I'm being Hijacked.

sakdieselsakdiesel NC
edited June 2009 in Spyware & Virus Removal
I seem to have a problem. Every time I google something, I click on the links which promptly take me to some random search page. I cannot seem to find the little bug that is causing me problems. When I try to run Malwarebyte's Antimalware or Spybot S&D they shut down shortly after they start scanning. I need some help. :eek3:

If it helps I have uploaded the log from hijack this

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:31:10 PM, on 6/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\LckFldService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Slacker\USB Station Refresher\slacker.portable.service.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\WinPatrol\winpatrol.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
D:\steam\steam.exe
C:\Documents and Settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Process Viewer 5\PrcView.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate1c99d1a3ca68e8e) (gupdate1c99d1a3ca68e8e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe
O23 - Service: Slacker Portable Service - Slacker - C:\Program Files\Slacker\USB Station Refresher\slacker.portable.service.exe
O23 - Service: Slacker Portable Service - Slacker - C:\Program Files\Slacker\USB Station Refresher\slacker.portable.service.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 8766 bytes

Comments

  • KatanaKatana
    edited June 2009
    Please note that all instructions given are customised for this computer only,
    the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.

    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly laechel.gif

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe


    IMPORTANT
    I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    BitTorrent DNA
    I'd like you to read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Also available here.

    My recommendation is you go to Control Panel > Add/Remove Programs and uninstall any P2P programs
    Please note: you must NOT use any P2P whilst we are cleaning your machine.


    Download and Run RSIT
    • Please download Random's System Information Tool by random/random from here and save it to your desktop.
    • Double click on RSIT.exe to run RSIT.
    • Click Continue at the disclaimer screen.
    • Once it has finished, two logs will open:
      • log.txt will be opened maximized.
      • info.txt will be opened minimized.
    • Please post the contents of both log.txt and info.txt.



    Please Download GMER to your desktop

    Download GMER and extract it to your desktop.

    ***Please close any open programs ***

    Double-click gmer.exe. The program will begin to run.

    **Caution**
    These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised by a trained Security Analyst

    If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
    • Click Yes.
    • Once the scan is complete, you may receive another notice about rootkit activity.
    • Click OK.
    • GMER will produce a log. Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.

    If you do not receive notice about possible rootkit activity remain on the Rootkit/Malware tab & make sure the 'Show All' button is unticked.
    • Click the Scan button and let the program do its work. GMER will produce a log.
    • Click on the Save button, and save the log as gmer.txt somewhere you can easily find it, such as your desktop.


    DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

    Please post the results from the GMER scan in your reply.
  • sakdieselsakdiesel NC
    edited June 2009
    I had a small problem while running GMER. I set it to run and then had to leave the house. When I came back to my computer today, there was a program running that took over everything. I could run nothing at all. It was some sort of fake antivirus program that even changed my wallpaper to a large warning about how I was infected. It then started the "antivirus" program, which I could not shut down. I rebooted to the same thing. I then rebooted into safe mode and ran Malwarebyte's Antimalware. It appears to have stopped it at least and I now have control of my computer again. I am attaching the log files you requested.

    Also, here is the log from MBAM:

    Malwarebytes' Anti-Malware 1.37
    Database version: 2254
    Windows 5.1.2600 Service Pack 3

    6/14/2009 1:42:58 PM
    mbam-log-2009-06-14 (13-42-42).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 151682
    Time elapsed: 17 minute(s), 46 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 2
    Registry Data Items Infected: 0
    Folders Infected: 2
    Files Infected: 5

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\11258904 (Rogue.Multiple.H) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\91268896 (Rogue.Multiple.H) -> No action taken.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    C:\Documents and Settings\All Users\Application Data\11258904 (Rogue.Multiple.H) -> No action taken.
    C:\Documents and Settings\All Users\Application Data\91268896 (Rogue.Multiple.H) -> No action taken.

    Files Infected:
    c:\documents and settings\all users\application data\11258904\11258904.exe (Rogue.Multiple.H) -> No action taken.
    c:\documents and settings\all users\application data\11258904\11258904.glu (Rogue.Multiple.H) -> No action taken.
    c:\documents and settings\all users\application data\11258904\pc11258904cnf (Rogue.Multiple.H) -> No action taken.
    c:\documents and settings\all users\application data\11258904\pc11258904ins (Rogue.Multiple.H) -> No action taken.
    c:\documents and settings\all users\application data\91268896\91268896.exe (Rogue.Multiple.H) -> No action taken.
  • KatanaKatana
    edited June 2009
    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply
    • Re-enable all the programs that were disabled during the running of ComboFix..



