Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Winfixer Virus [resolved]

Started by codesWithaFist , Oct 20 2005 05:49 PM

This topic is locked

#1
codesWithaFist

Posted 20 October 2005 - 05:49 PM

Member

Member
43 posts

Here's my HijackThis log. I assume I have the Winfixer virus because I get Internet Explorer pop-ups directed at WinFixer.com - also, my pc no longer goes into standby mode. I have read in several newsgroups that broken standby mode is attributable to Winfixer.

Please let me know if you need any additional details and thanks in advance for helping out the community.

Logfile of HijackThis v1.99.1
Scan saved at 7:02:12 PM, on 10/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$NETSDK\Binn\sqlservr.exe
C:\desktopsqlMSSQL$SQL1\Binn\sqlservr.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\snmp.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\Netscape\Netscape\Netscp.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\ROBERT~1.MEY\LOCALS~1\Temp\Temporary Directory 1 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Profiles\default\tjt5c13a.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\ddabc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://128.197.197.2...sCamControl.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: ddabc - C:\WINDOWS\system32\ddabc.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

#2
g2i2r4

Posted 21 October 2005 - 04:02 PM

retired HiJack Helper

Retired Staff
5,080 posts

Welcome codesWithaFist to Geeks to Go!

You are running HijackThis from its zipped archive.
Please create a new folder for it and unzip the program into it.

***

Please print these instructions out for use in Safe Mode.
Please note: your Antivirus program may prompt you to a malicious script trying to run. Allow the entire script once.

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to extract the files
This will create a VundoFix folder on your desktop.
After the files are extracted, please reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then hit enter.
Once in safe mode open taskmanager (ctrl-alt-del) > applications > new task > browse
open the VundoFix folder and doubleclick on KillVundo.bat
You will first be presented with a warning.
It should look like this

VundoFix V2.15 by Atri
By using VundoFix you agree that you are doing so at your own risk
Press enter to continue....
At this point press enter one time.
Next you will see:

Please Type in the filepath as instructed by the forum staff
and then press enter:
At this point please type the following file path (make sure to enter it exactly as below!):
- C:\WINDOWS\system32\ddabc.dll
Press Enter to continue with the fix.
Next you will see:

Please type in the second filepath as instructed by the forum
staff then press enter:
At this point please type the following file path (make sure to enter it exactly as below!):C:\WINDOWS\system32\cbadd.*
Press Enter to continue with the fix.
The fix will run then HijackThis will open, if it does not open automatically please open it manually.
In HiJackThis, please place a check next to the following items and click FIX CHECKED:
O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\ddabc.dll

O20 - Winlogon Notify: ddabc - C:\WINDOWS\system32\ddabc.dll
After you have fixed these items, close Hijackthis.
Press enter to exit the program then manually reboot your computer.
Once your machine reboots please continue with the instructions below.

Download and install CleanUp!

Open Cleanup! by double-clicking the icon on your desktop (or from the Start > All Programs menu).
Set the program up as follows:
Click "Options..."
Move the arrow down to "Custom CleanUp!"
Put a check next to the following (Make sure nothing else is checked!):

Empty Recycle Bins
Delete Cookies
Delete Prefetch files
Cleanup! All Users

Click OK
Press the CleanUp! button to start the program.

It may ask you to reboot at the end, click NO.

Then, please run this online virus scan: ActiveScan

Copy the results of the ActiveScan and paste them here along with a new HiJackThis log and the vundofix.txt file from the vundofix folder into this topic.

#3
codesWithaFist

Posted 21 October 2005 - 11:44 PM

Member

Topic Starter
Member
43 posts

Here are the logs requested:

VUNDO Log

Symantec Trojan.Vundo Removal Tool 1.3.1
The process "explorer.exe" contained a viral thread (000001E0). The thread was terminated.
The process "explorer.exe" contained a viral thread (000001E4). The thread was terminated.

C:\System Volume Information: (not scanned)
registry: HKEY_CLASSES_ROOT\MSEvents.MSEvents (key deleted)
registry: HKEY_CLASSES_ROOT\MSEvents.MSEvents.1 (key deleted)

Trojan.Vundo has not been found on your computer.

The Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 1:44:47 AM, on 10/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$NETSDK\Binn\sqlservr.exe
C:\desktopsqlMSSQL$SQL1\Binn\sqlservr.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\snmp.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\CleanUp!\cleanup.exe
C:\Program Files\CleanUp!\Cleanup.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Robert F. Meyer\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Profiles\default\tjt5c13a.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\ddabc.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://128.197.197.2...sCamControl.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: ddabc - C:\WINDOWS\system32\ddabc.dll (file missing)
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Unfortunately the ActiveScan never launched.

The symptoms of the virus appear to be gone. The pc can successfully be put into standby mode and I've yet to see a popup or redirect.

Thanks for the help so far - as a member of the tech community I truly appreciate your efforts which I will demonstrate with a visit to Paypal.

Cheers,
rfm

#4
codesWithaFist

Posted 21 October 2005 - 11:45 PM

Member

Topic Starter
Member
43 posts

#5
g2i2r4

Posted 22 October 2005 - 06:53 AM

retired HiJack Helper

Retired Staff
5,080 posts

You ran the Symantec tool instead of the Vundofix tool made by our Expert Atribune. Let's see if we can get everything gone.

Can you redo the HijackThis part and remove these two:
O2 - BHO: MSEvents Object - {8DBF02DA-4360-4A7E-BEA1-347B87816327} - C:\WINDOWS\system32\ddabc.dll (file missing)

O20 - Winlogon Notify: ddabc - C:\WINDOWS\system32\ddabc.dll (file missing)

***

Please try Panda again:

Please do an online virus scan with Panda ActiveScan at the right hand corner of this page. You need to use Internet Explorer for this scan.

Once you get to the Panda site, look in the right hand corner for the Panda Active Scan
A new window will appear; click on Check Now!
A new window will appear; fill in the boxes (Country, State, email addy)
Click on Scan Now! >
If you have never used ActiveScan before, you will be prompted to install an ActiveX control (asinst.cab) : click on Install. Panda will install the component, and then install the latest signature files.
From "Select a device to scan...", choose "My Computer"
Allow the scan to run. It'll take a while.
When complete, click on "See Report", and then on "Save report"; save it to a convenient location.
I will need you to post that report in your next reply; simply open the text file, then copy/paste the content here.

#6
codesWithaFist

Posted 22 October 2005 - 01:22 PM

Member

Topic Starter
Member
43 posts

Here's a HijackThis log from this afternoon. It looks like the two files you mentioned are now gone.

I ran the ActiveScan from Pandasoft - that log is at the bottom. It reports

Logfile of HijackThis v1.99.1
Scan saved at 12:54:53 PM, on 10/22/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\ACS.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\System32\DVDRAMSV.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$NETSDK\Binn\sqlservr.exe
C:\desktopsqlMSSQL$SQL1\Binn\sqlservr.exe
C:\Program Files\MySQL\MySQL Server 4.1\bin\mysqld-nt.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\System32\snmp.exe
c:\Toshiba\IVP\swupdate\swupdtmr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\mqsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\WLANSTA.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Documents and Settings\Robert F. Meyer\Desktop\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Profiles\default\tjt5c13a.slt\prefs.js)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Acrobat\ActiveX\AcroIEHelper.ocx
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [WLANSTA.EXE] WLANSTA.EXE START
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://128.197.197.2...sCamControl.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.co...aploader_v6.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.ao.../ampx_en_dl.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\Toshiba\IVP\swupdate\swupdtmr.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

Log for ActiveScan

Incident Status Location

Spyware:Cookie/2o7.net Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Com.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.com.com/]
Spyware:Cookie/Atlas DMT Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Zedo Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Coremetrics Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[data.coremetrics.com/]
Spyware:Cookie/QuestionMarket Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Mediaplex Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Bluestreak Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Tribalfusion Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Ask Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.ask.com/]
Spyware:Cookie/RealMedia Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Hitbox Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/FastClick Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/MammamediasolutionsReported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.targetnet.com/]
Spyware:Cookie/Overture Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Traffic MarketplaceReported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/onestat.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.stat.onestat.com/]
Spyware:Cookie/onestat.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[stat.onestat.com/]
Spyware:Cookie/onestat.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.stat.onestat.com/]
Spyware:Cookie/QkSrv Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.qksrv.net/]
Spyware:Cookie/Statcounter Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/web-stat Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.www.web-stat.com/]
Spyware:Cookie/Adserver Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/Xiti Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.xiti.com/]
Spyware:Cookie/myaffiliateprogramReported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.www.myaffiliateprogram.com/]
Spyware:Cookie/Weborama Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Toplist Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Valueclick Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.valueclick.com/]
Spyware:Cookie/Target Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.target.com/]
Spyware:Cookie/Serving-sys Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Seeq Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.seeq.com/]
Spyware:Cookie/Serving-sys Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Rightmedia Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.rightmedia.net/]
Spyware:Cookie/Maxserving Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/Internetfuel Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.internetfuel.com/]
Spyware:Cookie/Netster Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.lb1.netster.com/]
Spyware:Cookie/Internetfuel Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.internetfuel.com/]
Spyware:Cookie/Linksynergy Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.linksynergy.com/]
Spyware:Cookie/go Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.go.com/]
Spyware:Cookie/Hitbox Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.hg1.hitbox.com/]
Spyware:Cookie/Hitbox Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.ehg.hitbox.com/]
Spyware:Cookie/Euniverseads Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.euniverseads.com/]
Spyware:Cookie/360i Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.ct.360i.com/]
Spyware:Cookie/2o7.net Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Com.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.com.com/]
Spyware:Cookie/Atlas DMT Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Doubleclick Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Zedo Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.zedo.com/]
Spyware:Cookie/Coremetrics Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[data.coremetrics.com/]
Spyware:Cookie/QuestionMarket Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Mediaplex Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Bluestreak Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.bluestreak.com/]
Spyware:Cookie/Tribalfusion Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Ask Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.ask.com/]
Spyware:Cookie/RealMedia Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.realmedia.com/]
Spyware:Cookie/Hitbox Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.hitbox.com/]
Spyware:Cookie/FastClick Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.fastclick.net/]
Spyware:Cookie/MammamediasolutionsReported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.targetnet.com/]
Spyware:Cookie/Overture Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.perf.overture.com/]
Spyware:Cookie/Traffic MarketplaceReported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.trafficmp.com/]
Spyware:Cookie/onestat.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.stat.onestat.com/]
Spyware:Cookie/onestat.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[stat.onestat.com/]
Spyware:Cookie/onestat.com Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.stat.onestat.com/]
Spyware:Cookie/QkSrv Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.qksrv.net/]
Spyware:Cookie/Statcounter Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.statcounter.com/]
Spyware:Cookie/web-stat Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.www.web-stat.com/]
Spyware:Cookie/Adserver Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.z1.adserver.com/]
Spyware:Cookie/Xiti Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.xiti.com/]
Spyware:Cookie/myaffiliateprogramReported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.www.myaffiliateprogram.com/]
Spyware:Cookie/Weborama Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.weborama.fr/]
Spyware:Cookie/Toplist Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.toplist.cz/]
Spyware:Cookie/Valueclick Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.valueclick.com/]
Spyware:Cookie/Target Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.target.com/]
Spyware:Cookie/Serving-sys Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Seeq Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.seeq.com/]
Spyware:Cookie/Serving-sys Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.serving-sys.com/]
Spyware:Cookie/Rightmedia Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.rightmedia.net/]
Spyware:Cookie/Maxserving Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.maxserving.com/]
Spyware:Cookie/Internetfuel Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.internetfuel.com/]
Spyware:Cookie/Netster Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.lb1.netster.com/]
Spyware:Cookie/Internetfuel Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.internetfuel.com/]
Spyware:Cookie/Linksynergy Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.linksynergy.com/]
Spyware:Cookie/go Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.go.com/]
Spyware:Cookie/Hitbox Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.hg1.hitbox.com/]
Spyware:Cookie/Hitbox Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.ehg.hitbox.com/]
Spyware:Cookie/Euniverseads Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.euniverseads.com/]
Spyware:Cookie/360i Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Mozilla\Firefox\Profiles\uuqz8jkj.default\cookies.txt[.ct.360i.com/]
Virus:Exploit/ByteVerify Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2e5e301f-764e2692.zip[Dummy.class]
Virus:Exploit/BytVerify Reported C:\Documents and Settings\Robert F. Meyer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-690ccf7f-77dade23.zip[a.class]
Virus:Trj/Hooker.M Reported C:\WINDOWS\system32\sstqr.dll
Cheers,
rfm

#7
g2i2r4

Posted 22 October 2005 - 02:59 PM

retired HiJack Helper

Retired Staff
5,080 posts

You ran the SpyXposer, please run the Free Use Active Scan from the link at the right hand corner of the page.

Post me those results please.

#8
codesWithaFist

Posted 22 October 2005 - 07:18 PM

Member

Topic Starter
Member
43 posts

Here are the results of the ActiveScan

Incident Status Location

Virus:Exploit/ByteVerify Disinfected C:\Documents and Settings\Robert F. Meyer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-2e5e301f-764e2692.zip[Dummy.class]
Virus:Exploit/BytVerify Disinfected C:\Documents and Settings\Robert F. Meyer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\classload.jar-690ccf7f-77dade23.zip[a.class]
Virus:Trj/Hooker.M Disinfected C:\WINDOWS\system32\sstqr.dll

Cheers,
rfm

#9
g2i2r4

Posted 23 October 2005 - 05:23 AM

retired HiJack Helper

Retired Staff
5,080 posts

Looks like you did it.

Is the computer running ok?
If so, shall I post you some tips for the future and close this topic?

#10
codesWithaFist

Posted 23 October 2005 - 11:02 AM

Member

Topic Starter
Member
43 posts

Yes, the computer does seem to be operating just fine. Any tips would be welcome, also any opinions on anti-virus protection. I'm wondering if I should switch from the Starbucks of anti-virus programs.

Many, many thanks.

Cheers,
rfm

#11
g2i2r4

Posted 23 October 2005 - 12:42 PM

retired HiJack Helper

Retired Staff
5,080 posts

You could try eTrust free for a year.

-------------

Please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

You can find instructions on how to enable and re-enable system restore here:

Managing Windows Millenium System Restore

or

Windows XP System Restore Guide

Re-enable system restore with the instructions from the tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
  - Change the Download signed ActiveX controls to Prompt
  - Change the Download unsigned ActiveX controls to Disable
  - Change the Initialize and script ActiveX controls not marked as safe to Disable
  - Change the Installation of desktop items to Prompt
  - Change the Launching programs and files in an IFRAME to Prompt
  - Change the Navigate sub-frames across different domains to Prompt
  - When all these settings have been made, click on the OK button.
  - If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Use an AntiVirus Software - It is very important that your computer has an anti-virus software running. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer always has the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & Hijacker protection on your computer alongside your virus protection. You should also scan your computer with this program on a regular basis just as you would an antivirus software.

A tutorial on installing & using this product can be found here:

Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
Install Ad-Aware – Download and install Ad-Aware. You should also scan your computer with this program on a regular basis just as you would an antivirus software in conjunction with Spybot.

A tutorial on installing & using this product can be found here:

Using Ad-aware to remove Spyware, Malware, & Hijackers from your Computer
Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.