Skip to main content

HIJACK LOGTHANK YOU!

Customer

I ran Ad Aware SE as well. Here's my HiJack log...latest version. My PC said it was infected with a serious virus. I switched from Explorer to Opera as primary browser. I had to do a system restore just to use my PC today.

 

With all the C:\WINDOWS or C:\Programs directly below, I don't know how to delete because they are not a checked box.

 

THANKS!!!!

 

--------------------------------------------------------------

Logfile of HijackThis v1.99.1

Scan saved at 10:06:55 PM, on 5/19/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\System32\ctfmon.exe

C:\WINDOWS\System32\pctspk.exe

C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

C:\Program Files\Internet Explorer\Iesearch.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Yahoo!\Messenger\ypager.exe

C:\PROGRA~1\COMMON~1\ommr\ommra.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

C:\Program Files\Opera 9 Beta\Opera.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\PROGRA~1\Lavasoft\AD-AWA~2\Ad-Aware.exe

C:\WINDOWS\hh.exe

C:\WINDOWS\System32\P2P Networking\P2P Networking.exe

C:\PROGRA~1\WINZIP\winzip32.exe

C:\Documents and Settings\JV\Local Settings\Temp\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://letgohome.com/sp.htm?id=574

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://by108fd.bay108.hotmail.msn.com/cgi-...3473d0f&fti=yes

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://totalinternet.snap.com:8005/channel...ernet-0,00.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = By DSLExtreme

O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKLM\..\Run: [iesearch.exe] C:\Program Files\Internet Explorer\Iesearch.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"

O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART

O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll

O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

O4 - HKCU\..\Run: [ommr] C:\PROGRA~1\COMMON~1\ommr\ommrm.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: *.greg-search.com

O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr...etup1.0.0.6.cab

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab

O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{C3B4C301-DDDC-4863-A1A7-2A25965C6E97}: NameServer = 66.51.206.100 66.51.205.100

O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\Documents and Settings\JV\msopt.dll

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

0

Comments

32 comments

Date Votes
  • Customer

    Hello,

     

    Hijackthis is still in your temp-folder, so I strongly advise to create a permanent folder and move hijackthis.exe into it. The reason is because hijackthis creates backups and when it's in your temp-folder it can be accidentally deleted.

    How do you make a permanent folder:

     

    Click My Computer, then C:\ and then on Program Files.

    In the menu bar, File->New->Folder.

    That will create a folder named New Folder, which you can rename to "HJT" or "HijackThis".

    Now you have C:\Program Files\HijackThis. Put your HijackThis.exe there.

     

    Do you have Kazaa installed? In case you do, I strongly recommend you uninstall it, because it contains adware and I see it's also installed on your system.

     

    Another question, is your Adaware SE up to date? Because normally it should delete what I can find in your log though...

     

    anyway, uninstall next programs if present:

     

    Kazaa

    Instafinder

    P2P Networking

    MyWebsearch

    altnet

    Spykiller <== in case you didn't buy it. this is a poor scanner.

     

    Reboot afterwards.

     

    After reboot,

     

    We also need to disable your Microsoft AntiSpyware Real-time Protection as it may interfere with the fixes.

     

    Open Microsoft AntiSpyware.

    Click on Tools, Settings.

    In the left pane, click on Real-time Protection.

    Under Startup Options uncheck: Enable the Microsoft AntiSpyware Security Agents on startup (recommended).

    Under Real-time spyware threat protection uncheck: Enable real-time spyware threat protection (recommended).

    After you uncheck these, click on the Save button and close Microsoft AntiSpyware.

    Right click on the Microsoft AntiSpyware icon on the taskbar and select Shutdown Microsoft AntiSpyware.