    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper
  • sakdieselsakdiesel NC
    edited June 2009
    I am trying to turn AVG Anti-Virus off but cannot find out how. I even tried to uninstall it and recieved the error message:
    Local machine: installation failed
    Installation:
    Error: Action failed for registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows: creating registry key....
    Error 0x80070005


    any ideas?
  • sakdieselsakdiesel NC
    edited June 2009
    didn't get an answer so I ran combofix and have attached the logfile

    ComboFix 09-06-13.09 - Jeff 06/14/2009 17:36.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1655 [GMT -4:00]
    Running from: c:\documents and settings\Jeff\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\drivers\SKYNETwprqbabb.sys
    c:\windows\system32\SKYNETdqtqjdat.dat
    c:\windows\system32\SKYNETliilbpfu.dll
    c:\windows\system32\SKYNETmqwuypnt.dat
    c:\windows\system32\SKYNETqomudpux.dll
    c:\windows\system32\wl.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Service_SKYNETpxmyvotk


    ((((((((((((((((((((((((( Files Created from 2009-05-14 to 2009-06-14 )))))))))))))))))))))))))))))))
    .

    2009-06-14 17:23 . 2009-06-14 17:23
    d
    w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2009-06-14 17:15 . 2009-06-14 17:15
    d-sh--w- c:\documents and settings\Administrator\IETldCache
    2009-06-13 12:32 . 2009-06-13 12:32
    d
    w- C:\rsit
    2009-06-13 12:25 . 2009-06-13 12:25 75264 ----a-w- c:\windows\cadkasdeinst01e.exe
    2009-06-13 12:25 . 2009-06-13 12:25
    d
    w- c:\program files\Dividers and Ruler 1
    2009-06-12 19:35 . 2009-06-12 19:35
    d
    w- c:\program files\Trend Micro
    2009-06-12 19:33 . 2009-06-12 19:33 812344 ----a-w- C:\HJTInstall.exe
    2009-06-12 17:30 . 2009-06-12 17:31
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-06-12 17:30 . 2009-06-12 17:31
    d
    w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-06-12 13:02 . 2008-06-11 14:47 9022288 ----a-w- c:\documents and settings\Jeff\Application Data\TomTom\HOME\Profiles\o9oqtmk6.default\extensions\Navcore.8.010.9369@tomtom.com\8-010-9369-1.dll
    2009-06-11 11:23 . 2009-06-11 11:23 152576 ----a-w- c:\documents and settings\Jeff\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
    2009-06-11 04:54 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
    2009-06-11 04:54 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
    2009-06-09 15:44 . 2009-06-09 15:44 3371383 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-06-08 16:01 . 2009-06-08 16:01
    d-sh--w- c:\documents and settings\Jeff\PrivacIE
    2009-06-08 13:12 . 2009-06-08 13:12
    d-sh--w- c:\documents and settings\LocalService\IETldCache
    2009-06-07 20:29 . 2009-06-07 20:29
    d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2009-06-07 20:27 . 2009-06-07 20:27
    d-sh--w- c:\documents and settings\Jeff\IETldCache
    2009-06-07 20:05 . 2009-06-07 20:05
    d
    w- c:\windows\ie8updates
    2009-06-07 20:05 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll
    2009-06-07 20:05 . 2009-06-07 20:05
    dc-h--w- c:\windows\ie8
    2009-06-05 14:06 . 2008-12-04 05:25 120832 ----a-w- c:\documents and settings\Jeff\Application Data\Mozilla\Firefox\Profiles\5rk2i35a.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
    2009-06-01 21:44 . 2009-06-01 21:44
    d
    w- c:\documents and settings\Jeff\Application Data\WinPatrol
    2009-06-01 21:44 . 2009-02-21 20:54 0 ----a-w- c:\documents and settings\Jeff\Application Data\WinPatrol\Config.sys
    2009-06-01 21:44 . 2009-02-21 20:54 0 ----a-w- c:\documents and settings\Jeff\Application Data\WinPatrol\Autoexec.bat
    2009-06-01 21:44 . 2009-06-03 23:48
    d
    w- c:\program files\WinPatrol
    2009-06-01 21:40 . 2007-03-10 04:37 139264 ----a-w- c:\windows\system32\viscomqtde.dll
    2009-06-01 21:40 . 2007-03-10 04:36 81920 ----a-w- c:\windows\system32\viscomwave.dll
    2009-06-01 21:40 . 2006-08-02 09:01 438272 ----a-w- c:\windows\system32\SkinCrafter.dll
    2009-06-01 21:40 . 2009-06-01 21:40
    d
