[Rawe]

Ok, can you download CCleaner here: http://www.ccleaner.com/

Do NOT run the program yet. Install it.. Launch it. Go to the "Tools" section and select the lower tab "Automatically starting applications" (or something similar, I'm translating from finnish).

Can you then post me here all of the objects on the list.

[Advertisements]

ok dude, the tab is called "Startup" in the english version, and what
I have in it is :

SystemTray
CpuIdle (everyone knows this goodie)
C-Media mixer
Jet Detection (some SoundBlaster Live program)
ccApp (from the symantec shared folder, i don't have symantec product but used to..)
AVG7_CC
AVG7_EMC
nwiz (i have no idea what this is but i have this for years now....)
NvCplDaemon (has to do with my NV graphic card i think)
appbar.lnk (my bar program which i recommand)
Adobe Gamma.lnk (some crappy adobe [bleep], but i think i need this..)

[vsync]

ok dude, the tab is called "Startup" in the english version, and what
I have in it is :

SystemTray
CpuIdle (everyone knows this goodie)
C-Media mixer
Jet Detection (some SoundBlaster Live program)
ccApp (from the symantec shared folder, i don't have symantec product but used to..)
AVG7_CC
AVG7_EMC
nwiz (i have no idea what this is but i have this for years now....)
NvCplDaemon (has to do with my NV graphic card i think)
appbar.lnk (my bar program which i recommand)
Adobe Gamma.lnk (some crappy adobe [bleep], but i think i need this..)

[Rawe]

I'm not sure what's happening since your log looks good to me.

Download and install EasyCleaner:
http://personal.inet...rts/ecleane.htm

After installing it check under Settings > Registry tab if the backup
option is checked and if the directory it points to exists.
This should be true by default, but check anyway.

Then click OK and click Registry
Then click Search. When it is done select all the items per color,
(most, if not all should be green) and click Remove.

Reboot when you are done.

Then.

Please do an online scan with Kaspersky WebScanner

Next Click on Launch Kaspersky Anti-Virus Web Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  Standard
  
  • Scan Options:
  Scan Archives
  Scan Mail Bases
• Click OK
• Now under select a target to scan:Select My Computer
• This program will start to scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.
• Copy and paste that information in your next post.

[Rawe]

Why do you have two anti-virus software's running at the same time??

Please only use one active at a time.. Either use Norton or AVG. Personally I would recommend keeping AVG.

[vsync]

I don't use 2 anti-virus programs, i ain't dumb..
I only use AVG, i've uninstalled Norton months ago..

anyway, the trojran seems to be gone because i don't get
the AVG pop ups anymore..
10x dude!

[Rawe]

That's great to hear!

**Re-hide hidden files option you modified earlier**

Let's clear out your restore points now.

Disable System Restore;

1. Click Start > Programs > Accessories > Windows Explorer
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Check the "Turn off System Restore"
5. Click Apply. An message shows up.
6. Click "Yes" to do this.
7. Confirm with "Ok".

Reboot.

Enable System Restore;

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck the "Turn off System Restore" check box.
5. Click Apply, and then click "OK".

Now set a fresh restore point.

Here's some tips for future to prevent spyware;

Detect and Remove Programs:

• How to use Ad-Aware to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Ad-Aware.
• How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware.

Prevention Programs:

• Spywareblaster <= SpywareBlaster will prevent spyware from being installed. (My favourite)
• Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts.
• MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
• Google Toolbar <= Get the free google toolbar to help stop pop up windows.

Other necessary Programs:

• AntiVirus Program <= An AntiVirus program is a must! Whether it is a free version like AVG or Anti-Vir, or a shareware version like Norton or Kaspersky, this is a must have.
• Firewall <= A firewall is definatley a must have. Two good free versions are Sygate and ZoneLabs.
• More Secure Browser <= Internet Explorer is not the most secure and best browser. There are safer and better alternatives available. I recommend Firefox.
• EULAlyzer by Javacool <= No need to read End user license agreements when installing software--
  
  # Discover potentially hidden behavior about the software you're going to install
  # Pick up on things you missed when reading license agreements
  # Keep a saved database of the license agreements you view
  # Instant results - super-fast analysis in just a second

And also see TonyKlein's good advice;
So how did I get infected in the first place? (My favourite)

Edited by Rawe, 20 September 2005 - 11:16 AM.

[vsync]

Thanks dude, i'll read those!
good stuff

[Rawe]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.