evntsvc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
–a—— 2006-11-30 22:49 4662776 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Real\\RealOne Player\\realplay.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=

S3 gUSBSTOi;gUSBSTOi;C:\DOCUME~1\Owner\LOCALS~1\Temp\gUSBSTOi.sys []

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-19 09:11:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\mcafee.com\Agent\Mcdetect.exe
C:\PROGRA~1\mcafee.com\VSO\McShield.exe
C:\PROGRA~1\mcafee.com\Agent\McTskshd.exe
C:\WINDOWS\SYSTEM32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
C:\WINDOWS\SYSTEM32\cscript.exe
.
**************************************************************************
.
Completion time: 2008-06-19 9:25:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-19 14:24:52
ComboFix2.txt 2008-06-19 13:24:47

Pre-Run: 2,019,094,528 bytes free
Post-Run: 1,991,344,128 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows Whistler Personal" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

113
Post #17
That is fine, and I should have noted that that method would start combofix.

Hopefully your pop-ups have stopped, as it looks like the active part of the infection is neutralized. Still some work to do though.

Please download the OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt2.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    [kill explorer]
C:\WINDOWS\exwd.exe
C:\qnprukh.exe
C:\amtbnr.exe
C:\WINDOWS\SYSTEM32\jfiehayd.dll
C:\heam.exe
C:\d1.exe
purity 
[start explorer]
  • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
  • Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Use ATF Cleaner to remove temp files,
cookies, cache, ect…
Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Lets run an F-Secure online scan for Viruses, Spyware and RootKits:
  • Go to http://support.f-secure.com/enu/home/ols.shtml
  • Scroll to the bottom of the page and click the Start scanning button. A window will pop up.
  • Allow the Active X control to be installed on your computer, then click the Accept button
  • Click Full System Scan and allow the components to download and the scan to complete.
  • If malware is found, check Submit samples to F-Secure then select Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
If Automatic cleaning with Submit samples hangs, click Cancel, then New Scan
  • When the cleaning option is presented, Uncheck Submit samples to F-Secure
  • Click Automatic cleaning
  • When cleaning has finitished, click Show report (this will open an Internet Explorer window containing the report)
  • Highlight and Copy (CTRL + C) the complete report, and Paste (CTRL + V) in a new reply to this post
Notes:
  • This scan will only work with Internet Explorer
  • You must have administrator rights to run this scan
  • This scan can take several hours, so please be patient



Post a new HijackThis log and let me know how it's running now.
Post #18
The F-Scan was scanning for more than 3 hours, and then finally the window shut down. My computer said it was running low on virtual memory, and I think it shut the browser down before it finished. Here's my MBAM log, OTMove it, and HJT log.

Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d533de66-2b14-490e-b016-2720ce19dca1} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{8be255a8-2c24-4969-a642-1be88efd6986} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6ae377b2-39f5-46e8-8b93-0cf4ba12dada} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{eae7a9c6-14c8-4855-ba97-84bc5f4cd910} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{e6e82c9d-3bf1-4657-8e45-3dea97d1b88c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vrmdtneg.bkod (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vrmdtneg.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\SearchMigratedDefaultURL (Trojan.Zlob) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchUrl\w\ (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\SYSTEM32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.



Explorer killed successfully
C:\WINDOWS\exwd.exe moved successfully.
C:\qnprukh.exe moved successfully.
C:\amtbnr.exe moved successfully.
C:\WINDOWS\SYSTEM32\jfiehayd.dll NOT unregistered.
C:\WINDOWS\SYSTEM32\jfiehayd.dll moved successfully.
C:\heam.exe moved successfully.
C:\d1.exe moved successfully.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 06192008_110107


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:06:27 PM, on 6/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\LogFileHJT.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 2243 bytes


Computer seems to be running better….but, you tell me…anything still out there that we haven't gotten yet?
Post #19
I think we have got most of it. I would still like to see a virus scan run. We can try another online scan. I prefer to run Kaspersky online scanner but it requires Java now which you do not have installed. Also, is your McAfee AV fully up to date? And have you run a full system scan with it? If not I would recommend that also. Let's try another online scan too…