    w- c:\program files\Extra YouTube FLV Downloader + Video Converter
    2009-05-27 22:36 . 2009-05-27 22:39 26123 ----a-w- c:\windows\scunin.dat
    2009-05-27 22:36 . 2009-05-27 22:39 967 ----a-w- c:\windows\ScUnin.pif
    2009-05-27 22:36 . 2009-05-27 22:39 70656 ----a-w- c:\windows\ScUnin.exe
    2009-05-27 00:31 . 2009-05-27 00:33 122686 ----a-w- c:\windows\hpqins00.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-06-14 21:29 . 2009-03-23 02:47
    d
    w- c:\documents and settings\Jeff\Application Data\DNA
    2009-06-14 20:42 . 2009-02-21 22:22
    d
    w- c:\documents and settings\All Users\Application Data\avg8
    2009-06-14 17:45 . 2009-03-23 02:47
    d
    w- c:\program files\DNA
    2009-06-14 17:33 . 2009-02-23 19:07 664 ----a-w- c:\windows\system32\d3d9caps.dat
    2009-06-13 13:02 . 2009-03-03 06:41 74 ----a-w- c:\windows\system32\mslck.dat
    2009-06-13 02:26 . 2009-06-13 02:24
    d
    w- c:\program files\MSI
    2009-06-13 02:16 . 2009-02-24 22:50 1 ----a-w- c:\documents and settings\Jeff\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
    2009-06-12 02:12 . 2009-03-01 16:13 139112 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys
    2009-06-12 02:12 . 2009-03-01 16:12 202144 ----a-w- c:\windows\system32\PnkBstrB.exe
    2009-06-11 16:17 . 2009-04-10 02:25
    d
    w- c:\documents and settings\Jeff\Application Data\HPAppData
    2009-06-11 11:24 . 2009-02-23 01:50
    d
    w- c:\program files\Java
    2009-06-09 15:45 . 2009-02-24 22:41
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-06-06 13:08 . 2009-05-06 21:29
    d
    w- c:\program files\Coupons
    2009-05-26 17:20 . 2009-02-24 22:41 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-05-26 17:19 . 2009-02-24 22:41 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-05-21 15:33 . 2009-02-23 01:50 410984 ----a-w- c:\windows\system32\deploytk.dll
    2009-05-18 21:16 . 2009-03-04 22:38
    d
    w- c:\program files\Google
    2009-05-13 19:49 . 2009-05-13 19:49 21840 ----a-w- c:\windows\system32\SIntfNT.dll
    2009-05-13 19:49 . 2009-05-13 19:49 17212 ----a-w- c:\windows\system32\SIntf32.dll
    2009-05-13 19:49 . 2009-05-13 19:49 12067 ----a-w- c:\windows\system32\SIntf16.dll
    2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
    2009-05-07 15:32 . 2009-02-22 04:59 345600
    w- c:\windows\system32\localspl.dll
    2009-05-03 11:10 . 2009-02-22 04:29
    d
    w- c:\program files\Common Files\Wise Installation Wizard
    2009-05-01 13:07 . 2009-02-21 22:23 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-05-01 13:07 . 2009-02-21 22:22 325896 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-05-01 13:07 . 2009-02-21 22:22 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-05-01 13:07 . 2009-02-21 22:23 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-04-29 03:08 . 2009-05-03 11:09 1579630 ----a-w- c:\windows\system32\nvdata.bin
    2009-04-29 03:08 . 2009-05-03 11:09 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll
    2009-04-29 03:08 . 2009-02-22 04:29 457248 ----a-w- c:\windows\system32\nvudisp.exe
    2009-04-29 03:08 . 2009-02-18 18:44 663552 ----a-w- c:\windows\system32\nvcuvid.dll
    2009-04-29 03:08 . 2009-01-15 13:19 9994240 ----a-w- c:\windows\system32\nvoglnt.dll
    2009-04-29 03:08 . 2009-01-15 13:19 806912 ----a-w- c:\windows\system32\nvapi.dll
    2009-04-29 03:08 . 2009-01-15 13:19 8055424 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
    2009-04-29 03:08 . 2009-01-15 13:19 5896192 ----a-w- c:\windows\system32\nv4_disp.dll
    2009-04-29 03:08 . 2009-01-15 13:19 1720320 ----a-w- c:\windows\system32\nvcuda.dll
    2009-04-29 03:08 . 2009-01-15 13:19 143360 ----a-w- c:\windows\system32\nvcodins.dll
    2009-04-29 03:08 . 2009-01-15 13:19 143360 ----a-w- c:\windows\system32\nvcod.dll
    2009-04-29 02:06 . 2009-04-29 02:06 466944 ----a-w- c:\windows\system32\nvshell.dll
    2009-04-29 02:06 . 2009-04-29 02:06 449056 ----a-w- c:\windows\system32\nvappbar.exe
    2009-04-29 02:06 . 2009-04-29 02:06 436768 ----a-w- c:\windows\system32\keystone.exe
    2009-04-29 02:06 . 2009-04-29 02:06 1724416 ----a-w- c:\windows\system32\nvwdmcpl.dll