     

    * Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

     

    R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://letgohome.com/sp.htm?id=574

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://totalinternet.snap.com:8005/channel...ernet-0,00.html

    O2 - BHO: InstaFinderK - {4E7BD74F-2B8D-469E-90F0-F66AB581A933} - C:\PROGRA~1\INSTAF~1\INSTAF~1.DLL

    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)

    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

    O4 - HKLM\..\Run: [iesearch.exe] C:\Program Files\Internet Explorer\Iesearch.exe

    O4 - HKLM\..\Run: [P2P Networking] C:\WINDOWS\System32\P2P Networking\P2P Networking.exe /AUTOSTART

    O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s

    O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll

    O4 - HKCU\..\Run: [spyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup

    O4 - HKCU\..\Run: [ommr] C:\PROGRA~1\COMMON~1\ommr\ommrm.exe

    O15 - Trusted Zone: *.greg-search.com

    O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://imgfarm.com/images/nocache/funwebpr...etup1.0.0.6.cab

    O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} (Web P2P Installer) -

    O18 - Protocol: icoo - {4A8DADD4-5A25-4D41-8599-CB7458766220} - C:\Documents and Settings\JV\msopt.dll

     

    * Click on Fix Checked when finished and exit HijackThis.

    Make sure your Internet Explorer is closed when you click Fix Checked!

     

    * Reboot into Safe Mode`: ( without networking support !)

    °To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key.

     

     

    * Using Windows Explorer, locate the following files/folders, and delete them if still present:

     

    C:\Program Files\Internet Explorer\Iesearch.exe

    C:\PROGRAM FILES\COMMON FILES\ommr <== folder

    C:\WINDOWS\System32\P2P Networking <== folder

    C:\PROGRAM FILES\MYWEBSEARCH <== folder

    c:\program files\altnet <= folder

    C:\Documents and Settings\JV\msopt.dll

     

    * Clean your Cache and Cookies in IE:


    • Close all instances of Outlook Express and Internet Explorer


    • Go to Control Panel > Internet Options > General tab


    • Click the "Delete Cookies" button


    • Next to it, Click the "Delete Files" button


    • When prompted, place a check in: "Delete all offline content", click OK



    * Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):


    • Go to Tools > Options.


    • Click Privacy in the menu on the left side of the Options window.


    • Click the Clear button located to the right of each option (History, Cookies, Cache).


    • Click OK to close the Options window
      Alternatively, you can clear all information stored while browsing by clicking Clear All.
      A confirmation dialog box will be shown before clearing the information.



    * Clean other Temporary files + Recycle bin


    • Go to start > run and type: cleanmgr and click ok.


    • Let it scan your system for files to remove.


    • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.


    • Press OK to remove them.



    Perform a full scan with Adaware SE to get rid of the leftovers.

     

    Reboot back to normal mode and post a new hijackthislog in your next reply.

    0
  • Customer

    WOW! That was an adventure. I did everything you mentioned...just finished loading a new version of Java.

     

    Here's the latest Hijackthis scan:

     

    Logfile of HijackThis v1.99.1

    Scan saved at 3:37:53 AM, on 5/20/2006

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

     

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\System32\pctspk.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Messenger\msmsgs.exe

    C:\WINDOWS\System32\ctfmon.exe

    C:\Program Files\WinZip\WZQKPICK.EXE

    C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

    C:\Program Files\ewido anti-malware\ewidoctrl.exe

    C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

    C:\Program Files\Opera 9 Beta\Opera.exe

    C:\WINDOWS\System32\msiexec.exe

    C:\Program Files\HiJack This\HijackThis.exe

     

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://by108fd.bay108.hotmail.msn.com/cgi-...3473d0f&fti=yes

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = By DSLExtreme

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe

    O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp3\winampa.exe"

    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

    O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

    O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll

    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

    O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

    O4 - Global Startup: ZoneAlarm.lnk = C:\Program Files\Zone Labs\ZoneAlarm\zonealarm.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab

    O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{C3B4C301-DDDC-4863-A1A7-2A25965C6E97}: NameServer = 66.51.206.100 66.51.205.100

    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    0
  • Customer

    By the way... I also see you are still using an old vulnerable version of Sun java. So update it asap!

