[Resolved] Malware Infection

Hi, and Welcome to WhatTheTech

My name is jpshortstuff. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.


Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location.
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
• Post that log back here.

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

Thanks.

Thank you very much for your help. I ran the scans. Here is the malwarebyte log: Malwarebytes' Anti-Malware 1.30 Database version: 1419 Windows 6.0.6000 11/24/2008 10:43:03 AM mbam-log-2008-11-24 (10-43-03).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 132057 Time elapsed: 1 hour(s), 40 minute(s), 19 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 3 Memory Processes Infected: C:\Windows\System32\msiconf.exe (Trojan.Downloader) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Rapid Antivirus (Rogue.RapidAntivirus) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a20ebc15-667d-3b3e-aa0b-e8e9cd50b42a} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{a20ebc15-667d-3b3e-aa0b-e8e9cd50b42a} (Trojan.BHO) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msiexec.exe (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Users\Matt\AppData\Local\Temp\~ad3E6.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Windows\System32\msiconf.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Windows\System32\mws14686.dll (Trojan.BHO) -> Delete on reboot. Here is the DDS log: DDS (Version 1.0) - NTFSx86 Run by [removed] at 10:45:57.00 on Mon 11/24/2008 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.1013.165 [GMT -5:00] ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\Windows\System32\WLTRYSVC.EXE C:\Windows\System32\bcmwltry.exe C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\aestsrv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Windows\system32\svchost.exe -k bthsvcs C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe C:\Program Files\Dell Support Center\bin\sprtsvc.exe C:\Windows\system32\STacSV.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\DellTPad\Apoint.exe C:\Windows\OEM02Mon.exe C:\Windows\System32\igfxpers.exe C:\Windows\System32\WLTRAY.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\DELL\MediaDirect\PCMService.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\DELL\QuickSet\quickset.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe c:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\system32\taskeng.exe C:\Program Files\Internet Explorer\ieuser.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Windows\system32\NOTEPAD.EXE C:\Windows\system32\Macromed\Flash\FlashUtil9d.exe C:\Users\Matt\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M9PRROVL\dds[1].scr C:\Windows\system32\wbem\wmiprvse.exe ============== Psuedo HJT Report =============== uWindow Title = Internet Explorer provided by Dell BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - c:\program files\common files\symantec shared\coshared\browser\1.7\NppBho.dll BHO: {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre1.6.0\bin\ssv.dll BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll BHO: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - c:\program files\google\googletoolbarnotifier\4.1.805.4472\swg.dll BHO: {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\program files\bae\BAE.dll TB: {90222687-F593-4738-B738-FBEE9C7B26DF} - c:\program files\common files\symantec shared\coshared\browser\1.7\UIBHO.dll TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup uRun: [Aim6] uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [Apoint] c:\program files\delltpad\Apoint.exe mRun: [OEM02Mon.exe] c:\windows\OEM02Mon.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Broadcom Wireless Manager UI] c:\windows\system32\WLTRAY.exe mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start mRun: [] mRun: [PCMService] "c:\program files\dell\mediadirect\PCMService.exe" mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe" mRun: [ECenter] c:\dell\e-center\EULALauncher.exe mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll" mRun: [SymLnch] c:\users\matt\appdata\local\temp\LnchStub.exe mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe" mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [Adobe Photo Downloader] "c:\program files\adobe\photoshop album starter edition\3.2\apps\apdproxy.exe" mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\quickset.lnk - c:\program files\dell\quickset\quickset.exe IE: Send image to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device… - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0\bin\npjpi160.dll IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Notify: igfxcui - igfxdev.dll AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL ============= SERVICES / DRIVERS =============== R1 IDSvix86;Symantec Intrusion Prevention Driver;\??