    2009-04-29 02:06 . 2009-04-29 02:06 1657376 ----a-w- c:\windows\system32\nwiz.exe
    2009-04-29 02:06 . 2009-04-29 02:06 1101824 ----a-w- c:\windows\system32\nvwimg.dll
    2009-04-29 02:06 . 2009-04-29 02:06 1507328 ----a-w- c:\windows\system32\nview.dll
    2009-04-29 02:06 . 2009-04-29 02:06 1194528 ----a-w- c:\windows\system32\nvcplui.exe
    2009-04-29 02:06 . 2009-04-29 02:06 81920 ----a-w- c:\windows\system32\nvwddi.dll
    2009-04-29 02:06 . 2009-04-29 02:06 3117056 ----a-w- c:\windows\system32\nvwss.dll
    2009-04-29 02:06 . 2009-04-29 02:06 4038656 ----a-w- c:\windows\system32\nvvitvs.dll
    2009-04-29 02:06 . 2009-04-29 02:06 1282048 ----a-w- c:\windows\system32\nvmobls.dll
    2009-04-29 02:05 . 2009-04-29 02:05 86016 ----a-w- c:\windows\system32\nvmctray.dll
    2009-04-29 02:05 . 2009-04-29 02:05 4014080 ----a-w- c:\windows\system32\nvdisps.dll
    2009-04-29 02:05 . 2009-04-29 02:05 3510272 ----a-w- c:\windows\system32\nvgames.dll
    2009-04-29 02:05 . 2009-04-29 02:05 188416 ----a-w- c:\windows\system32\nvmccss.dll
    2009-04-29 02:05 . 2009-04-29 02:05 168004 ----a-w- c:\windows\system32\nvsvc32.exe
    2009-04-29 02:05 . 2009-04-29 02:05 143360 ----a-w- c:\windows\system32\nvcolor.exe
    2009-04-29 02:05 . 2009-04-29 02:05 13750272 ----a-w- c:\windows\system32\nvcpl.dll
    2009-04-29 02:05 . 2009-04-29 02:05 229376 ----a-w- c:\windows\system32\nvmccs.dll
    2009-04-27 04:42 . 2009-02-21 21:23 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
    2009-04-25 13:46 . 2009-03-13 21:00
    d
    w- c:\program files\DoubleSafety
    2009-04-25 12:20 . 2009-03-18 02:33
    d
    w- c:\documents and settings\Jeff\Application Data\BitTorrent
    2009-04-25 01:57 . 2009-04-25 01:57
    d
    w- c:\program files\AliveMedia
    2009-04-22 11:26 . 2009-04-18 23:16
    d
    w- c:\program files\Say the Time
    2009-04-21 00:30 . 2009-04-21 00:20
    d
    w- c:\documents and settings\All Users\Application Data\BVRP Software
    2009-04-21 00:30 . 2009-02-21 21:20
    d--h--w- c:\program files\InstallShield Installation Information
    2009-04-20 20:54 . 2009-04-20 20:54 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
    2009-04-19 03:25 . 2009-04-19 03:25
    d
    w- c:\program files\Microsoft Games for Windows - LIVE
    2009-04-18 23:15 . 2009-03-16 04:43
    d
    w- c:\documents and settings\Jeff\Application Data\Mp3 Audio Editor
    2009-04-18 23:06 . 2009-04-18 23:06
    d
    w- c:\documents and settings\Jeff\Application Data\Audio Editor Deluxe
    2009-04-17 12:26 . 2009-02-22 04:59 1847168
    w- c:\windows\system32\win32k.sys
    2009-04-15 14:51 . 2009-02-22 04:59 585216 ----a-w- c:\windows\system32\rpcrt4.dll
    2009-04-08 04:40 . 2009-04-08 03:37 179742
    w- c:\windows\hpwins14.dat
    2009-04-03 21:43 . 2009-04-03 21:43 152576 ----a-w- c:\documents and settings\Jeff\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
    2009-04-01 11:22 . 2009-04-01 11:22 215872
    w- c:\windows\system32\drivers\truecrypt.sys
    2009-03-22 16:35 . 2009-03-22 16:35 4096
    w- c:\windows\d3dx.dat
    2009-03-22 03:46 . 2009-03-22 03:46 2311 ----a-w- c:\documents and settings\All Users\Application Data\xml41A.tmp
    2009-03-22 03:46 . 2009-03-22 03:46 13311 ----a-w- c:\documents and settings\All Users\Application Data\xml419.tmp
    2009-03-22 03:46 . 2009-03-22 03:46 9017 ----a-w- c:\documents and settings\All Users\Application Data\xml418.tmp
    2009-03-18 00:03 . 2009-03-17 23:54 106942640 ----a-w- c:\documents and settings\Jeff\Application Data\SanDisk\Sansa Updater\Sansa Media Converter.EXE
    2009-03-17 23:50 . 2009-03-17 23:50 349184 ----a-w- c:\documents and settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaUpdaterInstall.exe
    2009-03-17 23:50 . 2009-03-17 23:50 79872 ----a-w- c:\documents and settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    2009-03-17 23:50 . 2009-03-17 23:50 538112 ----a-w- c:\documents and settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaUpdater.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "SkinClock"="c:\program files\Atomic Alarm Clock\AtomicAlarmClock.exe" [2006-05-11 557056]
