[Render]

Hi,

Tell your friend to post his issue in this forum and I or some other helper will help him as every infection is different and have to be treated individually.

Please do this now:

Download AVPTool from Here to your desktop

Run the program you have just downloaded to your desktop (it will be randomly named )

First we will run a virus scan

• On the first tab select all elements down to Computer (included) and then select start scan
• Once it has finished select report and post that.

Do not close AVPTool or it will self uninstall, if it does uninstall - then just rerun the setup file on your desktop

Now an analysis scan

• Select the Manual Disinfection tab
• Press the Gather System Information button
• Once done Open the last report saved folder then attach the zip file to your next post zip
• The file is located at C:\Users\your name\Desktop\Virus Removal Tool\setup_9.0.0.722_05.01.2011_20-34\LOG\avptool_sysinfo.zip

How to add an attachment to a new topic or reply

[Advertisements]

Hi Render,

As instructed:

Autoscan: completed <1 minute ago (events: 6, objects: 199829, time: 00:49:19)
3/06/2011 5:57:35 PM Task completed
3/06/2011 5:37:37 PM Deleted: Packed.Win32.Krap.hc C:\System Volume Information\_restore{764F37E8-835B-4CA2-B9F0-8C2FD237CDF1}\RP2\A0001062.exe
3/06/2011 5:36:55 PM Detected: Packed.Win32.Krap.hc C:\System Volume Information\_restore{764F37E8-835B-4CA2-B9F0-8C2FD237CDF1}\RP2\A0001062.exe
3/06/2011 5:21:05 PM Deleted: Trojan-Downloader.Java.Agent.me C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\37db3fe2-586e3e14
3/06/2011 5:20:23 PM Detected: Trojan-Downloader.Java.Agent.me C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\37db3fe2-586e3e14
3/06/2011 5:08:16 PM Task started

The program did find something as a red notice popped up asking to delete it and I confifmed and then clicked the box to do the same with anything else it found.

As this is the first time I can remeber attaching a file I hope it works but I will save it.

Regards

Attached Files

•  avptool_sysinfo.zip   21.31KB   86 downloads

[Rickles]

Hi Render,

As instructed:

Autoscan: completed <1 minute ago (events: 6, objects: 199829, time: 00:49:19)
3/06/2011 5:57:35 PM Task completed
3/06/2011 5:37:37 PM Deleted: Packed.Win32.Krap.hc C:\System Volume Information\_restore{764F37E8-835B-4CA2-B9F0-8C2FD237CDF1}\RP2\A0001062.exe
3/06/2011 5:36:55 PM Detected: Packed.Win32.Krap.hc C:\System Volume Information\_restore{764F37E8-835B-4CA2-B9F0-8C2FD237CDF1}\RP2\A0001062.exe
3/06/2011 5:21:05 PM Deleted: Trojan-Downloader.Java.Agent.me C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\37db3fe2-586e3e14
3/06/2011 5:20:23 PM Detected: Trojan-Downloader.Java.Agent.me C:\Documents and Settings\HP_Administrator\Application Data\Sun\Java\Deployment\cache\6.0\34\37db3fe2-586e3e14
3/06/2011 5:08:16 PM Task started

The program did find something as a red notice popped up asking to delete it and I confifmed and then clicked the box to do the same with anything else it found.

As this is the first time I can remeber attaching a file I hope it works but I will save it.

Regards

Attached Files

•  avptool_sysinfo.zip   21.31KB   86 downloads

[Render]

Hi,

Please proceed with this:

• Re-run AVPTool
• Select the Manual Disinfection tab
• Where it states Step 3 paste in the following disinfection script and press Execute
  
  

  begin
  SetAVZPMStatus(True);
  SearchRootkit(true, true);
  SetAVZGuardStatus(True);
   DelBHO('{710EB7A1-45ED-11D0-924A-0020AFC7AC4D}');
  BC_ImportDeletedList;
  ExecuteSysClean;
  BC_Activate;
  RebootWindows(true);
  end.

• Your system will reboot on completion, if it does not please do so yourself
• On completion please run another analysis scan and attach the zip file

[Rickles]

Hi Render,

Followed your instructions.

As requested:

Autoscan: stopped 3 hours ago (events: 2, objects: 2, time: 00:00:15)
3/06/2011 11:55:53 PM Task stopped
3/06/2011 11:55:35 PM Task started
Autoscan: completed 1 hour ago (events: 2, objects: 203046, time: 02:02:47)
3/06/2011 11:56:10 PM Task started
4/06/2011 1:58:57 AM Task completed

Regards

Attached Files

•  avptool_sysinfo.zip   21.21KB   87 downloads

[Render]

Your logs shows that your system is clean. If you have no further issues with your computer, then please proceed with the following housekeeping procedures outlined below.

Removing the tools we used:

Reset System Restore points:

• Please reopen on your desktop.
• Copy (select all lines inside quote box and press CTRL+C) and Paste (press CTRL+V) the following code into the textbox.
  
  

  :Commands
  [ClearAllRestorePoints]
  

• Click on button.
• OTL may ask to reboot the machine. Please do so if asked.
• Click on button.

NEXT...

OTL Clean-Up:

• Reopen on your desktop.
• Click on
• You will be prompted to reboot your system. Please do so.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.


There are a few things I recommend you to do once your computer is completely clean:

Updates for Windows - One of the essentials is to keep your computer updated with the latest operating system patches and security fixes. Windows Updates are constantly being revised to combat the newest hacks and threats, Microsoft releases security updates that help your computer from becoming vulnerable. It is best if you have these set to download automatically.

How to turn on Automatic Updates for Windows:

• Windows XP

Java and Adobe Reader updates

There are certain programs that are security vulnerabilities, it is recommended that you keep everything updated. Two of the main vulnerabilities are Java and Adobe Reader.

Java Updates - Java needs to be regularly updated to fix security vulnerabilities. You can download the latest version of the Java Runtime Environment (JRE) from here. Download, install and reboot your computer. You also need to uninstall older versions of Java:

• Click Start
• Select Control Panel
• Select Add or Remove Programs
• Remove all Java updates except the latest one you have just installed.

Update Adobe Acrobat Reader to latest version. You can download it HERE.

Suggestion:

Foxit is a great free PDF alternative. It uses fewer system resources and is not vulnerable to the exploits affecting Adobe Reader. Providing full PDF functionality, Foxit is rapidly becoming the PDF reader of choice for many. Get it here.

Other Software Updates - Go HERE to scan your computer for any out of date software at least once per week. The vast majority of virus, worm and spyware infections could have been prevented, if the user had kept their software up-to-date. You should do everything you can to keep your software up-to-date. Doing so will help you prevent infections and the headaches that follow them.

Web Browsers - Picking the right internet browser is very important. You need to find one that suits your needs but that is also safe. All browsers listed below are far more secure than Internet Explorer, immune to almost all known browser hijackers, and also have the best built-in pop up blockers.

• Mozilla Firefox
• Opera
• Chrome

Although, if you prefer staying with Internet Explorer I highly recommend you do this :

Make Internet Explorer more secure:

• Click Start > Run
• Type Inetcpl.cpl & click OK
• Click on the Security tab
• Click Reset all zones to default level
• Make sure the Internet Zone is selected & Click Custom level
• In the ActiveX section, set the options Download signed and unsigned ActiveX controls to Prompt, and Initialize and Script ActiveX controls not marked as safe to Disable.
• Next click OK, then Apply button and then OK to exit the Internet Properties page.

Tips to protect yourself against malware and reduce the potential for re-infection:

• Simple and easy ways to keep your computer safe.
• Hardening Windows Security - Part 1 & Part 2.
• Your Guide To Staying Safe Online.
• Use Task Manager to close pop-up messages to safely exit malware attacks.
• How to Secure Your Web Browser.

Now after all these steps, your PC will be more secure. However it is important to note that you can still get infected if you are not careful. One of the best security programs you can have is common sense. As malware gets more sophisticated, you need to be more wary. If you do get caught though and the above steps can't help prevent it, we will be here to help you out.

Stay secure and thank you for choosing GeeksToGo.

[Rickles]

Hi Render,

Followed your instructions:

========= COMMANDS ==========
Restore points cleared and new OTL Restore Point set!

OTL by OldTimer - Version 3.2.23.0 log created on 06052011_165858

I already use Foxit to read PDFs and I shall look at the Mozilla and Chrome and your other suggestions.

Thank you for your help and time and I am always thankful that a site like Geeks exists.

Regards

[Render]

You are welcome and let me know if you have any other questions.

[Render]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.