     

    Updating Java:


    • Go to Start > Control Panel double-click on the Software icon > add/remove programs.


    • Search in the list for all previous installed versions of Java. (J2SE Runtime Environment.... )
      It should have next icon next to it:
      Select it and click Remove.


    • Then Download and install the newest version from here:



    0
  • Customer

    This is already looking a lot better..

     

    * Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

     

    O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe

    O4 - HKCU\..\Run: [uninstal] regsvr32 /u /s image.dll

     

    * Click on Fix Checked when finished and exit HijackThis.

    Make sure your Internet Explorer is closed when you click Fix Checked!

     

    Install an antivirus, because I don't see an antivirus installed here.

    AVG, Avira OR Avast are good FREE antivirus.

     

    Reboot and post a new hijackthislog in your next reply.

    0
  • Customer

    Latest HIJACK Log...how does it look now???

     

    Logfile of HijackThis v1.99.1

    Scan saved at 6:37:58 PM, on 5/25/2006

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

     

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\System32\ctfmon.exe

    C:\Program Files\ewido anti-malware\ewidoctrl.exe

    C:\Program Files\ewido anti-malware\ewidoguard.exe

    C:\WINDOWS\sql-dgm.exe

    C:\WINDOWS\Msmgs.exe

    C:\WINDOWS\System32\wuauclt.exe

    C:\Program Files\Opera 9 Beta\Opera.exe

    C:\Documents and Settings\JV\Desktop\Internet\Spy--Scan\HijackThis.exe

     

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://by108fd.bay108.hotmail.msn.com/cgi-...3473d0f&fti=yes

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = By DSLExtreme

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab

    O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{C3B4C301-DDDC-4863-A1A7-2A25965C6E97}: NameServer = 66.51.206.100 66.51.205.100

    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: SQLDGM - Unknown owner - C:\WINDOWS\sql-dgm.exe

    O23 - Service: Windows web messenger - Unknown owner - C:\WINDOWS\Msmgs.exe

    0
  • Customer

    It looks... confusing...

     

    I see two new entries present, unknown to me and they smell bad...

    Tilebot maybe..

     

    Can you perform next please?

     

    Go to next site:

    http://www.virustotal.com/en/indexf.html

    On top you'll find 'Browse'

    Click the browse button and browse to next file:

     

    C:\WINDOWS\sql-dgm.exe

     

    Click open.

    Then click the 'Send' button next to it.

    This will scan the file. Please be patient.

    Once scanned, copy and paste the results in notepad.

     

    then perform the same for next file:

     

    C:\WINDOWS\Msmgs.exe <== this one is present in your windows-folder and NOT your Messenger folder.

     

    Then install an antivirus, because I don't see it present on your system and that's the reason why you got reinfected again, because nothing is protecting your system right now...

     

    AVG, Avira OR Avast are good FREE antivirus.

     

    Let your Antivirus perform a full scan. Reboot afterwards!

     

    Post the results from Virustotal in your next reply together with a new hijackthislog.

    Please don't wait too long with this, because in case it is indeed tilebot, it will install more malware.

    0
  • Customer

    Go to next site:

    http://www.virustotal.com/en/indexf.html

    On top you'll find 'Browse'

    Click the browse button and browse to next file:

     

    OK...went to that site and did not see 'Browse' anywhere. I appreciate your step by step but had difficulty with this one. Maybe it would have made sense if I found 'Browse' and clicked to next file, etc.

     

    I will install the anti virus you mentioned.

    0
  • Customer

    Hi,

     

    Look at next image. In my case it is in dutch, but you have to click the button next to the field. From there you can browse to the files C:\WINDOWS\sql-dgm.exe and C:\WINDOWS\Msmgs.exe

    Then click the send button.