\c:\progra~2\symantec\defini~1\symcdata\idsdefs\20081120.001\IDSvix86.sys [2008-11-21 270384] R2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-10-24 73728] R2 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\ViewpointService.exe" [2007-11-19 24652] R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2007-10-2 179712] R3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-11-24 38496] R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\system32\drivers\OEM02Dev.sys [2007-10-2 235584] R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\system32\drivers\OEM02Vfx.sys [2007-10-2 7424] R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\SYMNDISV.SYS [2007-1-9 38200] S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;"c:\program files\google\google desktop search\GoogleDesktop.exe" [2007-10-2 29744] =============== Created Last 30 ================ 2008-11-24 08:58 –d—– c:\users\matt\appdata\roaming\Malwarebytes 2008-11-24 08:58 15,504 a——- c:\windows\system32\drivers\mbam.sys 2008-11-24 08:58 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2008-11-24 08:58 –d—– c:\programdata\Malwarebytes 2008-11-24 08:58 –d—– c:\program files\Malwarebytes' Anti-Malware 2008-11-24 08:58 –d—– c:\progra~2\Malwarebytes 2008-11-24 08:32 –d—– c:\programdata\Spybot - Search & Destroy 2008-11-24 08:32 –d—– c:\program files\Spybot - Search & Destroy 2008-11-24 08:32 –d—– c:\progra~2\Spybot - Search & Destroy 2008-11-24 08:04 –d—– c:\program files\Trend Micro 2008-11-24 01:18 –d—– C:\N360_BACKUP 2008-11-23 22:51 176,128 a——- c:\windows\system32\ws14686.dll 2008-11-23 22:51 176,128 ——– c:\windows\system32\mws14686.dll 2008-11-23 22:50 –d—– c:\program files\WMVideoPlugin 2008-11-12 08:31 211,456 a——- c:\windows\system32\drivers\mrxsmb10.sys 2008-11-12 08:31 1,194,496 a——- c:\windows\system32\msxml3.dll 2008-11-12 08:31 2,048 a——- c:\windows\system32\msxml3r.dll 2008-11-12 08:31 1,341,440 a——- c:\windows\system32\msxml6.dll 2008-11-12 08:31 2,048 a——- c:\windows\system32\msxml6r.dll 2008-11-02 20:58 –d—– c:\programdata\Apple Computer 2008-11-02 20:55 –d—– c:\programdata\Apple 2008-10-31 19:23 428,032 a——- c:\windows\system32\EncDec.dll 2008-10-31 19:23 217,088 a——- c:\windows\system32\psisrndr.ax 2008-10-31 19:23 1,244,672 a——- c:\windows\system32\mcmde.dll 2008-10-31 19:23 292,352 a——- c:\windows\system32\psisdecd.dll 2008-10-31 19:23 177,152 a——- c:\windows\system32\mpg2splt.ax 2008-10-31 19:23 80,896 a——- c:\windows\system32\MSNP.ax 2008-10-31 19:23 68,608 a——- c:\windows\system32\Mpeg2Data.ax 2008-10-31 19:23 57,856 a——- c:\windows\system32\MSDvbNP.ax 2008-10-29 07:49 441,856 a——- c:\windows\system32\win32spl.dll 2008-10-29 07:49 37,376 a——- c:\windows\system32\printcom.dll ==================== Find3M ==================== 2008-11-24 00:27 –d—– c:\program files\Norton 360 2008-11-23 23:54 –d—– c:\users\matt\appdata\roaming\ICAClient 2008-11-20 16:31 –d—– c:\progra~2\Symantec 2008-10-06 18:12 –d—– c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-01 22:49 826,368 a——- c:\windows\system32\wininet.dll 2008-10-01 22:49 56,320 a——- c:\windows\system32\iesetup.dll 2008-10-01 22:49 52,736 a——- c:\windows\apppatch\iebrshim.dll 2008-10-01 22:48 26,624 a——- c:\windows\system32\ieUnatt.exe 2008-09-30 16:43 1,286,152 a——- c:\windows\system32\msxml4.dll 2008-09-17 23:35 3,470,904 a——- c:\windows\system32\ntoskrnl.exe 2008-09-17 23:35 3,505,208 a——- c:\windows\system32\ntkrnlpa.exe 2008-09-17 21:03 2,027,520 a——- c:\windows\system32\win32k.sys 2008-01-20 18:37 –d—– c:\users\matt\appdata\roaming\Symantec 2008-01-20 15:52 –d—– c:\progra~2\Symantec Temporary Files 2007-11-19 21:00 –d—– c:\progra~2\Viewpoint 2007-10-02 15:47 76 —shr– c:\windows\CT4CET.bin 2008-04-01 08:06 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2008-04-01 08:06 32,768 a–sh— c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2008-04-01 08:06 16,384 a–sh— c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat 2007-10-02 23:28 8,192 a–sh— c:\windows\users\default\NTUSER.DAT ============= FINISH: 10:47:30.26 =============== I attached the DDS attach file. Thank you again for all of your help. I'll look forward to your reply. Matt

Hi

Please Right Click your Start button, and click Explore.
Next, locate and delete the following files and folders (if present):

Files:
c:\windows\system32\ws14686.dll <
c:\windows\system32\mws14686.dll <

Folders:
c:\program files\WMVideoPlugin\ <

If any of them aren't there then don't worry, but if you have a problem deleting one of them then please let me know.


Run Eset NOD32 Online AntiVirus
http://www.eset.eu/online-scanner
Note: You will need to use Internet Explorer for this scan.

• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activex control to install
• Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
• Click Start
• Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checked
• Click Scan
• Wait for the scan to finish
• Re-enable your Anvirisus software.
• A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.

Please post a new HijackThis log as well. How's the computer running at the moment?

Thanks.

Sorry, I forgot you were on Vista, my bad.

For ESET, right-click Internet Explorer and click Run As Administrator…. Then try the online scan.

Don't worry about the HijackThis message, I think I know what that was about.

Thanks.

Thanks! Here's the Eset log: # version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=3637 (20081124) # vers_arch_module=1.064 (20080214) # vers_adv_heur_module=1.066 (20070917) # EOSSerial=ebb3e69771fc064e92c0df47a8bbe04b # end=stopped # remove_checked=false # unwanted_checked=true # utc_time=2008-11-25 12:52:00 # local_time=2008-11-24 07:52:00 (-0500, Eastern Standard Time) # country="United States" # osver=6.0.6000 NT # scanned=1 # found=0 # scan_time=0 Everything seems to be running fine right now. Haven't gotten the fake error message since we started the scans this morning.

Glad to hear things are running better

That HijackThis log looks like an older one. Please right-click HijackThis, click Run As Administrator… and then run a new scan, posting the log here in your next reply. I think we are nearly there

Hi

I'm afraid I'm not familiar with Norton products, so I don't think I can be of any help there. It may be worth asking about this on the Norton Support Forum once we are finished here.


You need to disable TeaTimer, so that it doesn't interfere with our fix.

• Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
• If you have the new version 1.5, click once on Resident Protection, then right-click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
• If you have Version 1.4, Click on Exit Spybot S&D Resident

Open HijackThis. Hit Do A System Scan Only. Place a check next to the following items (if present):
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Close all browsers and windows except for HijackThis and click Fix Checked.


Viewpoint Manager is often installed without the users permission. If you didn't install it, or if you did but you no longer use it, I recommend you get rid of it.

Please click Start >> Control Panel >> Add or Remove Programs.
Find the item below on the list and click Remove.
Viewpoint Manager
Let me know how it goes.


Re-enable TeaTimer:

• Open Spybot
• Click on Tools in bottom left hand corner.
• Click on Resident.
• Check Resident "TeaTimer" box.
• Click on Allow change ONLY to popup box with:
• Entry: SpybotSD Teatimer
• Click on Mode, select Default mode
• Close Spybot

Any more problems apart from Norton? Please post one more HijackThis log.

Thanks.

Hi msiegel629

Log looks good

Yes, get rid of Viewpoint Media Player unless you installed it/use it.

You can now delete any other tools I had you download and use, unless you wish to keep them.


Set correct settings for files that should be hidden in Windows Vista

• Click Start.
• Open My Computer.
• Select Folder and Search Options
• Select the View Tab.
• Under the Hidden files and folders heading select Hide hidden files and folders.
• Check Hide file extensions for known file types
• Check the Hide protected operating system files (recommended) option.
• Click Yes to confirm.
• Click OK.

Now that your system appears to be clean, there's just a few steps I'd like you to take to prevent any future infections.

• System restore:
  We will now clear your existing system restore points and establish a new clean restore point:
  • Click on the Start button to open your Start Menu.
  • Click on the Control Panel menu option.
  • Click on the System and Maintenance menu option.
  • Click on the System menu option.
  • Click on System Protection in the left-hand task list.
  • Create the manual restore point you should click on the Create button. When you press this button a prompt will appear asking you to provide a title for this manual restore point.
  • Type in a title for the manual restore point and press the Create button.
  • Close the System window after you have been advised that the procedure has been successfully completed.
    
  • Next, go to Start > Run and type in cleanmgr
  • Select the More options tab
  • Choose the option to clean up system restore and OK it.
    
    This will remove all restore points except the new one you just created.
  Make sure you do this now, as your System Restore currently has infected files in it.
  
  
• Keeping your Windows up-to-date is crucial to your computer's security. Please go to the Windows Update Site (using Internet Explorer) and download and install all critical updates on a regular basis.
  
  
• Make sure you update your Anti-Virus software regularly, new viruses are being developed all the time.
  
  
• Some more programs that it would be useful to have [OPTIONAL but RECOMMENDED]:
  
  SpywareBlaster is another real-time scanner that prevents most spyware from even being installed.
  Freely available: Download SpywareBlaster
  
  Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

Also, please read this great article by Tony Klein: So How Did I Get Infected In First Place

Glad we could be of assistance.

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

Stay Clean!

jpshortstuff

Everything seems to be working well now…thank you so much for all of your help. You guys are great!!

No problem, glad I could help

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.