You will need to run this with Internet Explorer.
Run Panda's ActiveScan from here and perform a full system scan.
  • Once you are on the Panda site click the "Scan your PC" button
  • A new window will open…
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address
  • Select either Home User or Company
    NOTE: If you do not want to receive any marketing material from Panda select I do not want… at the bottom.
  • Click the big Free Online Scan button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
  • If you are on a slow connection it will take about 15 minuites for the scanner to load.
  • Click on "Local Disks" to start the scan
  • Once scan is done, click "see report" then "save report"
  • Save the log someplace you can find
  • Reboot
  • Post the Panda scan results in your next reply
Post #20 last edited
Hi there.. how are u? Apparently I don't have the necessary system requirements to run Panda Scan 2.0. Thats what it tells me anyway. My computer is pretty old…about 7 years. Also, I don't have an up to date McAfee…. haven't run a scan on that in some time….and I can't because my subscription is expired.
Post #22 last edited
Good morning… I uninstalled McAfee, and installed AVG… I ran a scan. Here's the results of that.

"Scan ""Scan whole computer"" was finished."
"Infections found:";"61"
"Infected objects removed or healed";"61"
"Not removed or healed.";"0"
"Spyware found:";"7"
"Spyware removed:";"7"
"Not removed:";"0"
"Warnings count:";"42"
"Information count:";"0"
"Scan started:";"Friday, June 20, 2008, 12:04:37 AM"
"Total object scanned:";"470030"
"Time needed:";"2 hour(s) 6 minute(s) 27 second(s) "
"Errors encountered:";"0"

"Infections"
"File";"Infection";"Result"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20070803-192054-283.dll";"Trojan horse BHO.ALC";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20070804-124938-746.dll";"Trojan horse BHO.ALE";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20080522-213901-179.dll";"Trojan horse FakeAlert.C";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20080616-214709-882.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20080616-215434-232.dll";"Trojan horse Downloader.Adload.MB";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20080616-215434-461.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20080616-222327-650.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"
"C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip:\WINDOWS\NDNuninstall4_50.exe";"Trojan horse Dialer.23.AW";"Moved to Virus Vault"
"C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip";"Trojan horse Dialer.23.AW";"Moved to Virus Vault"
"C:\QooBox\Quarantine\catchme2008-06-19_ 74420.07.zip:\iifCTMfF.dll";"Trojan horse Vundo.J";"Moved to Virus Vault"
"C:\QooBox\Quarantine\catchme2008-06-19_ 74420.07.zip";"Trojan horse Vundo.J";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\cftmon.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\d.exe";"Trojan horse Proxy.ACIT";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\neltabxw.exe";"Trojan horse Agent.WVT";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\opnmJAtr.dll";"Trojan horse Generic10.AFLT";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\vrmdtneg.dll";"Trojan horse Downloader.Zlob.SE";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\wpvmqosg.dll";"Trojan horse Agent.WVU";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip:\backups\xvorfwbd.dll";"Trojan horse Agent.WVV";"Moved to Virus Vault"
"C:\SDFix\backups\backups.zip";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\SDFix\backups\catchme.zip:\kdtej.exe";"Trojan horse DNSChanger.AD";"Moved to Virus Vault"