    "Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]
    "Steam"="d:\steam\steam.exe" [2009-06-10 1217784]
    "SansaDispatch"="c:\documents and settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-03-17 79872]
    "BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-03-23 321344]
    "TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-04-08 251240]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-01 1947928]
    "Launch LGDCore"="c:\program files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1122304]
    "Launch LCDMon"="c:\program files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 497152]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-04-29 13750272]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-04-29 86016]
    "WinPatrol"="c:\program files\WinPatrol\winpatrol.exe" [2009-04-20 337216]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
    "SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-07-22 81920]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-10-10 69632]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-04-29 1657376]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    CoreCenter.lnk - c:\program files\MSI\Core Center\CoreCenter.exe [2009-6-12 932864]
    DigiCell.lnk - c:\program files\MSI\DigiCell\DigiCell.exe [2005-7-5 1344512]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-2-21 809488]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-11-07 21:41 72208
    w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-05-01 13:07 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=&quot;"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\mmc.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "d:\\Steam\\SteamApps\\common\\frontlines fuel of war\\Binaries\\FFOW.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "d:\\Quake Wars\\etqw.exe"=
    "d:\\Quake Wars\\etqwded.exe"=
    "d:\\Steam\\SteamApps\\zulicaman\\dystopia\\hl2.exe"=
    "d:\\Battlefield 2\\BF2.exe"=
    "d:\\Steam\\SteamApps\\common\\buccaneer demo\\Buccaneer.exe"=
    "d:\\Steam\\SteamApps\\zulicaman\\eternal-silence\\hl2.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Slacker\\USB Station Refresher\\slacker.tray.exe"=
    "c:\\Program Files\\Slacker\\USB Station Refresher\\slacker.jukebox.exe"=
    "c:\\Program Files\\Slacker\\USB Station Refresher\\slacker.jukebox.launch.exe"=
    "c:\\Program Files\\yDecode\\yDecode.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP2\\RpcAgentSrv.exe"=
    "c:\\Program Files\\DNA\\btdna.exe"=
    "c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2009.SP2\\WNt500x86\\RpcSandraSrv.exe"=
    "d:\\Steam\\SteamApps\\zulicaman\\half-life 2 deathmatch\\hl2.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "d:\\Steam\\SteamApps\\common\\dawn of war ii - spd\\DOW2.exe"=
    "d:\\Steam\\SteamApps\\common\\unreal tournament 3\\Binaries\\UT3.exe"=
    "d:\\Starcraft\\StarCraft.exe"=
    "d:\\Steam\\SteamApps\\common\\america's army 3\\Binaries\\AA3Game.exe"=
    "d:\\Steam\\SteamApps\\zulicaman\\team fortress 2\\hl2.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2/21/2009 6:22 PM 325896]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2/21/2009 6:23 PM 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/21/2009 6:22 PM 298776]
    R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2/21/2009 8:04 PM 10384]
    R2 Slacker Portable Service;Slacker Portable Service;c:\program files\Slacker\USB Station Refresher\slacker.portable.service.exe [10/31/2008 5:03 PM 234176]
    R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [4/8/2009 6:38 AM 92008]
    S2 gupdate1c99d1a3ca68e8e;Google Update Service (gupdate1c99d1a3ca68e8e);c:\program files\Google\Update\GoogleUpdate.exe [3/4/2009 6:40 PM 133104]
    S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe [3/21/2009 11:46 PM 98488]
    S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    HPService REG_MULTI_SZ HPSLPSVC
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
    .
    Contents of the 'Scheduled Tasks' folder

