.EXE attack

pangetpanget
edited November 2007 in Spyware & Virus Removal
Help! It makes my pc go crazy. Here's the HiJack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:30:20 AM, on 1/1/1999
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\nvsvc86.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\lrs\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotinfolink.com
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spoolsvc.exe
O4 - HKLM\..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe
O4 - HKLM\..\Run: [Microsoft Internet Explorer] C:\WINDOWS\System32\iexplore.exe
O4 - HKLM\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe
O4 - HKUS\S-1-5-18\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Network Security XP] C:\WINDOWS\System32\nvsvc86.exe (User 'Default user')
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: Add to Media Manager... - C:\Program Files\MP3 Player Utilities 4.00\MediaManager\grab.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

--
End of file - 3348 bytes

**

Thanks

Comments

  • pangetpanget
    edited October 2007
    I think it's likely this virus is the culprit as I've seen this being detected by avast.

    http://www.sophos.co.uk/security/analyses/w32rbotgui.html
  • Baabiouz
    edited October 2007
    Hi panget!
    I'll help you ger rid of your viruses and problems. :)

    Let's start with these:

    #1
    What firewall do you use?

    #2
    Download SDFix and save it to your Desktop.
    Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log
    #3
    Please download Combofix to your desktop.
    Doubleclick combo.exe to launch the application.
    Follow the prompts that will be displayed on the screen.
    Don't click on the window while the fix is running, because that will cause your system to hang.
    When finished, it should produce a log, combofix.txt.
    Post this log in your next reply together with a new hijackthislog.

    #4
    Please, post a fresh HijackThis log, Sdfix's Report.txt and Combofix's Combofix.txt :)
  • pangetpanget
    edited October 2007
    Thank you. But my log may take some time because I've just reinstalled my windows.
  • Baabiouz
    edited October 2007
    Ok.
    Update your windows and install firewall and Antivirus softwares.
    here is some good examples:
    Firewalls:

    1) ZoneAlarm
    2) Agnitum
    3) Sunbelt/Kerio
    4) Comodo

    Antiviruses: Install only one firewall and AV. :)
  • waydorrwaydorr
    edited October 2007
    thank God i found this place pheewwww!
    i've had to reinstall windows over and over and over again
    and i keep getting this exe attacks everytime i install an antivirus it keeps deleting all tha exe on my operating systemespecially in c:/windows/system32

    files like notepad.exe and all other application even windows logon
    pls i'll be trying this nowand will send u a report as requested:confused:
  • waydorrwaydorr
    edited October 2007
    sorrry pls i forgot to say i have used avg and thought that was the problem and after several reinstalls i used mcafee but they all are the same
    PLS helllllllppp
  • waydorrwaydorr
    edited October 2007
    hello Baabiouz
    this is my own repert

    SDFix: Version 1.112

    Run by WAY on Sat 10/27/2007 at 07:12 AM

    Microsoft Windows XP [Version 5.1.2600]

    Running From: C:\SDFix

    Safe Mode:
    Checking Services:


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting...


    Normal Mode:
    Checking Files:

    No Trojan Files Found




    Removing Temp Files...

    ADS Check:

    C:\WINDOWS
    No streams found.

    C:\WINDOWS\system32
    No streams found.

    C:\WINDOWS\system32\svchost.exe
    No streams found.

    C:\WINDOWS\system32\ntoskrnl.exe
    No streams found.



    Final Check:

    Remaining Services:



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
    "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

    Remaining Files:


    Files with Hidden Attributes:


    Finished!
  • Baabiouz
    edited October 2007
    Hi!

    C:\WINDOWS\system32\winlogon.exe
    and
    C:\WINDOWS\system32\NOTEPAD.EXE
    are legitimates.

    please Take a fresh hijackthis log and post it back here :)
  • waydorrwaydorr
    edited October 2007
    thank but do i do that when i have an antivirus installed cos now i did a system restore and teh system became fine and now i have an antivirus installed.

    anyways i'll take a fresh hijacking log now and report back to you
  • waydorrwaydorr
    edited October 2007
    i just finished a fresh scan now but they are all the same report
    here is what is really happening now i have mcafee antivirus installed and when the on access scan runs it sees all the exe i have on my system including ones in another drive as virus likewise when i instal avg antivirus

    now my catalyst control center wont lunch it says cli.exe - application error and says the application failed to initialize properly

    please i'll post more results and i'll send you my whole system configuration soon
    for now i'll just tyr a system restore to get my computer back to a previous state
  • Baabiouz
    edited October 2007
    Have you installed new drivers to Ati?

    I would be glad if you send a fresh hijackthis log :)
  • waydorrwaydorr
    edited October 2007
    pls to be clear how do i create a fresh hijackthis log? is it not with the the files i downloaded SDFix and Combofix

    please let me know if there is anothe way to do this
  • Baabiouz
    edited October 2007
    Fresh hijackthis log means, Open HijackThis, click "Do system scan and save log file" and copy that log here.
  • waydorrwaydorr
    edited October 2007
    please help this ids the log file i got from hijackthis
    i really need this help like the air i breathe

    Logfile of HijackThis v1.99.1
    Scan saved at 09:47, on 2007-10-27
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Internet Download Manager\IDMan.exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Download Manager\IEMonitor.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Opera\Opera.exe
    C:\WINDOWS\TEMP\VRTA.tmp
    E:\My Documents\Downloads\Programs\hijackthis_sfx\HijackThis.exe

    O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [DaemonTools_WhenUSave_Installer] C:\Program Files\DaemonTools_WhenUSave_Installer\DaemonTools_WhenUSave_Installer.exe
    O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Download All Links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
    O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
    O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    please help thanks
  • waydorrwaydorr
    edited October 2007
    or do i install an antivirus before i use the hijackthis? cos i'm scared installing any antivirus, they all delete my files with .exe extension
    i have 2 hard drives one 80gig and another 320gig the 80 gig is partitiond in two partitions c with the operation system and partition D with the jobs i've done which i obviously dont want to lose and the 320 gig drive E is all my files lifeline, all the files i have are here and i dont want to lose anything here not even the smalllest file.
    but anytime i install an anti virus they all see files with a .exe extension in any of this drives as a virus and they tend to delete them
  • Baabiouz
    edited October 2007
    You need also firewall !