     

     

    Let them scan one by one, so first upload the file C:\WINDOWS\sql-dgm.exe, let it scan (can take a couple of mins), save results in notepad, and then upload next file: C:\WINDOWS\Msmgs.exe and save results in notepad and paste the results in your next reply.

    0
  • Customer

    OK...been having more troubles...everytime I try to download antivirus my system locks up. Also, that site did not have Browse, it was called Search...now I shut down my browser and went back and it now says Browse. This is the crap I'm dealing with all the time.

     

    I just downloaded AntiVir and will try your suggestion.

    0
  • Customer

    This is malware causing this.

    Anyway, perform the steps I posted for Virustotal first and post the results.

    Then we'll deal with these files manually and you can perform the AntiVir scan afterwards to get rid of the leftovers.

    0
  • Customer

    I didn't know how to find these files, so I did a search, copied to my desktop and then entered in Browse and hit send. Here are the resutls.

     

     

    STATUS: SCANNINGFile "SQL-DGM.EXE-30A194F5.pf" received on 05

     

    .26.2006 at 10:55:36 (CET) is being scanned by VirusTotal in

     

    this moment. Results will be shown as they're generated.

     

    Antivirus Version Update Result

    AntiVir 6.34.1.32 05.26.2006 no virus found

    Authentium 4.93.8 05.26.2006 no virus found

    Avast 4.6.695.0 05.26.2006 no virus found

    AVG 386 05.25.2006 no virus found

    BitDefender 7.2 05.26.2006 no virus found

    CAT-QuickHeal 8.00 05.25.2006 no virus found

    ClamAV devel-20060426 05.25.2006 no virus found

    DrWeb 4.33 05.26.2006 no virus found

    eTrust-InoculateIT 23.72.18 05.26.2006 no virus found

    eTrust-Vet 12.6.2229 05.26.2006 no virus found

     

     

    Aditional Information

    File size: 2682 bytes

    MD5: 7b905b2be25a7ccb3b003497a691ee14

     

     

     

    STATUS: SCANNINGFile "MSMGS.EXE-0ABF45FB.pf" received on 05.

     

    26.2006 at 10:59:41 (CET) is being scanned by VirusTotal in

     

    this moment. Results will be shown as they're generated.

     

    Antivirus Version Update Result

    AntiVir 6.34.1.32 05.26.2006 no virus found

    Authentium 4.93.8 05.26.2006 no virus found

    Avast 4.6.695.0 05.26.2006 no virus found

    AVG 386 05.25.2006 no virus found

    BitDefender 7.2 05.26.2006 no virus found

    CAT-QuickHeal 8.00 05.25.2006 no virus found

    ClamAV devel-20060426 05.25.2006 no virus found

    DrWeb 4.33 05.26.2006 no virus found

    eTrust-InoculateIT 23.72.18 05.26.2006 no virus found

    eTrust-Vet 12.6.2229 05.26.2006 no virus found

    Ewido 3.5 05.26.2006 no virus found

    Fortinet 2.77.0.0 05.26.2006 no virus found

    F-Prot 3.16c 05.25.2006 no virus found

    Ikarus 0.2.65.0 05.26.2006 no virus found

    Kaspersky 4.0.2.24 05.26.2006 no virus found

    McAfee 4770 05.25.2006 no virus found

    Microsoft 1.1441 05.26.2006 no virus found

    NOD32v2 1.1559 05.25.2006 no virus found

    Norman 5.90.17 05.24.2006 no virus found

    Panda 9.0.0.4 05.26.2006 no virus found

    Sophos 4.05.0 05.26.2006 no virus found

    Symantec 8.0 05.26.2006 no virus found

    TheHacker 5.9.8.148 05.26.2006 no virus found

     

     

    Aditional Information

    File size: 23324 bytes

    MD5: a1855c05a082bdc23e73778a86010b37

    SHA1: 29dc111494eb9c15635673260fbfdf590bc018c4

     

    VirusTotal is a free service offered by Hispasec

    0
  • Customer

    I did all of the above, using the zip file. I tried emailing the two zip files to you but was told the files contain a virus. I sent you a email about this.