    2009-05-26 c:\windows\Tasks\AWC AutoCare.job
    - c:\program files\IObit\Advanced SystemCare 3\AutoCare.exe [2009-02-24 16:32]

    2009-06-14 c:\windows\Tasks\AWC AutoSweep.job
    - c:\program files\IObit\Advanced SystemCare 3\AutoSweep.exe [2009-02-24 16:32]

    2009-06-02 c:\windows\Tasks\AWC Update.job
    - c:\program files\IObit\Advanced SystemCare 3\IObitUpdate.exe [2009-02-24 16:37]

    2009-06-14 c:\windows\Tasks\GoogleUpdateTaskMachine.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2009-03-04 22:40]
    .
    .
    Supplementary Scan
    .
    FF - ProfilePath -
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-06-14 17:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    SansaDispatch = c:\documents and settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe?252ffe.gummo.flashcp.com%252fcocoon%252fbls%252fupdates%252fSANSA%252ffe%252fverify-cert

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'winlogon.exe'(772)
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\common files\logishrd\bluetooth\LBTServ.dll
    .
    Completion time: 2009-06-14 17:40
    ComboFix-quarantined-files.txt 2009-06-14 21:40

    Pre-Run: 36,918,968,320 bytes free
    Post-Run: 37,029,101,568 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    279 --- E O F --- 2009-06-11 07:01
  • KatanaKatana
    edited June 2009
    That's looking better :)


    Step 1

    Disable Teatimer
    We need to disable Teatimer as it may interfere with the cleaning.
    Please do not re-enable it until I give instructions.

    First step:
    • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
    • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
    • If you have Version 1.4, Click on Exit Spybot S&D Resident
    Second step, For Either Version :
    • Open Spybot S&D
    • Click Mode, choose Advanced Mode
    • Go To the bottom of the Vertical Panel on the Left, Click Tools
    • then, also in left panel, click Resident shows a red/white shield.
    • If your firewall raises a question, say OK
    • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
    • OK any prompts.
    • Use File, Exit to terminate Spybot
    • Click Link >>> HERE <<< Link and select "save as" and save it to your desktop
    • Double click TTWipe.bat
    • Reboot your machine for the changes to take effect.



    Step 2

    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    Read the Requirements and limitations before you click Accept.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    • Kaspersky Log
    • A Fresh HJT Log
    • How are things running now ?


    Additional Notes


    Remove Programs

    Older versions of some programs have vulnerabilities that malware can use to infect your system.

    Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
    click on the program to highlight it, and click on remove.
    • Java(TM) 6 Update 7
    Now close the Control Panel.
  • sakdieselsakdiesel NC
    edited June 2009
    Things are working better. here are the logs requested
    KASPERSKY ONLINE SCANNER 7.0 REPORT
    Monday, June 15, 2009
    Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
    Kaspersky Online Scanner version: 7.0.26.13
    Program database last update: Monday, June 15, 2009 12:27:39
    Records in database: 2345167

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    G:\

    Scan statistics:
    Files scanned: 101026
    Threat name: 5
    Infected objects: 16
    Suspicious objects: 0
    Duration of the scan: 02:51:10


