[Mike]

Take your time, go out for a drink and it will be done

[Advertisements]

Hi,

here is the latest Kaspersky report...


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 11, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, July 10, 2008 13:41:30
Records in database: 932972
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 122517
Threat name: 4
Infected objects: 13
Suspicious objects: 1196
Duration of the scan: 02:42:01


File name / Threat name / Threats count
C:\Documents and Settings\robert\Desktop\old hard drive\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 124
C:\Documents and Settings\robert\Desktop\old hard drive\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\robert\Desktop\virus stuff\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 234
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\_OTMoveIt\MovedFiles\07102008_105712\Documents and Settings\Administrator\Desktop\New Folder (2)\confirm your data .msg Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\_OTMoveIt\MovedFiles\07102008_110405\Documents and Settings\Administrator\Desktop\New Folder (2)\please confirm your data! -Thu 17 Jan 2008 07 13 35 -0600.msg Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\Documents and Settings\Administrator\Desktop\backups\outlook backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 140
E:\Documents and Settings\Administrator\Desktop\backups\outlook backup.pst Infected: Trojan-Downloader.Win32.Agent.hzc 1
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 234
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 1
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 380
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 4
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 72

The selected area was scanned.

[xvz1300royalstar]

Hi,

here is the latest Kaspersky report...


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 11, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, July 10, 2008 13:41:30
Records in database: 932972
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 122517
Threat name: 4
Infected objects: 13
Suspicious objects: 1196
Duration of the scan: 02:42:01


File name / Threat name / Threats count
C:\Documents and Settings\robert\Desktop\old hard drive\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 124
C:\Documents and Settings\robert\Desktop\old hard drive\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\robert\Desktop\virus stuff\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 234
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\_OTMoveIt\MovedFiles\07102008_105712\Documents and Settings\Administrator\Desktop\New Folder (2)\confirm your data .msg Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\_OTMoveIt\MovedFiles\07102008_110405\Documents and Settings\Administrator\Desktop\New Folder (2)\please confirm your data! -Thu 17 Jan 2008 07 13 35 -0600.msg Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\Documents and Settings\Administrator\Desktop\backups\outlook backup.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 140
E:\Documents and Settings\Administrator\Desktop\backups\outlook backup.pst Infected: Trojan-Downloader.Win32.Agent.hzc 1
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 234
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 1
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
E:\Documents and Settings\Administrator\Desktop\backups\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 380
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Identities\{0F300A23-F227-4928-B907-D0A14B3D78BB}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 4
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 72

The selected area was scanned.

[Mike]

Hi there,

do you need your Outlook express stuff? Let's try a different scan and see if that can disinfected the files without deleting your Outlook database(s).
You posted me the wrong OTMoveIt log, it should be located in C:\_OTMoveIt and have the date 07102008_HH:MM:SS

Please run a BitDefender Online Scan

• Click I Agree to agree to the EULA.
• Allow the ActiveX control to install when prompted.
• Click Click here to scan to begin the scan.
• Please refrain from using the computer until the scan is finished. This might take a while to run, but it is important that nothing else is running while you scan.
• When the scan is finished, click on Click here to export the scan results.
• Save the report to your desktop , it will be saved as an HTML file - Zip the file and attach it in your next reply.

To attach a file, do the following:* Click Add Reply
* Under the reply panel is the Attachments Panel
* Browse for the attachment file you want to upload, then click the green Upload button
* Once it has uploaded, click the Manage Current Attachments drop down box
* Click on to insert the attachment into your post

[xvz1300royalstar]

Hi,

here is the only other otmoveit file I have...

File/Folder C:\fsaua.data not found.
File/Folder C:\Program Files\a-squared Anti-Malware\unins000.exe not found.
File/Folder C:\Program Files\DVDFab 5\unins000.exe not found.
E:\Documents and Settings\Administrator\Desktop\New Folder (2) moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07102008_110405


I have deleted a lot of outlook stuff and here is the latest kaspersky report.....

