[grey5730]

Too right! Lay on, McDuff! How may I help?

(BTW, the scan is 6% done and it's already found one virus with 2 infected objects! I'm shocked -- and quite a bit cheesed off, too! If I find that git of a nephew of mine has been mucking about with my machine I'll have his guts for garters!)

Cheers,
Grey

[Advertisements]

Hi Grey

thanks for that. One of my colleagues, Atri, will be posting on here to you. He is a top guy and was responsible for the tool that we used to get rid of your infection.

[ukbiker]

Hi Grey

thanks for that. One of my colleagues, Atri, will be posting on here to you. He is a top guy and was responsible for the tool that we used to get rid of your infection.

[grey5730]

Not at all. Glad to help any way I can. You've been a real brick about this mess, so if there's anything I can do to 'give back' a bit, I'm only too happy to do so.

Looking forward to hearing from Atri.

Grey

PS: 18% now, still at 1 virus, 2 infected objects. Let's hope there are no more!

[ukbiker]

Hi again

I have just spoken with atri, and unfortunately, when we used Cleanup earlier, that will have destroyed the data he needed

ah well, thanks anyway.

How is the Kavscan progressing?

[grey5730]

Oh bugger! :-( I was afraid of that, but I hoped that he could use some sort of data recovery proggie (like the police use) to find what he was looking for. *sigh*

The scan is still marching along merrily and has reached 95%. It is showing 5 viruses and 8 infected objects thus far. I am NOT a happy camper.

Will let you know as soon as the bloody thing is done.

Harrrrrrumph!

Grumpily,
Grey

[grey5730]

Ok, here's the Kaspersky text:

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, September 19, 2005 17:31:58
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.67.0
Kaspersky Anti-Virus database last update: 19/09/2005
Kaspersky Anti-Virus database records: 150100
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 91068
Number of viruses found: 5
Number of infected objects: 8
Number of suspicious objects: 0
Duration of the scan process: 3821 sec

Infected Object Name - Virus Name
C:\1.exe/data0003 Infected: not-a-virus:AdWare.ToolBar.HotSearchBar.i
C:\1.exe Infected: not-a-virus:AdWare.ToolBar.HotSearchBar.i
C:\Documents and Settings\Lori\My Documents\services\SETI\setiathome.exe Infected: not-a-virus:[email protected]
C:\Program Files\Dell\Media Experience\Extension\WTGames\InstallWT.exe/data0061/data0112 Infected: not-a-virus:AdWare.WinAD
C:\Program Files\Dell\Media Experience\Extension\WTGames\InstallWT.exe/data0061 Infected: not-a-virus:AdWare.WinAD
C:\Program Files\Dell\Media Experience\Extension\WTGames\InstallWT.exe Infected: not-a-virus:AdWare.WinAD
C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll Infected: not-a-virus:AdWare.ToolBar.MyWay.v
C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b

Scan process completed.

******************************

Looking at it, I see the seti@home thingummy, which is not an infection, but something I've been doing for over 6 years now. (we'll find those little green sods yet! HAH!)

As for the other stuff, it looks to be all adware and such, and I have no idea where it came from. Grrrrrrrrrrrrrrrrrrr.

Is that WT stuff from Wild Tangent? A lot of Wild Tangent stuff comes bundled with computers (as games, both online and one-player versions), and each time I've got a new machine I've tried to rid myself of all that crapware (including AOL and other proprietary software and adverts for ISPs), but sometimes it's pretty stealthy. I absolutely loathe Wild Tangent, so if there is even one little remnant of their filth on my computer I want it out of there!

Sorry, I guess I'm sounding a bit shrill.

Frustrated,
Grey

So, what's the next step, kind sir?

Resignedly,
Grey

[ukbiker]

Hi there

dont worry, thats about what I expected to show up.

Im getting fed up myself with the seti app getting flagged as malware, i run it in background to and the folding proteins distrib on my test box as well, so we will leave them alone

almost everything else there has come either courtesy of dell media experience games or from your homepage install. The popcaploader entry is actually fairly harmless and on the occasions i have removed it, the user has had problems with running games afterwards in about 40% of cases.

the one that we will get rid of now though is the hotsearch bar entry.

Please reboot into safe mode, then using windows explorer, find and delete this files/folder

C:\1.exe

then reboot into normal mode, rerun HJT and post the log here for me as well as your wishes for the WT, Mysearch items related to dell and your homepage.