    File name / Threat name / Threats count
    C:\Documents and Settings\Jeff\Desktop\download files\firstpage2006-final-3.00-setup.zip Infected: Hoax.JS.BadJoke.RJump 1
    C:\Documents and Settings\Jeff\Desktop\download files\installed\screensavers installed\All 3Planesoft 3D Screensavers.rar Infected: Trojan-PSW.Win32.LdPinch.bsj 1
    C:\Documents and Settings\Jeff\Desktop\download files\Not setup\fp2006-final-3.00-setup.exe Infected: Hoax.JS.BadJoke.RJump 1
    C:\Documents and Settings\Jeff\My Documents\cool shit\cc hack\CMaster.zip Infected: Hoax.Win32.CardGen.g 1
    C:\Documents and Settings\Jeff\My Documents\Darkwatch pics\Downloads\All 3Planesoft 3D Screensavers.rar Infected: Trojan-PSW.Win32.LdPinch.bsj 1
    C:\Documents and Settings\Jeff\My Documents\files to place\Downloads\All 3Planesoft 3D Screensavers.rar Infected: Trojan-PSW.Win32.LdPinch.bsj 1
    C:\Documents and Settings\Jeff\My Documents\files to place\Downloads\screensavers.rar Infected: not-a-virus:AdWare.Win32.EZula.z 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\SKYNETliilbpfu.dll.vir Infected: Trojan.Win32.Small.bzc 1
    C:\WINDOWS\system32\Clock_Tower_3D_Screensaver.scr Infected: Trojan-PSW.Win32.LdPinch.bsj 1
    D:\C Backup\2009-04-01\Backup C1.zip Infected: Hoax.JS.BadJoke.RJump 1
    D:\C Backup\2009-04-15\Backup C1.zip Infected: Hoax.JS.BadJoke.RJump 1
    D:\download files\firstpage2006-final-3.00-setup.zip Infected: Hoax.JS.BadJoke.RJump 1
    D:\download files\installed\screensavers installed\All 3Planesoft 3D Screensavers.rar Infected: Trojan-PSW.Win32.LdPinch.bsj 1
    D:\download files\Not setup\fp2006-final-3.00-setup.exe Infected: Hoax.JS.BadJoke.RJump 1
    E:\download files\firstpage2006-final-3.00-setup.zip Infected: Hoax.JS.BadJoke.RJump 1
    E:\download files\Not setup\fp2006-final-3.00-setup.exe Infected: Hoax.JS.BadJoke.RJump 1

    The selected area was scanned.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:21:46 PM, on 6/15/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\LckFldService.exe
    C:\Program Files\Logitech\G-series Software\LCDMon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Program Files\Slacker\USB Station Refresher\slacker.portable.service.exe
    C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
    D:\steam\steam.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Documents and Settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
    C:\Program Files\DNA\btdna.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Java\jre6\bin\java.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
    O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\WinPatrol\winpatrol.exe -expressboot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SkinClock] C:\Program Files\Atomic Alarm Clock\AtomicAlarmClock.exe
    O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
    O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\Jeff\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
    O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe
    O4 - Global Startup: DigiCell.lnk = C:\Program Files\MSI\DigiCell\DigiCell.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - http://echat.bellsouth.net/sdccommon/download/tgctlcm.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Update Service (gupdate1c99d1a3ca68e8e) (gupdate1c99d1a3ca68e8e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: LckFldService - Unknown owner - C:\WINDOWS\system32\LckFldService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe
    O23 - Service: Slacker Portable Service - Slacker - C:\Program Files\Slacker\USB Station Refresher\slacker.portable.service.exe
    O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

    --
    End of file - 8293 bytes
  • KatanaKatana
    edited June 2009
    Do you know what this file is ?
    C:\Documents and Settings\Jeff\My Documents\cool shit\cc hack\CMaster.zip
  • sakdieselsakdiesel NC
    edited June 2009
    That folder contains several zip files which I forgot about. I downloaded them in the past to learn a little bit about hacking and the way they (hackers) work to get into my computer. Never got around to it. I should delete them I suppose.
  • KatanaKatana
    edited June 2009
    OTMoveIt
    Please download OTM by OldTimer and save it to your desktop
    • Double-click OTM.exe to run it.
    • Copy the lines in the codebox below. ( Make sure you include :Processes )
    :Processes
:Files
C:\Documents and Settings\Jeff\Desktop\download files\firstpage2006-final-3.00-setup.zip
C:\Documents and Settings\Jeff\Desktop\download files\installed\screensavers installed\All 3Planesoft 3D Screensavers.rar
C:\Documents and Settings\Jeff\Desktop\download files\Not setup\fp2006-final-3.00-setup.exe
C:\Documents and Settings\Jeff\My Documents\cool shit\cc hack\CMaster.zip
C:\Documents and Settings\Jeff\My Documents\Darkwatch pics\Downloads\All 3Planesoft 3D Screensavers.rar
C:\Documents and Settings\Jeff\My Documents\files to place\Downloads\All 3Planesoft 3D Screensavers.rar
C:\Documents and Settings\Jeff\My Documents\files to place\Downloads\screensavers.rar
C:\WINDOWS\system32\Clock_Tower_3D_Screensaver.scr
D:\download files\firstpage2006-final-3.00-setup.zip
D:\download files\installed\screensavers installed\All 3Planesoft 3D Screensavers.rar
D:\download files\Not setup\fp2006-final-3.00-setup.exe
E:\download files\firstpage2006-final-3.00-setup.zip
E:\download files\Not setup\fp2006-final-3.00-setup.exe
:Commands
[Purity]
[EmptyTemp]
    • Return to OTM, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.