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 11, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, July 11, 2008 09:55:23
Records in database: 941430
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 122585
Threat name: 4
Infected objects: 13
Suspicious objects: 1194
Duration of the scan: 02:42:57


File name / Threat name / Threats count
C:\Documents and Settings\robert\Desktop\virus stuff\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
C:\Documents and Settings\robert\Local Settings\Application Data\Identities\{8B201A7C-62E8-4E85-A860-7793BBEFF856}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\Dc41.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 128
C:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\Dc41.pst Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\Dc42.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 234
C:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\Dc42.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 1
C:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\Dc42.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
C:\_OTMoveIt\MovedFiles\07102008_105712\Documents and Settings\Administrator\Desktop\New Folder (2)\confirm your data .msg Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\_OTMoveIt\MovedFiles\07102008_110405\Documents and Settings\Administrator\Desktop\New Folder (2)\please confirm your data! -Thu 17 Jan 2008 07 13 35 -0600.msg Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 70
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De77.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 140
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De77.pst Infected: Trojan-Downloader.Win32.Agent.hzc 1
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De83\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 234
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De83\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 1
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De83\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De83\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De85\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 376
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De85\Deleted Items.dbx Infected: Trojan-Downloader.Win32.Agent.hzc 2
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De85\Deleted Items.dbx Infected: Trojan-Spy.HTML.Paylap.kf 2
E:\RECYCLER\S-1-5-21-1123561945-1303643608-725345543-1003\De85\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 4

The selected area was scanned.


I will do the bitdefender now.

Regards

Robert

[Mike]

OK, it won't hurt but it looks like you got everything.

Post back with the results and how your PC is running, I think we can get you cleaned up and on your way next post.

[xvz1300royalstar]

I have attached the bitdefender report...  bitdefender.html   20KB   24 downloads

[Mike]

Hi there,

Looks good, take a look on your old harddrive and new one in Outlook for [Subject: Hot pictures][From: Jesse Duncan], delete any emails with that subject and sender.

Please download ATF Cleaner by Atribune.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Then,

Please download OTCleanIt.

• Save it to your desktop.
• Double Click on OTCleanIt.exe, a window will appear.
• Please press the CleanUp! Button.

This will remove the tools we used during the process of cleaning your computer.

Also delete that Virus stuff folder you made.

You can uninstall MalwareByte's antimalware if you wish, you may also keep it.

&

Right-click on "My Computer." The "System Properties" dialogue box will appear, showing a number of tabs. From here you can reset System Restore and configure Automatic Updates.

First, click the System Restore tab.

• Check the box beside "Turn off System Restore"
• Click "Apply"
• At the prompt, click "Yes"

Wait while your system deletes existing Restore Points, this may take a few moments.

• Uncheck the box beside "Turn off System Restore"
• Click "Apply"
• At the prompt, click "Yes"

Your system will now create a new Restore Point.

Now that your are clean, you'll want to stay that way.

Some important things that you should keep in mind in order to protect yourself:

• Use common sense. This is the big one! Don't download programs from suspicious sites and be careful where you browse.
  Things you can do to aviod downloading bad programs:
  • Google the program. Read reviews and opinions from other people on the internet, if you dont see any reports of foul play - then there more than likely is none.
  • Stay away from Cracks! However luring the thought of free software can be it's not worth the hassle and potential danger of getting infected.
  • Download the program directly from the website of the developer - then you can be certain you haven't downloaded a bogus copy.
  • Read the EULA (End User License Agreement) - Find out exactly what you are downloading. A good tool to aid you in this would be EULAyzer.
• Keep your protection programs up to date! No matter how good your Antivirus or Antispyware program is, without an updated set of definitions it will do you no good against the new infections. If you run a free program make sure to update them at least once a week.
• Make sure that windows updates is enabled. Keeping your system up to date is a must - to turn on automatic updates take a look at this article by Microsoft.

I have listed two programs to boost your security while using no resources.

• SpywareBlaster Take a look at the tutorial here.
• ZonedOut Adds thousands of websites to your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.

Also consider using an alternative web broswer. Two big named ones, both far superior to Internet Explorer in terms of security and performance, would be Firefox and Opera.

Make a habit of scanning your computer for viruses every week or so and backing up important files regularly.

Please also read Expert Tony Klein's excellent article: How I got Infected in the First Place

Please post back and tell me if everything is OK, so that I may mark this thread as Resolved.

[xvz1300royalstar]

Hi Mike,

I have deleted the virus folder that i made and ran atf cleaner and otcleanit, and sorted out system restore.
I couldnt find this stuff...[Subject: Hot pictures][From: Jesse Duncan],

Regards

Robert

[Mike]

If its not there - then its not there

Any other troubles with your PC? Any questions you have?

[Mike]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.