[Resolved] Spyware Infection

mschroe919, hope your doctors appt went well…. we can't afford to lose you right now! Remote procedure is set to automatic. It's status is "started". Remote procedure desktop help is disabled. dresin

Hi dresin Yeah my doctor went well thanks for asking. Lets look at what's in the startup. click Start> Run> type in Msconfig tap enter key. look in the Startup. Make a list of everything with a check mark. Now uncheck everything except your anti-virus. After you uncheck it and rebooting, you'll be using Selective startup. When you see the box popup that tells you that, just put a Check in the Box to not show that when you startup. Reboot and see if Normal Mode now works I also need to see the list you make good luck msschroe919

Things are much better. Actually were better even before the selective start-up - printer working again and able to get into the internet some. Seems to shut down and reboot normally now. Got right in with no problems after selective startup. Here is the list of checked items in startup: jusched hpsysdrv hkcmd sgtray RECGUARD AGRSMMSG lsburnwatcher ISUSPM HPWuSchd2 hphup06 KBD hphmon06 outost ashdisp Googe Desktop Reader_s1 realsched duprep 0 -K ctfmon Super AntiSpyware msmsgs GoogleToolbar Notifier WMPNSCFG Tea Timer HP Digital Imaging Monitor Nikon Monitor One additional thought. I realized that we have been disabling the anti-virus protection on Avast because the internet connection was shutting down at odd times. Most often right when we were in the middle of something important. Probably not a good idea though. Do you think that the anti-virus was interacting with another program to cause this problem? Thanks, dresin

Following up on my note from yesterday. Things are better, but when I tried to shut down last night the computer froze again. Any thoughts? Thanks, dresin

Hi dresin;

Just for now please go back to
click Start> Run> type in Msconfig tap enter key.
and put the check back on outost this is
your firewall. Important to have a firewall.

I will return later with some more ideas.
mschroe919

I wondered about that. OK. Outpost is back on. When I went back to change the startup, I noticed that dumprep 0 -k, SUPERAntispyware, ctfmon and Google Toolbar Notifier were checked again. I did get an Access Denied Error when I unchecked the items in startup. However, I was able to uncheck them. I had a look after rebooting and they are still unchecked. Last, I was unable to get on the internet through explorer. However, I was able to update my spyware and am going to run that now. dresin

Hi

I was unable to get on the internet through explorer.

Was this after you put the check back on outost?
If so go back and uncheck it and reboot and see if you can
access the internet through explorer.

If you can we have to check your firewall settings.
By the way when you installe thei firewall, did
youu stop the windows firewall?

mschroe919

I unchecked Outpost again, rebooted and now am able to get back on the internet through explorer. Windows firewall is on. By the way, ran adaware, spybot and superantispyware and came up clean except for some tracking cookies. This is a major improvement. However, a trojan was caught by my anti-virus while adaware was running. I've also noticed that dumprep 0 -K, ctfmon and Google Toolbar Notifier come back as checked in msconfig startup, even though I unchecked them. dresin

Hi,

Lets set your Outpost to accept IE browser
Here is how:

•Once Agnitum is installed, open up its main configuration window. Go to Options -> Application.
•Select Trusted Applications. Click on Add. Navigate to the location where DC++ is installed, typically C:\Program Files\DCPlusPlus, and select DCPlusPlus.exe.

[external image: Posted Image]

•Once DC++ has been added, it should appear on the list of applications under Trusted Applications.

[external image: Posted Image]


Click on OK

[external image: Posted Image]


•That's it! DC++ is now configured!

let me know if this did it?
mschroe919

I can't find DCPLUSPLUS.exe anywhere. Did a search through subfiles, hidden files, etc. IEXPLORE.EXE is already in the trusted applications. Any thoughts? dresin

I can't find DCPLUSPLUS.exe anywhere. THAT WAS JUST A EXAMPLE SHOWING WHERE YOU PUT YOU TRUSTED PROGRAMS


IEXPLORE.EXE is already in the trusted applications. THIS IS WHAT I WANTED TO MAKE SURE YOU HAVE IT THERE.

next:

Lets see if you have MS firewall on or off:

Go to controll panel switch to classic view, then click on firewall, if on click off.
Then click ok.
Next go to security center click on it, When there on left side under resources
click on the line Change the way security alerts me
there uncheck the box Firewall then ok.

Now if ms firewall is off and yours is on lets see what does with these
mschroe919

Hello mschroe919, Sorry for the delay in responding. Out of town for a day. I turned off windows firewall as you suggested. Turned on Outpost. Rebooted. Tried to get on internet but get the message that explorer can't display the webpage. I've found that when Windows firewall is on and Outpost is off, I have no problems. So I must have something configured incorrectly in Outpost. Thanks, dresin

hello.
Well to tell the truth I havent heard much about the Outpost.
If you don't feel safe with microsoft firewall.
You could try the one I use:
Zone alarm

from ;
HERE:

Other than this I see you are and your Pc is both under controll

I will stick around for you to let me know if you are happy
mschroe919

Thank you very much, mschroe919. I think things are looking pretty good. Seems like this was a tough one and I really appreciate you hanging in there with me. Let's give it a day and see if we run into any more problems. I switched out the firewall. That seems to have helped. Maybe the old one was corrupted somehow. One remaining problem that I've noticed is that shut down takes much longer now. Any thoughts on what I can do about that? Thanks again, dresin

Hi dresin, As far as your shut down goes, here is what I did to mine: create a shutdown icon on desktop here is how: Right click on your desktop and select new > shortcut. In dialog box type shutdown -s -t 01 click next to continue and then type a name for shortcut and click finish. Notice the t 01 the t is for time 01 is for seconds to shut dow you can change the 01 to I think 60 Once you have the Icon you can change the picture of the icon here is how: Right click on the icon then left click on change icon then left click on choose a picture from another from another file, then a window will pop up with pictures pick one abd apply Oh and now you can review the all clean speech I gave you earlier. Some things on there are important…Namely hiding you files again let me know what you think about this quick shut down. Good luck mschroe919