whenever i log in on any account, 'setup" appears in the task manager applications. it happened before the computer got severely infected and before this thread. i just want to know what that's all about. any ideas?
Not really sure…how I would troubleshoot that is to selectively disable your startups using msconfig (are you familiar with using it?). You have quite a bit running at startup anyway and may see some performance improvement by disabling some of them. I typically only have my security programs running at startup. I bet that one of the startups is attempting to "do" something. Let me know if you need help with that.
oh and one last thing, everytime i turn on the computer the folder "MCE00000" is created in the windows temp file. the folder is empty. i searched it on google and it seems to be some sort of spyware? im not sure what program is repeatedly creating it.
Those are created by McAfee, nothing to worry about. They'll get cleaned out either when rebooting or cleaning up temp files.
ive also encountered strange files in the prefetch folder which also appears in the task manager processes:
I believe those are all legit. prefetch files. Not sure why they would show up under processes though. May also have something to do with the startups. Again, don't think it's a worry.
If all is well let's clean up.
- Make sure you have an Internet Connection.
- Double-click OTMoveIt2.exe to run it.
- Click on the CleanUp! button
- A list of tool components used in the Cleanup of malware will be downloaded.
- If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
- Click Yes to beging the Cleanup process and remove these components, including this application.
- You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
- Click START then RUN
- Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [external image: Posted Image]
The above procedure will:
- Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
- Reset the clock settings.
- Hide file extensions, if required.
- Hide System/Hidden files, if required.
- Reset System Restore.
~~~~~~~~~~~~~~~~~~~~~~~~~~
You can also delete SDFix and the files/folders it created.
In addition to updating and using what you currently have you may want to consider the following:
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware
Install Winpatrol -
Use
Winpatrol to take control of your PC and provide another layer of security.
Help file and tutorial can be found
Here
Use IE-SPYAD with Zoned Out -
Zoned Out with
IE-SPYAD will block access to malicious websites so you cannot be redirected to them from an infected site or email. Instructions for set up and use can be found at the websites.
NOTE: Works with IE only.
Block unwanted parasites with a custom hosts file -
http://www.mvps.org/winhelp2002/hosts.htm
Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you
Will Not be protected when new malicious programs are released.
I'll leave the thread open a few days in case you have questions or issues.
Regards,
Dave