[grey5730]

Hi UKBiker,

1.exe is history. Here's the HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 6:31:48 PM, on 9/19/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Kerio\Personal Firewall\persfw.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Documents and Settings\Lori\My Documents\services\SETI\seti_service.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Lori\My Documents\services\SETI\setiathome.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe
C:\Program Files\Dell Photo AIO Printer 942\memcard.exe
C:\Program Files\Dell Photo AIO Printer 942\dlbubmon.exe
C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Lori\My Documents\Botty\Botty.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Documents and Settings\Lori\My Documents\Proggies\AtomicTimeSync\ats.exe
C:\Program Files\SpyCatcher\Protector.exe
C:\Program Files\SpyCatcher\Scheduler daemon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\ToolBox\Toolbox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://my.iwon.com/i...G=home&SEC=bnav
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com...de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.iwon.com/i...G=home&SEC=bnav
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\1.bin\deSrcAs.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Advanced Tools Check] C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [Dell Photo AIO Printer 942] "C:\Program Files\Dell Photo AIO Printer 942\dlbubmgr.exe"
O4 - HKLM\..\Run: [DellMCM] "C:\Program Files\Dell Photo AIO Printer 942\memcard.exe"
O4 - HKLM\..\Run: [GhostSurfDelSatellite] "C:\Program Files\SpyCatcher\DeleteSatellite.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Protector.lnk = C:\Program Files\SpyCatcher\Protector.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Startup: ToolBox.lnk = C:\Program Files\ToolBox\Toolbox.exe
O4 - Global Startup: Botty.lnk = C:\Documents and Settings\Lori\My Documents\Botty\Botty.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Shortcut to ats.exe.lnk = C:\Documents and Settings\Lori\My Documents\Proggies\AtomicTimeSync\ats.exe
O4 - Global Startup: SilkQuit Meter.lnk = C:\Program Files\valecam\SilkQuit\SilkQuit.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....k/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.micros...b?1122115196828
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://sun.jerseyins...sCamControl.ocx
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.gwcoc.org...ms/h263ctrl.cab
O16 - DPF: {CC05BC12-2AA2-4AC7-AC81-0E40F83B1ADF} (Live365Player Class) - http://www.live365.c...ers/play365.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://a284.g.akamai...aploader_v6.cab
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: PCANotify - C:\WINDOWS\SYSTEM32\PCANotify.dll
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: dlbu_device - Dell - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Kerio Personal Firewall (PersFw) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall\persfw.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SETI@Home Service (SETI@Home) - Unknown owner - C:\Documents and Settings\Lori\My Documents\services\SETI\seti_service.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe




Let's leave the popcap loader, since (oh, the shame!) I do play a few games online. I know, I know, I know, I SHOULD be working! :-D

As for the Dell crap, what IS it, exactly? It isn't anything I need, is it? Would it bollix up the solitaire, hearts and such? I know the MyWay junk comes from Dell, but I never knew just what it was for.

Whatever that Hotsearch Bar is, please, by all means, turf it. 'We don' neeed no steeenkin' Hotsearch!'

What stuff is coming from iWon? I'm a little confused about what could be coming from them since I've never authorised any sort of download.

Crikey, this stuff is insidious, isn't it?

Grey

[ukbiker]

Hi there

ok then - hotsearchbar i think came buncled from Iwon, but your security apps have stopped it dead in its tracks. Although it is there, it cant do anything. If you deleted that C:\1.exe file i listed in my last post, it is already gone.

Wild tangent and Myway are bundled direct installs from Dell. Removing WT may affect your games they installed, so personally I would leave it. MY way is a neat trick Dell have pulled to "help" their customers get more personalised reults from searches if you use the MyWay Search assistant. Whether it is classed as malware or not is a matter which causes a degree of debate, however I do know that it is reputed to be a less than strightforward uninstall. That said however, if you want to, we will drag it away, although you will need to be comfortable with getting into and navigating around the registry.

In practical terms though, as it hasnt interfered with your internet use so far, it may be adviseable to leave it be.

If you decide to leave these apps installed, you can always come back here in the future if you decide later that you want to get rid of them. Apart from the single file i gave instructions on deletion for earlier, (did you delete it?) your log is clear of the infection that was causing you problems.

Tell me please, how is your PC running now? have the pop ups etc stopped?

[grey5730]

Hi UKBiker,

So far so good. Haven't had one alert that a winwhatever or adsomethingorother was trying to open a web page since we did the VUNDO voodoo. :-D Good riddance to bad rubbish.

I don't use the MyWay/Dell mess, and while it scorches my knickers that Dell (who should bloody well KNOW better, thank you very much) is being sneaky and underhanded, as long as this isn't mucking about with my performance or stealing personal info, I'll leave well enough alone. For now.

