[Resolved] Oh wow! What happened!

Things are looking much better.

1. We need you to next get rid of your old Java programs and update to a safer version:

Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

2. Once that is done, we need to give your whole system a total check as our logs are designed to only see certain areas and malware could be dormant in other areas.

Using Internet Explorer, please do a Kaspersky Online Scan

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure as follows:
  • Scan using the following Anti-Virus database:
    
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  [external image: Posted Image]
  
  
• Click the Save as Text button to save the file to your desktop and post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan

KASPERSKY ONLINE SCANNER 7 REPORT Saturday, December 20, 2008 Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, December 20, 2008 19:10:22 Records in database: 1492554 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area My Computer A:\ C:\ D:\ Scan statistics Files scanned 80972 Threat name 7 Infected objects 10 Suspicious objects 0 Duration of the scan 01:58:18 File name Threat name Threats count C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\Ad-Aware QF 20080223 010945.aawqff Infected: not-a-virus:AdWare.Win32.Altnet.l 1 C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\Ad-Aware QF 20080223 010945.aawqff Infected: not-a-virus:AdWare.Win32.Altnet.b 1 C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\bovutaja.dll.vir Infected: Trojan.Win32.Monder.acpz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\fotuwutu.dll.vir Infected: Trojan.Win32.Monder.acpz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\kirenalo.dll.vir Infected: Trojan.Win32.Monder.acxs 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\lebenesa.dll.vir Infected: Trojan.Win32.Monder.aedd 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\pipidiwo.dll.vir Infected: Trojan.Win32.Monder.acpz 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\telelepu.dll.vir Infected: Trojan.Win32.Monder.aedd 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\vavanoho.dll.vir Infected: Trojan.Win32.Monder.aede 1 The selected area was scanned.

Please run the following OTMoveIt3 script as per previous instructions. Remember to post the results. The other items will be cleaned up when we uninstall ComboFix.

:processes
explorer.exe

:Files
C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\Ad-Aware QF 20080223 010945.aawqff

:commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

I did it the first time and the log didn't copy and I closed it, so I did it again, but it did remove "QF 20080223 010945.aawqff" ========== PROCESSES ========== Process explorer.exe killed successfully. ========== FILES ========== File/Folder C:\Documents and Settings\All Users\Application Data\Lavasoft\Ad-Aware 2007\Ad-Aware QF 20080223 010945.aawqff not found. ========== COMMANDS ========== User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12202008_211438 Files moved on Reboot… File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.

This is not a major problem as we are talking about a quarantined file.

Congratulations, your logs look CLEAN

There are a few things you must do once you system is completely clean:

Time for some housekeeping

• OTMoveIt3 Cleanup
  • Make sure you have an Internet Connection.
  • Open OTMoveIt3
  • Click on the green CleanUp! button
  • A list of tool components used in the Cleanup of malware will be downloaded.
  • If your Firewall or Real Time protection attempts to block the tool from reaching the Internet, please allow the tool to do so.
  • Click Yes to begin the Cleanup process and remove these components, including this application.
  • You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.
• ComboFix Cleanup
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
    
    
    
  • [external image: Posted Image]

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer More Secure

• From within Internet Explorer click on the Tools menu and then click on Options.
• Click once on the Security tab.
• Click once on the Internet icon so it becomes highlighted.
• Click once on the Custom Level button.
  
  
  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
• Next press the Apply button and then the OK to exit the Internet Properties page.

2. Use and Update an Anti-Virus Software - I can not overemphasize the need for you to use and update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

3. FIREWALL
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

Do not install more than one firewall program because they will conflict with each other


4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. Install Spybot - Search and Destroy - Download and install Spybot - Search and Destroy with its TeaTimer option. This will provide real time spyware and hijacker protection on your computer alongside your virus protection. You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here:
Instructions for - Spybot S & D and Ad-aware

8. Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Alright! Awesome thanks!

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.