    • - Close ALL open windows (especially Internet Explorer!)-
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar), and paste it in your next reply.
    • Close OTM


    If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
  • sakdieselsakdiesel NC
    edited June 2009
    I didn't get the chance to copy what was in the results window because OTM needed to reboot. Here is the resulting log file though.
  • KatanaKatana
    edited June 2009
    Congratulations your logs look clean :)

    Let's see if I can help you keep it that way

    First lets tidy up

    Please delete RSIT.exe and C:\RSIT (entire folder)
    You can also delete any logs we have produced, and empty your Recycle bin.


    Uninstall Combofix
    • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
      • CF_Cleanup.png


    Uninstall OTMoveIt (OTM.exe)
    • Open OTMoveIt Click Cleanup,
    • When a box pops up click YES.


    The following is some info to help you stay safe and clean.


    You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
    ( Vista users must ensure that any programs are Vista compatible BEFORE installing )

    Online Scanners
    I would recommend a scan at one or more of the following sites at least once a month.

    http://www.pandasecurity.com/activescan
    http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

    !!! Make sure that all your programs are updated !!!
    Secunia Software Inspector does all the work for you, .... see HERE for details

    AntiSpyware
      AntiSpyware is
    not the same thing as Antivirus.
    Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
    You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
    Most of the programs in this list have a free (for Home Users ) and paid versions,
    it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
    [*]Spybot - Search & Destroy <<< A must have program
    • It includes host protection and registry protection
    • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

    [*] MalwareBytes Anti-malware <<< A New and effective program
    [*]a-squared Free <<< A good "realtime" or "on demand" scanner
    [*]superantispyware <<< A good "realtime" or "on demand" scanner



    Prevention
      These programs don't detect malware, they help stop it getting on your machine in the first place. Each does a different job, so you can have more than one
    • Winpatrol
      • An excellent startup manager and then some !!
      • Notifies you if programs are added to startup
      • Allows delayed startup
      • A must have addition
    • SpywareBlaster 4.0
      • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
    • SpywareGuard 2.2
      • SpywareGuard provides real-time protection against spyware.
      • Not required if you have other "realtime" antispyware or Winpatrol
    • ZonedOut
      • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
    • MVPS HOSTS
      • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
      • For information on how to download and install, please read this tutorial by WinHelp2002.
      • Not required if you are using other host file protections


    Internet Browsers
      Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        • Change the Download signed ActiveX controls to Prompt
        • Change the Download unsigned ActiveX controls to Disable
        • Change the Initialise and script ActiveX controls not marked as safe to Disable
        • Change the Installation of desktop items to Prompt
        • Change the Launching programs and files in an IFRAME to Prompt
        • Change the Navigate sub-frames across different domains to Prompt
        • When all these settings have been made, click on the OK button.
        • If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    If you are still using IE6 then either update, or get one of the following.
    • FireFox
      • With many addons available that make customization easy this is a very popular choice
      • NoScript and AdBlockPlus addons are essential
    • Opera
      • Another popular alternative
    • Netscape
      • Another popular alternative
      • Also has Addons available



    Cleaning Temporary Internet Files and Tracking Cookies
      Temporary Internet Files are mainly the files that are downloaded when you open a web page. Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware. It is a good idea to empty the Temporary Internet Files folder on a regular basis. Tracking Cookies are files that websites use to monitor which sites you visit and how often. A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted. CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords Both of these can be cleaned manually, but a quicker option is to use a program
    • ATF Cleaner
      • Free and very simple to use
    • CCleaner
      • Free and very flexible, you can chose which cookies to keep


    Also PLEASE read this article.....So How Did I Get Infected In The First Place

    The last and most important thing I can tell you is UPDATE.
    If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
    Malware changes on a day to day basis. You should update every week at the very least.

    If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


    If you could post back one more time to let me know everything is OK, then I can have this thread archived.

    Happy surfing K'
  • sakdieselsakdiesel NC
    edited June 2009
    Everything is in excellent shape. Programs open faster and there are no hangups. Thank you Katana! :respect::respect::rockon::)
Sign In or Register to comment.