    0
  • Customer

    Ehm, you didn't let it scan the right files...

    I didn't know how to find these files, so I did a search, copied to my desktop and then entered in Browse and hit send. Here are the resutls.

     

    You did that wrong. Press the button browse on top in Virustotal. From there you can browse to the files I mentioned. Once found, select it and click the send button in Virustotal.

    No need to search via search in Windows.

     

    You scanned the ones present in your prefech folder. You have to scan the ones present in your C:\Windows-folder

     

    Could be that these files are hidden, so perform next:

     

    Please set your system to show all files.

    Click Start.

    Open My Computer.

    Select the Tools menu and click Folder Options.

    Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.

    Uncheck: Hide file extensions for known file types

    Uncheck the Hide protected operating system files (recommended) option.

    Click Yes to confirm.

    Click OK.

     

    Then use Virustotal again and search for the right files present in your Windows folder.

    If it's too difficult for you to perform, because I guess you don't really understand how to submit files, perform next instead:

     

    *Please download the Suspicious File Packer from here:

    http://www.safer-networking.org/files/sfp.zip

    Unzip it to the desktop and run it.

     

    Paste the following file paths into the Suspicious File Packer window:

     

    C:\WINDOWS\sql-dgm.exe

    C:\WINDOWS\Msmgs.exe

     

    Allow SFP to pack the file. This will generate a CAB archive on your desktop. Please email the file to:

     

    miekiemoesATmalware-research.co.uk

     

    remember to replace the AT in the above line with an @

    (the reason to not post a complete valid e-mail address in a post is so spammers can't harvest the addresses)

    0
  • Customer

    OK...the second file was sent to you. The first, C:\WINDOWS\sql-dgm.exe has a virus.

     

    Also, I downloaded antivir_workstation_win7u_en_h and then went through the stages to open on my desktop. All files were extracted and then it stopped. Usually the program opens and I could use it (do a scan)...this program did nothing. I tried to open it again and same thing...files extracted but no program. I didi a search for it but was only given the same option.

     

    I hate computers.

    0
  • Customer

    Hi, disable your Antivirus and try again to mail it.

     

    Then perform next... (better to save next instructions in notepad)

     

    * Reboot into Safe Mode`: ( without networking support !)

    °To get into the Safe mode as the computer is booting press and hold your "F8 Key". Use your arrow keys to move to "Safe Mode" and press your Enter key.

     

    In safe mode, check and fix next entries in hijackthis:

     

    O23 - Service: SQLDGM - Unknown owner - C:\WINDOWS\sql-dgm.exe

    O23 - Service: Windows web messenger - Unknown owner - C:\WINDOWS\Msmgs.exe

     

    Then, still in safe mode, delete next files present in your WINDOWS-folder and not anywhere else:

     

    C:\WINDOWS\sql-dgm.exe

    C:\WINDOWS\Msmgs.exe

     

    Reboot back to normal mode and post a new hijackthislog.

    0
  • Customer

    Hi, perform my previous steps first and then try to install antivir again. Because, as i already said, malware could interfere here.

    0
  • Customer

    Whoever you are, you are sure generous with your time! I'm a little stunned...so THANKS. If you like music, I can send you some CD's...I have a great collection.

     

    OK...back to this crap of a computer.

     

    Then, still in safe mode, delete next files present in your WINDOWS-folder and not anywhere else:

     

    C:\WINDOWS\sql-dgm.exe

    C:\WINDOWS\Msmgs.exe

     

    This is back to where I was before, finding these files. The only way I know how to is to rt click on Start, go to Explore, go to Windows and search...but in Windows there are so many folders. Which folder is this in?