"C:\SDFix\backups\catchme.zip:\narqwe.sys";"Trojan horse BackDoor.Generic9.AVIL";"Moved to Virus Vault"
"C:\SDFix\backups\catchme.zip:\spools.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\SDFix\backups\catchme.zip";"Trojan horse DNSChanger.AD";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1887\A0217468.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1887\A0217477.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217483.exe";"Trojan horse DNSChanger.AD";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217485.dll";"Trojan horse Generic10.AFLT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217486.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217487.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217488.exe";"Trojan horse Proxy.ACIT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217489.exe";"Trojan horse Agent.WVT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217490.dll";"Trojan horse Downloader.Zlob.SE";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217491.dll";"Trojan horse Agent.WVU";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217492.dll";"Trojan horse Agent.WVV";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217500.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217501.exe";"Trojan horse Proxy.ACIT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217503.exe";"Trojan horse Agent.WVT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217504.dll";"Trojan horse Generic10.AFLT";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217506.dll";"Trojan horse Downloader.Zlob.SE";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217507.dll";"Trojan horse Agent.WVU";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1888\A0217508.dll";"Trojan horse Agent.WVV";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1890\A0217619.dll";"Trojan horse Agent.WAF";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1890\A0217621.dll";"Trojan horse Generic10.AQFA";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1890\A0217622.dll";"Trojan horse Generic10.AQAM";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1890\A0217623.dll";"Trojan horse Generic10.AOPZ";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1890\A0217624.dll";"Trojan horse Generic10.AQDF";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1890\A0217632.dll";"Virus found Vundo";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1891\A0217813.exe";"Virus found Win32/PEPatch";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217855.dll";"Trojan horse BHO.ALC";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217856.dll";"Trojan horse BHO.ALE";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217858.dll";"Trojan horse FakeAlert.C";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217859.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217860.dll";"Trojan horse Downloader.Adload.MB";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217861.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217862.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"
"C:\_OTMoveIt\MovedFiles\06192008_110107\amtbnr.exe";"Trojan horse Generic10.AMHX";"Moved to Virus Vault"
"C:\_OTMoveIt\MovedFiles\06192008_110107\d1.exe";"Trojan horse Small.AU";"Moved to Virus Vault"
"C:\_OTMoveIt\MovedFiles\06192008_110107\heam.exe";"Trojan horse Downloader.Agent.AHJZ";"Moved to Virus Vault"
"C:\_OTMoveIt\MovedFiles\06192008_110107\qnprukh.exe";"Trojan horse SHeur.BMHH";"Moved to Virus Vault"
"C:\_OTMoveIt\MovedFiles\06192008_110107\WINDOWS\exwd.exe";"Trojan horse Downloader.Adload.KZ";"Moved to Virus Vault"
"C:\_OTMoveIt\MovedFiles\06192008_110107\WINDOWS\SYSTEM32\jfiehayd.dll";"Trojan horse Downloader.Agent.AGHX";"Moved to Virus Vault"

