[Ardent]

I have taken the liberty of just going ahead and reinstalling the software after noticing that the device manager was up and viewable( yes it was an incredible job swandog did!) I did notice that there were some yellow question marks next to the Epson drivers so I uninstalled them. Then went to the Epson site downloaded and installed the latest drivers and scan utilities, Rebooted and plugged in the scanner and low an behold it worked!
As of now everything works normally . I can't believe how fast my machine runs now. I think I must have had this infection for at least 4-5 months, much longer than I originally thought. The scanner problem is what really brought it to my attention. I want to thank you all for the wonderful help I recieved on this problem. It certainly has given me a new perspective on the invasivness of these viruses.

I have taken notice of the problem it caused and am determined to take appropriate messures to safeguard my pc. I have AVG as my antivirus program . I did have Norton but it didn't catch this virus. I am very good about keeping my scan engine up to date so I am at a loss as to why it missed it. AVG was reccomended to me so I will use it for now until I invest in a new program ( any suggestions appreciated). I also have spyware Doctor up and running again. I think it wasn't a problem to begin with. It must have been a coincidence that I inoticed the scanner problem just after I installed it. It already caught a trojan yesterday so I feel its doing the job.
Unless you feel there is anything else I need to do to tweak the system, I'd say this case is closed!

[Advertisements]

I'll post my usual 'prevention speech', but you'd better wait for Jack123 to give a final OK as well


Everything looks great --- you seem to be clean.
Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows, including the latest version of Internet Explorer. This can patch many of the security holes through which attackers can gain access to your computer. Your current versions are outdated. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.o...oducts/firefox/

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are ZoneAlarm, Kerio, or Sygate.
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Edited by Swandog46, 22 January 2006 - 06:25 PM.

[Swandog46]

I'll post my usual 'prevention speech', but you'd better wait for Jack123 to give a final OK as well


Everything looks great --- you seem to be clean.
Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows, including the latest version of Internet Explorer. This can patch many of the security holes through which attackers can gain access to your computer. Your current versions are outdated. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.o...oducts/firefox/

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are ZoneAlarm, Kerio, or Sygate.
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Edited by Swandog46, 22 January 2006 - 06:25 PM.

[Ardent]

Great !
I have Adaware and Spybot already, I downloaded Spyware Blaster and Spyguard. I have Spyware Doctor already on my pc. I really try to keep them up to date as I do with my antivirus program AVG. Do all these programs run in the background? Is there a possible problem with that? Does it take up resources?
I have downloaded Firefox and will try it for awhile to see if I like it. I have updated MS IE as per your suggestion also. I have heard about the probblems with IE so I will make sure I have the lates updates. Is there a way to tell if I have the latest updates for it? Trying to navigate through MS web site is a nightmare.

Thanks again for the great job you all did!

[Jack123]

Scanner Twain Problem-[PMW-#8]
23rd Jan 2006

I was just waiting for [Malware Tech Staff] to give – [OK to Go] – and give you – [The Speech] -

I also have spyware Doctor up and running again. I think it wasn't a problem to begin with. It must have been a coincidence that I inoticed the scanner problem just after I installed it.

Catch 22 – Which came 1st – [Chicken] or – [Egg]

Do all these programs run in the background? Is there a possible problem with that? Does it take up resources?

Almost all of these programs want to be started with Windows – It is best to pick only One to run all the time – And periodically run the others – by themselves – for extra verification – Running more than one at time – will tend to have them step on/over each other & possibly permit some – Maleware – to slip thru detection – And will tend to use more resources –

You should also have a [Firewall] – Installed & maintained also – They can be troublesome – but can be tailored to your requirements – The biggest advantage is – Not that they keep things out – But that they keep things from getting Out –

You become the – Weakest Security Link – depending on what you permit to – [Come In] – or – [Go Out] – but the best thing would be – you would have a – Security Record – that could help discover origin -

Is there a way to tell if I have the latest updates for it? Trying to navigate through MS web site is a nightmare.

To Check for Latest Security Updates use the Free Advisor Application from Belarc -

Belarc Advisor - Free Personal PC Audit (version 7.0t)
http://www.belarc.co...e_download.html

have taken the liberty of just going ahead and reinstalling the software after noticing that the device manager was up and viewable( yes it was an incredible job swandog did!) I did notice that there were some yellow question marks next to the Epson drivers so I uninstalled them. Then went to the Epson site downloaded and installed the latest drivers and scan utilities, Rebooted and plugged in the scanner and low an behold it worked!

Hardware Problem Troubleshooting – Starts with – [Device Manager] – Swandog46 returned your – [Tool] – that - [Malware] – stole

Glad that PC & Scanner are – Functional – You can use – [Everest] & [Belarc] with [Device Manager] to maintain PC Updates – Were the Links that I directed your way of any help –

Glad that you hung in there – and – also glad you gave us feedback on how/what you did to fix Original problem -

Please stay with – Geeks to Go – You do not need to have a problem to stay – There are Information Forums – that you can participate –

Good Luck-
Jack123

Edited by Jack123, 23 January 2006 - 10:30 AM.

[Swandog46]

I disagree --- you can have everything running in the background just fine. SpywareBlaster configures Windows to protect for you, so it doesn't actually run in the background anyway. SpywareGuard does, and I suppose you could leave that off in favor of the Spyware Doctor realtime protection. That would be OK. But the rest are not realtime --- AdAware and Spybot are on-demand scanners (Spybot has a realtime component called TeaTimer, but you can leave that disabled. It also has I.E. browser protection which is integrated, not realtime, so that should be enabled at the very least.)

Naturally add an antivirus and a firewall to this to round it out; those are OK to run at the same time too.

About Windows Update, make sure you are set up to receive updates automatically. Go to Start -> Control Panel -> Automatic Updates, and make sure they are enabled.

And about the browser, it might be the single most important thing. I haven't *had* a single problem since I switched to Firefox. It simply doesn't have the security holes I.E. does. And to top it off, in addition to being safer, it's much faster too --- a newer browser, and simply better-designed. I challenge you to try it for a week --- I'll guarantee you won't want to go back!

[Ardent]

Thanks for the advice. I am running Firefox now. Also I am using the firewall that comes with Windodws. Is this acceptable or would the other ones you mentioned be better suited?

[Swandog46]

The other ones are really much better..... ZoneAlarm is the most user friendly probably, and perhaps Sygate or Outpost is the most powerful? Again, you'll get a lot of differences of personal preference.

[Ardent]

I installed zonealarm which seems to be doing the job. I do have one last question reguarding p2p . I download music occasionally and I now realize that may be a possible entry way for spyware/ viruses. I have ben reading various opinions on the web about these. There are some that I definetly had and gotten rid of long ago. Now I use Limewire Pro and i have seen various thoughts on this, some say that it has problems, other say a certain version is fine. Will my ZoneAlarm help protect me from any potential issues? Is there a p2p program thats is safest?

Thanks again

[Swandog46]

For P2P recommendations, see:
http://www.spywarein...m/articles/p2p/

Also, thanks to Mosaic1 for pointing out that there may be one leftover file that we missed (translated from the hexadecimal code). Can you please go to c:\windows\system32 and look for a file called CONWEXEC.EXE? If you find it, please (1) upload it for analysis at http://virusscan.jotti.org/ and post the results here for me, and then (2) delete it.

[Ardent]

Checked where you mentioned it and the file was not there so I guess I'm clean?

Also is there a site on the web that has up to date info on P2P, specifically Limewire Pro 4.9.4 I am trying to track down wether it has spyware or not. I see that some versions do but some are clean. I can't seem to find info on the pro version.

Thanks for the guidance

[Swandog46]

Did you read the link I sent you to? I *thought* that LimeWire 4 was clean, but previous versions were not. But I am now not so sure...

If you don't mind I want to check more thoroughly for that file. Please run Notepad and copy the following text into a new file:

@ECHO OFF
cd %systemdrive%\
dir /a /s CONWEXEC.EXE >> results.txt
notepad results.txt

Save the file to the desktop as log.bat and make sure the "Save as type" field says "All files". Close Notepad, and double-click on the log.bat you just created. It will run for a few seconds, then a logfile should open up in Notepad. Please post the contents of this log here for me.

[Ardent]

Thanks for the info. I'll keep looking for more info on Limewire.
I'm afraid I don't know notepad. Could you give me more explicit instructions please.

Thank you

[Swandog46]

Sure Go to Start -> Programs -> Accessories -> Notepad, or alternatively, go to Start -> Run -> notepad.

[Ardent]

I did and it brought up a black box with C\windows\system32\cmd.exe at the top and a blinking insertion point and that was all. Nothing to post other than that.

[Swandog46]

Can you check to see if there is a file called c:\results.txt, and if so, what it contains? This is very strange.