     

    Regarding Hotmail, I don't know how to disable my Antivirus. I know, must be so simple, but I couldn't find where.

     

    I can however In safe mode, check and fix next entries in hijackthis:

     

    O23 - Service: SQLDGM - Unknown owner - C:\WINDOWS\sql-dgm.exe

    O23 - Service: Windows web messenger - Unknown owner - C:\WINDOWS\Msmgs.exe

    0
  • Customer

    For your info... C:\WINDOWS\Msmgs.exe... not widely detected yet, so thanks for that file.

    It is hidden and read only. So make sure, your hidden files and folders are shown as I already explained in my previous post, otherwise you wouldn't be able to find it.

     

    AntiVir 6.34.1.32 05.26.2006 no virus found

    Authentium 4.93.8 05.26.2006 no virus found

    Avast 4.6.695.0 05.26.2006 no virus found

    AVG 386 05.25.2006 no virus found

    BitDefender 7.2 05.26.2006 no virus found

    CAT-QuickHeal 8.00 05.25.2006 (Suspicious) - DNAScan

    ClamAV devel-20060426 05.25.2006 no virus found

    DrWeb 4.33 05.26.2006 no virus found

    eTrust-InoculateIT 23.72.18 05.26.2006 no virus found

    eTrust-Vet 12.6.2229 05.26.2006 no virus found

    Ewido 3.5 05.26.2006 no virus found

    Fortinet 2.77.0.0 05.26.2006 no virus found

    F-Prot 3.16c 05.25.2006 no virus found

    Ikarus 0.2.65.0 05.26.2006 no virus found

    Kaspersky 4.0.2.24 05.26.2006 no virus found

    McAfee 4770 05.25.2006 W32/Sdbot.worm.gen.bp

    Microsoft 1.1441 05.26.2006 Backdoor:Win32/Rbot!0B16

    NOD32v2 1.1559 05.25.2006 no virus found

    Norman 5.90.17 05.26.2006 no virus found

    Panda 9.0.0.4 05.26.2006 Suspicious file

    Sophos 4.05.0 05.26.2006 no virus found

    Symantec 8.0 05.26.2006 no virus found

    TheHacker 5.9.8.148 05.26.2006 no virus found

    UNA 1.83 05.24.2006 Backdoor.Rbot

    VBA32 no 05.25.2006 no virus found

     

    This is back to where I was before, finding these files. The only way I know how to is to rt click on Start, go to Explore, go to Windows and search...but in Windows there are so many folders. Which folder is this in?

     

    It is in your Windows-folder, those are 2 files present in your Windows-folder.

    So, click 'my computer', then click C:\, this will open your C:\, then click the Windows-folder, this will open your Windows-folder, then search in that folder for next files and delete them:

     

    sql-dgm.exe

    Msmgs.exe

    0
  • Customer

    I am running avast 4 Professional and it performed a scan on start up finding two viruses. I am doing a complete scan now. When you said I didn't have antivirus protection, what is the following:

    AdAware SE

    Spybot

    hijackthis

    ewido anti malware

    fixblast

    ...and now, avast!

     

    I also had Zonealarm, MS Antispyware which I deleted because they obviously didn't help.

    0
  • Customer

    I found those files but cannot delete them. I tried using Killbox Spyware and it said they don't exisit. They are shadowed in color unlike the others. Maybe these are the hidden files. Either way, I could not delete. At least I found the bastards.

    0
  • Customer

    I guess you're not doing this in safe mode.

    I just installed it here and they could get deleted fine in safe mode.

     

    I see you have already killbox present?

    Guess you're not doing this right, using killbox.

    Make sure you have the latest version of killbox and perform next instructions exactly as I describe below..

     

    * Download Killbox.

    Click killbox.exe.

    Select the option "Delete on reboot".

    Click the button: All Files (!important!)

    Now it should flash green.