    Looking over your log, it seems you don't have any evidence of a third party firewall.

    As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

    1) ZoneAlarm
    2) Agnitum
    3) Sunbelt/Kerio
    4) Comodo

    If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

    And you have installed BSplayer with WhenuSave. Whenusave is adware.
    So, uninstall that Bsplayer and download here "Bsplayer without whenusave"

    When you have done those instructions, please post a fresh hijackthis log back here :)
  • waydorrwaydorr
    edited October 2007
    yea thanx i think i figured the whole thig out
    just used my onboard antivirus (norton internet security) to run a scan andd it scanned all my files including the registary and it found the virus and then repaired the infected *.exe's and also made a backup for all the infected after repairing.
    also while i was doing all this i had to turn off system restore and empty my recycle bin

    voila all was gone and i turned back on sytem restore and now my system is working fine!
  • waydorrwaydorr
    edited October 2007
    Discovered: September 27, 2007
    Updated: September 27, 2007 10:54:25 PM
    Also Known As: Win32/Virut.6544.A [Computer Associates]
    Type: Virus
    Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

    W32.Virut.W is a virus that infects .exe and .scr files on the compromised computer. It also opens a back door and may download potentially malicious files on to the compromised computer.



    use norton internet security to run a scan
    before installing norton turn off system restore and empty the recycle bin
    then restart and install norton then run a full system scan,
    it repairs the files without deleting them creates a backup of the files which will be sent to quarantine just in case the repaired file dont work(but i assure you it will work cos it has been fully tested at least by winXP, cos i got all my files with exe extension infected and now they are clean and all working fine now

    GET NORTON INTERNET SECURITY HERE http://spf-nocache.digitalriver.com/pub/symantec/2004/NIS081500.exe


    note i tried some antivirus but did not do the job cos they require a reboot and once u reboot the system (if it restarts cos it might not except in safe mode) the virus affects the antivirus itself and it seizes to work and if it works it starts deleting all the *.exe files in a plot to repair them


    GET NORTON INTERNET SECURITY HERE http://spf-nocache.digitalriver.com/pub/symantec/2004/NIS081500.exe
  • waydorrwaydorr
    edited October 2007
    Discovered: September 27, 2007
    Updated: September 27, 2007 10:54:25 PM
    Also Known As: Win32/Virut.6544.A [Computer Associates]
    Type: Virus
    Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

    W32.Virut.W is a virus that infects .exe and .scr files on the compromised computer. It also opens a back door and may download potentially malicious files on to the compromised computer.



    use norton internet security to run a scan
    before installing norton turn off system restore and empty the recycle bin
    then restart and install norton then run a full system scan,
    it repairs the files without deleting them creates a backup of the files which will be sent to quarantine just in case the repaired file dont work(but i assure you it will work cos it has been fully tested at least by winXP, cos i got all my files with exe extension infected and now they are clean and all working fine now

    GET NORTON INTERNET SECURITY HERE http://spf-nocache.digitalriver.com/pub/symantec/2004/NIS081500.exe


    note i tried some antivirus but did not do the job cos they require a reboot and once u reboot the system (if it restarts cos it might not except in safe mode) the virus affects the antivirus itself and it seizes to work and if it works it starts deleting all the *.exe files in a plot to repair them


    GET NORTON INTERNET SECURITY HERE http://spf-nocache.digitalriver.com/pub/symantec/2004/NIS081500.exe

    and voila u r done ;)
  • Baabiouz
    edited October 2007
    Great to hear that your computer works fine.


    Log looks clean...great job!

    Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
    1. Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point.

      You can find instructions on how to enable and reenable system restore here:

      Managing Windows Millenium System Restore

      or

      Windows XP System Restore Guide

      Renable system restore with instructions from tutorial above

    2. Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        1. Change the Download signed ActiveX controls to Prompt
        2. Change the Download unsigned ActiveX controls to Disable
        3. Change the Initialize and script ActiveX controls not marked as safe to Disable
        4. Change the Installation of desktop items to Prompt
        5. Change the Launching programs and files in an IFRAME to Prompt
        6. Change the Navigate sub-frames across different domains to Prompt
        7. When all these settings have been made, click on the OK button.
        8. If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.
    3. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

      See this link for a listing of some online & their stand-alone antivirus programs:

      Virus, Spyware, and Malware Protection and Removal Resources

    4. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

    5. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

      For a tutorial on Firewalls and a listing of some available ones see the link below:

      Understanding and Using Firewalls

    6. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

    7. Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

      A tutorial on installing & using this product can be found here:

      Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

    8. Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

      A tutorial on installing & using this product can be found here:

      Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

    9. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

      A tutorial on installing & using this product can be found here:

      Using SpywareBlaster to protect your computer from Spyware and Malware

    10. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
    Follow this list and your potential for being infected again will reduce dramatically.
  • Baabiouz
    edited November 2007
    Glad I could be of assistance! The help you received here was free. Please read through some of these Prevention Tips that Short-Media offers.

    This topic is now closed. If you wish it reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

    Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.

    If you are not the user who started this thread, you must start a new Thread instead :)

    Would you also be interested to join Short-Media (Team #93) with the Folding@Home Project? More information available here
Sign In or Register to comment.