[Advertisements]

nm

Edited by Guse, 16 July 2005 - 08:38 PM.

[Guse]

nm

Edited by Guse, 16 July 2005 - 08:38 PM.

[Guse]

Heya and welcome to Geeks to Go, crapwheresmycrowbar. My name is Guse and I'll be helping you.

I apologize for the delay getting to your log; the helpers here are very busy.

Now, you only have one line of concern, and some... "housecleaning" that can be done to make your log look better.

Run HijackThis and place check marks next to the following entries in bold:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O4 - HKLM\..\Run: [Dupe slow eq view] C:\Documents and Settings\All Users\Application Data\peak vga dupe slow\frag live.exe

Make sure that you’ve visually double-checked that those (and only those) entries have been selected and click Fix

Then, using Windows Explorer, find and delete the following files and folders (if they exist):

C:\Documents and Settings\All Users\Application Data\peak vga dupe slow\

If you get an error when deleting a file, right-click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

Then, run HijackThis again and post me another log in a new reply.

[Guse]

We have a tad bit more to do, man:

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

Now, I see that there is a MessengerPlus program installed on your machine. If this was intentional, ignore any instructions in green from this point on (i.e. don't check them in the HijackThis section).

Then, run HijackThis again, and place a checkmark next to the following items:

O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe
O20 - AppInit_DLLs: MsgPlusLoader.dll

Then, go to Add or Remove Programs in your Control Panel (Start | Control Panel | Add or Remove Programs) and remove the following program:

Messenger Plus! 3

If you absolutely love the program, just reinstall it without the sponsorship options.

Then, run an online virus scan at Panda Software.

Once that's all done, post both the Panda Scan log and a new HijackThis log.

Edited by Guse, 17 July 2005 - 09:33 PM.

[Guse]

A few things to note, first:

• I see that you have AVG Free, Avast! 4 and Panda TruPrevent all running on your machine… that’s going to slow you down. I realize that TruPrevent is meant to run with another virus scanner, so I’d decide between Avast and AVG if I were you. Running more than one virus scanner rarely helps offer any additional protection and can quite honestly cause each to function worse. My suggestion is that if you paid for Avast (I can’t tell from the log), stick with that. If they’re both the personal free editions, just pick one and uninstall the other. Keeping the one anti-virus and running TruPrevent isn’t a bad bit of protection.

• If Panda ActiveScan isn’t working for you, that’s fine (it won’t run on my home computer for some reason, either). I see that you’ve been to Trend Micro’s Housecall at least once, so running that scan again or one at Kaspersky Online would work just fine. Whichever you choose, just remember to retain the log it provides and post it in your next response.

• I normally wouldn’t mention this until the end, but the returning lines have me concerned. I see that you’re running Limewire. That program is pretty notorious for being bundled with malware. There are “good” P2P programs out there (in this case “good” means “spyware-free”). You can follow this link for a decent listing. My suggestion is that you uninstall it for the length of the fix. Then, if you want a P2P program, replace it with one from that list. At the very least, make sure you have a newer install of Limewire (old versions are bad).

Now, onto the next batch of fixes:

Firstly, download and install Cleanup! but don’t run it quite yet.
*NOTE* Cleanup deletes EVERYTHING out of temp/temporary folders and does not make backups.

Now, run that online virus scan. Choose Panda, Trend or Kaspersky (which are linked above).

Run HijackThis and place check marks next to the following entries in bold:

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file) O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)
O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)
O4 - HKLM\..\Run: [Dupe slow eq view] C:\Documents and Settings\All Users\Application Data\peak vga dupe slow\frag live.exe
O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe

Make sure that you’ve visually double-checked that those (and only those) entries have been selected and click Fix

Reboot into Safe Mode.

Once in Safe Mode, Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu). Set the program up as follows: 1. Click Options...
2. Move the arrow down to Custom CleanUp!
3. Put a check next to the following:o Empty Recycle Bins
o Delete Cookies
o Delete Prefetch files
o Scan local drives for temporary files
o Cleanup! All Users
4. Click the OK button
5. Press the CleanUp! button to start the program.
[/list]Then, using Windows Explorer, find and delete the following folders (if they exist):

C:\Documents and Settings\All Users\Application Data\peak vga dupe slow\
C:\Program Files\Daily Weather Forecast\weather

If you get an error when deleting a file, right-click on the file and check to see if the read only attribute is checked. If it is, uncheck it and try again.

Again, after this group is done, reboot into normal mode, run another HijackThis log and post it in your next reply with the virus scan log of your choice.

[Guse]

Your log is looking a lot better.

As for your question, AVG is a great scanner and you certainly wouldn't go wrong by choosing it. So, if you're tending towards AVG right now, I say go with it.

So, let's do one last thing. Uninstall Avast! and reboot the machine. Then, run me another HijackThis log and let's see where we stand. I want you to reboot just to make sure those 2 lines don't come back.

[Guse]

Remember that unless you purchase Ewido, it doesn't scan real-time. I'd suggest that you update the definitions and run the program about once a week to keep a clean system.

I'd like you to remove 1 more line in HijackThis:

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

This is mostly just housecleaning. Then, just for giggles, run me 1 more log. We should be just about there. I'm pleased that those lines didn't come back.

Edited by Guse, 20 July 2005 - 02:11 PM.

[Guse]

Congrats, your Log is clean!

An update that I recommend is: Windows XP Service Pack 2. Since you're junkware free, the time to get it is NOW. Service Pack 2 is a MAJOR upgrade for XP. It adds numerous security and software patches, as well as new features and functionality. You will also be adding another layer of protection against future threats.

In the future, here are some suggestions to keep your computer more secure.
Use a firewall - If you’re on a broadband connection, this shouldn’t even be an option. You can get a good, FREE firewall from ZoneLabs called ZoneAlarm here.

Make sure that you keep Windows up to date - Microsoft is constantly releasing updates to plug holes in their OS. It’s a good idea to take advantage of these as frequently as possible. As a matter of fact, if you’re lazy like me you can set Automatic Updates by right clicking on My Computer and selecting Properties . Then click the Automatic Updates tab, then click the Automatic radio button then click OK.

Make sure you have an up-to-date virus scanner – This is super important. Heck, it typically doesn’t even matter which one that you use… just pick one and keep it updated. A free virus scanner can be had from Grisoft, called AVG. Get it here.

You can also get a more secure browser – Not a necessity at all, but most exploits are manufactured to attack Internet Explorer. For the time being, browsers such as Opera and Firefox aren’t nearly as exploitable… yet.

Practice safe browsing – Just some run of the mill things to keep you safer. Don’t open email attachments even from people you know unless you know the attachment is coming. Try to stay to larger websites… it’s the smaller… less public ones that typically give you trouble (*this isn’t to say NEVER go there, just minimize it*). Also, try to stay legal: warez (stolen software) and file sharing apps (Kazaa, Torrents) tend to have grotesque amounts of spyware associated.

These are just some helpful tips. Enjoy malware-free computing!

[Guse]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.