And, yes, I most certainly did delete that 1.exe thingummy, and with great relish, I might add.

I do thank you so very much for your help! It seems you've managed to vanquish the dreaded crapware dragon from this particular electronic den. Let's hope that with all the precautions I'm taking, it won't come back.

Now, the next thing on my list is to get Errant Nephew's machine checked out with the Panda and the Kaspersky scans. (He still swears, BTW, that he has never laid a glove on my machine. Hmmmmm . . . ) I've got a pretty good idea what to look for, now, and what is/isn't alarming. He's not had any unusual pop-ups or slowing on his electronic beastie, but I've been installing all the recommended anti-spy ware apps that this site recommends, just to be safe, and I'll want to scan it with as many different things as I can, since it seems that each one finds different problems.

But that's work for another day. Right now I need a cup of tea. If I find anything out of the ordinary on his computer I'll either have him get in here on his next day off, or I'll start another thread for whatever particular problem might have been found. Meanwhile, I'm going to heave a sigh of relief, and put the kettle on.

Again, thank you so very much. I'm eternally grateful for your kindness and patience.

Cheers,
Grey

[ukbiker]

Hi there Grey

This is the bit that I really like



Congratulations , your log is clean

Just a general clean up now and we are done

Now you have to clean out your temporary files and flush your restore points:

• Start | Run | type cleanmgr | OK
• Let it scan your system for files to remove.
• Make sure Temporary Files, Temporary Internet Files, and Recycle Bin are the only things checked.
• Click "OK" to remove them.
• Click "Yes" to confirm the deletion.

Flush System Restore.

To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account.

(Windows XP)
1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

4. Finally Defragment your hard Drive.


So now that your PC is clean, how do you keep it that way?

The single most important measure is this. Keep your copy of XP fully up to date after that,

Here are some tips, to reduce the potential for spyware infection in the future, I strongly recommend installing the following applications:

Detect and Remove Programs:

• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

Prevention Programs:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed.
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

Other necessary Programs:

• AntiVirus Program<= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kapersky, this is a must have.
• Firewall<= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
• More Secure Browser<= Internet Explorer is not the most secure and best browser. There are safer alternatives available. ConsiderFirefox, however Opera and SlimBrowsers are good as well.

And also see TonyKlein's good advice
Spyware Aid's spyware article: Spyware, Adware, Malware: What it is, how it got on my computer, how to get rid of it, and how to prevent it.

Glad to have been of help

pS, When you look at your nephews PC, just remeber that The use of HJT unless you know what you are doing is really dangerous. I would stromgly advise that you do NOT use the specialised tools that we employed here without expert guidance from this forum, as misidentification of an infection can really cause problems. In short, run the antivirus scans, then post a log for us to analyse, better safe than sorry

[grey5730]

Hi-dee-ho UKBiker,

I'll soon start the last bit of clean up and resetting the restore, and will get back to you with the results, but first I wanted to assure you that I will NOT mess with HJG on my own! OOOOOHHHHH-no! I wouldn't know where to begin! When I said I have a good idea of what is and is not alarming, what I meant by that is only that if I run, say, Kaspersky, and it shows up his SETI app, I'll know that it's not to worry. He, too, uses iWon as a start page, so if I see anything relative to that I've got a pretty good idea what to do -- and what NOT to do. I've already checked his machine for 1.exe (nothing, thank goodness).

And I'm smart enough to know what I DON'T know, so if there is the slightest question about a particular item or entry, I have no qualms whatsoever about getting back in here and asking stupid questions, making myself look dumber than a box of rocks. Better that than making a right [bleep]-up of an expensive-to-repair machine! HAH!

Now: Onward and upward! Excelsior! I'm off to run the mop-ups you've indicated want doing.

BTW, a LOT of the things in the latter portion of your last post I've already done (the ie-spyad, the spyware guard and spyware blaster, etc.). I'm not quite sure what to do with the MVPS Hosts file -- although I've already DL'ed it. But, we'll get to that after I've completed the last instructions you gave me.

Back as soon as I can.

Cheers,
Grey

[grey5730]

Hey there, UKBiker:

Okey dokey, the cleanup is done, the System Restore has been flushed, rebooted and turned back on, and the defrag just finished. I've DL'ed and installed the HOSTS file, and have DL'ed the SpyBot, although it is not yet installed. I've bookmarked the page on how to use it and will read that over some later this evening (after that cup of tea!) before I install it. Everything else is done. Does the patient have a clean bill of health? :-)

Thanks so much for everything,
Grey

[ukbiker]

Hi there Grey

yep, everything is sorted now. Great Job

You have a PM from me by the way.

[ukbiker]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.