     

    Now copy the next bold part:

     

    C:\WINDOWS\sql-dgm.exe

    C:\WINDOWS\Msmgs.exe

     

    Open 'file' in the killboxmenu on top and choose Paste from clipboard

     

    Then press the button that looks like a red circle with a white X in it.

    Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES

    If you don't get that message, reboot manually.

     

    Your computer should reboot now.

     

    After reboot, post a new hijackthislog.

    There's more afterwards we need to restore though, because this infection compromised your security settings.

    0
  • Customer

    It seems both those files have been deleted.

    avast got the C:\WINDOWS\sql-dgm.exe

    and I just deleted C:\WINDOWS\Msmgs.exe in Windows manually.

    0
  • Customer

    Did you perform my previous steps?

    Can you post a new hijackthislog please, because there are more things we need to perform to restore the damage it already caused.

    So, I want to be sure here if these files are gone, otherwise restoring won't make sense...

     

    I also had Zonealarm, MS Antispyware which I deleted because they obviously didn't help.

     

    Ehm, these programs are needed to prevent malware being installed also.. Don't delete them like that... just because they didn't solve your problem....

    By the way, zonealarm is not an antivirus or spywarescanner, but a firewall, and you need that as well.

    AdAware SE

    Spybot

    hijackthis

    ewido anti malware


     

    those are no antivirus either. they deal with spyware/adware, not viruses.

    Hijackthis is only a diagnostic tool... it doesn't prevent malware being installed.

    0
  • Customer

    New Hijack

     

    Logfile of HijackThis v1.99.1

    Scan saved at 4:45:16 AM, on 5/26/2006

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2800.1106)

     

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\WINDOWS\Explorer.EXE

    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    C:\WINDOWS\System32\ctfmon.exe

    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    C:\Program Files\Alwil Software\Avast4\ashServ.exe

    C:\Program Files\ewido anti-malware\ewidoctrl.exe

    C:\Program Files\ewido anti-malware\ewidoguard.exe

    C:\Program Files\Alwil Software\Avast4\ashSimpl.exe

    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Documents and Settings\JV\Desktop\Internet\Spy--Scan\HijackThis.exe

     

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://by108fd.bay108.hotmail.msn.com/cgi-...3473d0f&fti=yes

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = By DSLExtreme

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://64.124.45.181/downloads/ccpm_0237.cab

    O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotion...ctor/WebAAS.cab

    O17 - HKLM\System\CCS\Services\Tcpip\..\{C3B4C301-DDDC-4863-A1A7-2A25965C6E97}: NameServer = 66.51.206.100 66.51.205.100

    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe

    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    0
  • Customer

    Ok, but can you post a new hijackthislog please?

     

    Also perform next:

     

    Open notepad and copy and paste next present in the quotebox in it:

     

    dir C:\WINDOWS\Msmgs.exe /a h > files1.txt

    dir C:\WINDOWS\sql-dgm.exe /a h > files2.txt

    dir C:\WINDOWS\system32\remon.sys /a h > files3.txt

    copy files1.txt + files2.txt + files3.txt = Output.txt

    del files*.txt

    start notepad Output.txt


     

    Save this as look.bat , choose to save as *all files and place it on your desktop.

    It should look like this:

    Doubleclick on it and notepad should open.

    Copy and paste the contents of it in your next reply.

    0
  • Customer

    ok.. that one looks clean. Please read in my previous post what other step you have to perform.

    0
  • Customer

    Volume in drive C has no label.

    Volume Serial Number is 8069-228C

     

    Directory of C:\WINDOWS

     

     

    Directory of C:\Documents and Settings\JV\Desktop

     

    Volume in drive C has no label.

    Volume Serial Number is 8069-228C

     

    Directory of C:\WINDOWS

     

     

    Directory of C:\Documents and Settings\JV\Desktop

     

    Volume in drive C has no label.