"Spyware"
"File";"Infection";"Result"
"C:\Program Files\GameSpy Arcade\GSAPak.exe";"Adware Generic2.ZHX";"Moved to Virus Vault"
"C:\Program Files\Trend Micro\HijackThis\backups\backup-20080518-211731-821.dll";"Adware Generic3.EFB";"Moved to Virus Vault"
"C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip:\WINDOWS\NDNuninstall4_34.exe";"Adware Generic.KKK";"Moved to Virus Vault"
"C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip:\WINDOWS\NDNuninstall4_80.exe";"Adware Generic.DPY";"Moved to Virus Vault"
"C:\Program Files\Yahoo!\YPSR\Quarantine\20050903083727531.zip:\WINDOWS\NDNuninstall4_88.exe";"Adware Generic.DQF";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217854.exe";"Adware Generic2.ZHX";"Moved to Virus Vault"
"C:\System Volume Information\_restore{593172EE-14D9-4262-8426-24BF2115D284}\RP1892\A0217857.dll";"Adware Generic3.EFB";"Moved to Virus Vault"

"Warnings"
"File";"Infection";"Result"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00110011-4B0B-44D5-9718-90C88817369B}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{086AE192-23A6-48D6-96EC-715F53797E85}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0EDC6C20-A31C-11DB-8AB9-0800200C9A66}";"Found Adware.RogueSuspect";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{11904CE8-632A-4856-A7CC-00B33FE71BD8}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{150FA160-130D-451F-B863-B655061432BA}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{17DA0C9E-4A27-4ac5-BB75-5D24B8CDB972}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C4DA27D-4D52-4465-A089-98E01BB725CA}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C78AB3F-A857-482e-80C0-3A1E5238A565}";"Found Adware.Isearch";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB1}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1F48AA48-C53A-4E21-85E7-AC7CC6B5FFB2}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2D38A51A-23C9-48a1-A33C-48675AA2B494}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2E9CAFF6-30C7-4208-8807-E79D4EC6F806}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3AAC4C68-AFC8-11DB-80EF-8AF955D89593}";"Found Adware.RogueSuspect";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{3CEFF6CD-6F08-4E4D-BCCD-FF7415288C3B}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4A2AACF3-ADF6-11D5-98A9-00E018981B9E}";"Found Adware.NewDotNet";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8333C319-0669-4893-A418-F56D9249FCA6}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9C691A33-7DDA-4C2F-BE4C-C176083F35CF}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A6F42CAD-2559-48DF-AF30-89E480AF5DFA}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C95FE080-8F5D-11D2-A20B-00AA003C157A}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CE7C3CF0-4B15-11D1-ABED-709549C10000}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CF021F40-3E14-23A5-CBA2-717765721306}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E2B2B5A1-B48C-4886-A318-723916A01024}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E2DDF680-9905-4dee-8C64-0A5DE7FE133C}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E3EEBBE8-9CAB-4C76-B26A-747E25EBB4C6}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E6D5237D-A6C7-4C83-A67F-F9F15586FA62}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E7AFFF2A-1B57-49C7-BF6B-E5123394C970}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F1FABE79-25FC-46de-8C5A-2C6DB9D64333}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FCADDC14-BD46-408A-9842-CDBE1C6D37EB}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FD9BC004-8331-4457-B830-4759FF704C22}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FF1BF4C7-4E08-4A28-A43F-9D60A9F7A880}";"Found Adware.Generic";"Potentially dangerous object"
"HKLM\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FFD2825E-0785-40C5-9A41-518F53A8261F}";"Found Adware.TitanShieldAntispyware";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt:\2o7.net.e7e7d917";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@2o7[2].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt:\atdmt.com.b3e33b5f";"Found Tracking cookie.Atdmt";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@atdmt[2].txt";"Found Tracking cookie.Atdmt";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.e9dbeb91";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@revsci[1].txt";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt:\tribalfusion.com.dcc03271";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object"
"C:\Documents and Settings\Owner\Cookies\owner@tribalfusion[2].txt";"Found Tracking cookie.Tribalfusion";"Potentially dangerous object"


Here's a new HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:34:31 AM, on 6/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Owner\Desktop\LogFileHJT.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [Cleanup] C:\DOCUME~1\Owner\LOCALS~1\Temp\2008619234847_mcappins.exe /v=3 /cleanup
O4 - HKLM\..\Run: [msci] C:\DOCUME~1\Owner\LOCALS~1\Temp\2008619234837_mcinfo.exe /insfin
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Acesoft\Tracks Eraser Pro\autocomp.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 2537 bytes
Post #23
Most of what AVG found is in your restore points or quarantined, and is harmless. We can clean that out now.

Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


  • [external image: Posted Image]
The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.

  • Make sure you have an Internet Connection.
  • Double-click OTMoveIt2.exe to run it.
  • Click on the CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
  • Click Yes to beging the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

I know you have an older system and need to watch what you use due to limited resources, but you need to add some security here, as you were extremely infected.

In addition to updating and using what you currently have you may want to consider the following:

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. Here are some free and evalutation versions that provide
better security than the Windows Firewall. Comodo
Outpost Firewall
For a tutorial on Firewalls and a listing of some other available ones see the link below:
Understanding and Using Firewalls

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install Spybot - Search and Destroy - Spybot: Search And Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
A tutorial on installing & using this product can be found here:
Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

Install Ad-Aware - Ad-Aware SE You should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.
A tutorial on installing & using this product can be found here:
Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install SpywareGuard - SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.
A tutorial on installing & using this product can be found here:
Using SpywareGuard to protect your computer from Spyware and Malware

Use Zoned Out -
Zoned Out will block access to malicious websites so you cannot be redirected to them from an infected site or email. Instructions for set up and use can be found at the website.

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Here is a great link to a post here on securing your PC after an attack.
http://www.castlecops.com/t7736-So_how_did…irst_place.html
Post #24
Great! Thanks for all those links. I'll be certain to keep it more updated. The lap top I have is newer, and updated reguarly, but I've kinda let that poor old desk top go! So, is it all clear now? Or still infected some?
Post #29
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI