[Resolved] blue screen locking computer

Hi fdlfrank,



My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for the issues on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.

You aren't running Anti Virus Software

I see Zone Alarm firewall but not Antivirus.
Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network.
Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software (for personal use), from one these excellent vendors NOW:

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition
-Anti-virus program for Windows.
-The home edition is freeware for noncommercial user
3) AVG Anti-Virus Free Edition
- Free edition of the AVG anti-virus program for Windows.
- Available for single computer use for home and non commercial use.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Next

Please download ATF Cleaner by Atribune.
Download - ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Then

Please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform quick scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
• Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it).

Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.

fdlfrank, OK. Go ahead and run ATF and Malwarbytes.

Tomk I ran ATF cleaner and Malwarebytes as you suggested. below is the report of infections found and removed. I downloaded Avira and installed it. Then I tried to shutdown Zone Alarm and just run Avira in the background because ZA uses much resources and slows computer down quite a bit. But when I stopped ZA I got a shield prompt that said my computer is at risk. Can I just run Avira and not ZA? thank you very much for all your time. frank Malwarebytes' Anti-Malware 1.31 Database version: 1510 Windows 5.1.2600 Service Pack 3 12/16/2008 11:38:45 PM mbam-log-2008-12-16 (23-38-45).txt Scan type: Quick Scan Objects scanned: 60633 Time elapsed: 9 minute(s), 2 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 4 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 7 Files Infected: 142 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a051b1ff-8d7e-418b-aabe-4ff 82f4280a2} (Trojan.Conhook) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: C:\Program Files\SpywareBot (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Quarantine (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Registry Backups (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\WINDOWS\system32\nGpxx01 (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\frank lettiere\Local Settings\Temp\NI.UGA6P_0001_N122M2210 (Rogue.Multiple) -> Quarantined and deleted successfully. Files Infected: C:\Program Files\SpywareBot\DataBaseNew.ref (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_21_10_49_12.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_21_13_25_11.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_22_08_40_21.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_22_08_41_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_22_13_33_05.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_23_10_06_18.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_26_09_18_10.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_26_09_18_55.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_27_09_59_30.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_27_23_15_15.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_28_15_54_55.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_07_28_17_59_57.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_01_20_09_30.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_07_14_26_26.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_07_14_26_41.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_08_17_47_50.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_08_17_49_06.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_09_08_17_45.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_09_12_53_36.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_10_09_46_35.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_10_10_07_00.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_10_10_21_29.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_10_10_53_25.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_10_11_04_29.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_10_11_08_39.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_11_08_29_16.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_11_11_37_22.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_09_30_02.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_11_47_57.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_15_05_59.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_15_07_57.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_15_14_57.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_15_49_37.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_16_29_46.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_16_42_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_12_16_57_16.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_14_17_12_19.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_20_09_39_25.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_22_09_35_09.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_22_09_36_42.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_08_22_09_37_14.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_07_18_30_42.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_07_19_24_32.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_11_08_16_10.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_14_10_33_42.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_21_09_03_37.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_21_09_04_11.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_21_09_04_34.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_09_22_19_09_10.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_06_09_51_58.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_14_09_33_18.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_14_09_34_03.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_15_10_44_41.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_20_11_04_35.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_27_08_06_17.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_27_08_10_03.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_27_11_11_58.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_27_11_12_49.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_10_27_11_22_40.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_01_09_53_32.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_04_22_16_34.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_04_22_16_53.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_07_06_24_34.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_16_09_24_52.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_09_59_47.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_10_10_58.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_10_41_14.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_11_30_34.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_11_30_51.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_11_35_38.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_21_20_27.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_17_21_20_44.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_19_19_11_22.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_19_19_11_49.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_24_12_54_21.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_24_12_54_39.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_27_18_01_53.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_11_27_18_02_41.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_01_10_18_22.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_01_10_18_45.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_01_19_08_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_02_22_37_19.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_02_22_38_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_02_23_01_18.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_05_23_10_31.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_05_23_11_22.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_08_16_54_29.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_09_17_27_57.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_12_10_52_17.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_12_10_52_52.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_14_17_06_49.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_18_11_02_43.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_18_11_03_17.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_18_20_19_18.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_18_20_19_59.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2006_12_27_11_49_19.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_01_23_51_27.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_03_16_58_25.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_05_15_33_20.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_05_16_06_59.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_05_16_07_42.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_10_12_36_46.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_10_12_46_07.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_11_20_08_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_20_11_04_52.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_22_10_55_27.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_22_10_56_09.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_27_12_14_12.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_27_12_15_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_01_30_09_35_03.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_03_16_31_44.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_03_16_32_30.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_05_10_31_51.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_15_08_45_07.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_15_09_11_39.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_21_09_40_10.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_24_09_17_42.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_02_24_09_18_26.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_02_11_53_24.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_02_11_54_16.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_02_11_54_39.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_04_11_21_34.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_04_11_35_02.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_06_10_11_53.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_06_10_12_56.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_07_20_26_57.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_12_11_24_48.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_12_11_25_31.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_14_15_10_33.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_14_15_11_28.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2007_03_14_15_20_48.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2008_01_22_12_32_15.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Log\log_2008_01_22_12_32_33.log (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings\CustomScan.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings\IgnoreList.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings\ScanInfo.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings\ScanResults.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings\SelectedFolders.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Program Files\SpywareBot\Settings\Settings.stg (Rogue.SpywareBot) -> Quarantined and deleted successfully. C:\Documents and Settings\frank lettiere\Local Settings\Temp\NI.UGA6P_0001_N122M2210\settings.ini (Rogue.Multiple) -> Quarantined and deleted successfully. C:\Documents and Settings\frank lettiere\GoToAssist_chat2way__317_en.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

fdlfrank,

Can I just run Avira and not ZA?

Yes. If you shut off the Anti-virus of ZA. Keep the firewall on or turn windows firewall on. You want one and only one firewall and Anti-virus running.

Please download SmitfraudFix

Double-click SmitfraudFix.exe
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Tomk I stopped Zone Alarm and am now running Avira. I ran Smithfraud and that report follows below. I think everything looks clean? I hope you see it that way. I can't thank you enough for all your help. frank SmitFraudFix v2.387 Scan done at 12:12:24.21, Thu 12/18/2008 Run from C:\Documents and Settings\frank lettiere\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Palm\AlarmApp.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Palm\HOTSYNC.EXE C:\Program Files\TechSmith\SnagIt 7\SnagIt32.exe C:\Program Files\TechSmith\SnagIt 7\TSCHelp.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\frank lettiere »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FRANKL~1\LOCALS~1\Temp »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\frank lettiere\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FRANKL~1\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix !!!Attention, following keys are not inevitably infected!!! Agent.OMZ.Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Intel® PRO/Wireless 3945ABG Network Connection - Packet Scheduler Miniport DNS Server Search Order: 192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\..\{C540C929-22C8-4B9E-9EF5-932DFA954666}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\..\{C540C929-22C8-4B9E-9EF5-932DFA954666}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\..\{C540C929-22C8-4B9E-9EF5-932DFA954666}: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

fdlfrank, Please let me have one more HijackThis log.

fdlfrank,

Log looks good


You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

Please delete SmitfraudFix.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

• Make your Internet Explorer more secure - This can be done by following these simple instructions:
  
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:

• From your desktop, right-click on My Computer,
• click on Properties
• Select the Automatic Updates tab
• Click on Automatic
• Click on Apply button
• Click on OK to exit.

If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein


Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.