    Volume Serial Number is 8069-228C

     

    Directory of C:\WINDOWS\system32

     

    05/25/2006 06:34 PM 7,168 remon.sys

    1 File(s) 7,168 bytes

     

    Directory of C:\Documents and Settings\JV\Desktop

     

    0
  • Customer

    I did all of the above. I hope I did the restoresecurity-folder correctly. I was asked if I wanted to add into C: and said yes.

     

    Is there a test I can run to show you the new changes?

    0
  • Customer

    Ok, remon.sys is indeed present. That one needs to go as well.

     

    Please follow all my instructions in the same order..

     

    Go to your C:\Windows\System32-folder

    Look in your System32-folder.

    Search for the file remon.sys and delete it.

    This one will also be hidden, so make sure your hidden files and folders are still shown.

     

    If you can't delete it - try it in safe mode.

     

    Then after you deleted that file, go to start > run and copy and paste next lines one by one in the field and hit enter after pasting every line:

     

    sc delete SQLDGM hit enter

     

    sc delete "Windows web messenger" hit enter

     

    sc delete remon hit enter

     

    Then, download next attachement to your desktop: restoresecurity.zip

    Unzip restoresecurity.zip

    Read here how to unzip/extract properly:

    http://metallica.geekstogo.com/xpcompressedexplanation.html

     

    Open the new created restoresecurity-folder present on your desktop

    You'll find restoresecurity.reg in there.

    Doubleclick it and when it asks you if you want to merge the contents to the registry, click yes/ok.

     

    Let me know how things went in your next reply.

    0
  • Customer

    Well, if it merged correctly, you should be ok.

     

    As a final cleanup, perform next:

     

    * Clean your Cache and Cookies in IE:


    • Close all instances of Outlook Express and Internet Explorer


    • Go to Control Panel > Internet Options > General tab


    • Click the "Delete Cookies" button


    • Next to it, Click the "Delete Files" button


    • When prompted, place a check in: "Delete all offline content", click OK



    * Clean your Cache and Cookies in Firefox (In case you also have Firefox installed):


    • Go to Tools > Options.


    • Click Privacy in the menu on the left side of the Options window.


    • Click the Clear button located to the right of each option (History, Cookies, Cache).


    • Click OK to close the Options window
      Alternatively, you can clear all information stored while browsing by clicking Clear All.
      A confirmation dialog box will be shown before clearing the information.



    * Clean other Temporary files + Recycle bin


    • Go to start > run and type: cleanmgr and click ok.


    • Let it scan your system for files to remove.


    • Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.


    • Press OK to remove them.



    Then reinstall your Zonealarm, because you need a decent firewall.

     

    Then change all your passwords, because the infection you were dealing with collected them!

     

    To keep this clean in the future, I would suggest the following things:

     

    Install Spywareblaster

    SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It blocks the popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage.

     

    * Avoid illegal sites, because that's where most malware is present.

    * Don't click on links inside popups.

    * Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.

    * Download free software only from sites you know and trust. Because a lot of free software can bundle other software, including spyware.

     

    Let your antispywarescanner(s) scan frequently and don't forget to update before.

     

    And I do suggest you perform an online virusscan once in a while. (Housecall and/or Bitdefender). Because what one virusscanner can't find another one maybe can.

    Also make sure that your virusscanner, the one that is installed on your system is always up to date!

     

    Make sure your windows has the latest updates: http://windowsupdate.microsoft.com/

     

    If you are having XP SP2, read here how to configure Security Features for Internet Explorer:

    http://www.microsoft.com/technet/security/...xp/iesecxp.mspx

     

    Also visit this Free Online Scanner for PC Health and Safety and Microsoft Security At Home for tips to Protect your Pc, Protect yourself and Protect your Family.

     

    More info on how to prevent malware you can also find here (By Tony Klein)

    and here: http://wiki.castlecops.com/Malware_Prevent...nt_Re-infection

     

    If you want to fight back the Malware Writers that have made your life a misery, please take a look here.

     

    Happy surfing again!

    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post