Persistant problem :(

[Vince]

Still not sure :(

Spybot comes back clean but there are 300+ temp files of which 1 could not be deleted

spybot tempfiles(a1).pngspybot tempfiles(a).pngspybot found(a).png

[Juliet]

The temp file was in use so thats not an issue.
These screen shots are for temp files and cookies.....These are collected daily and follow your web browsing.

Fix It For Me

[Vince]

Thanks for the reassurance Juliet

I think I was a little concerned by the amount of temp files that are created after I have deleted them all.
333 in about 5 mins now.
Previously 700+

I ran the fix it and will scan again when I return later this afternoon. I will post back any findings.

Thanks again

Vince

[Juliet]

Please Run TFC by OldTimer to clear temporary files:
TFC by OldTimer and save it to your desktop.

Close any open programs and Internet browsers.
Double click TFC.exe to run it on XP (for Vista and Windows 7 right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
Please be patient as clearing out temp files may take a while.
Once it completes you may be prompted to restart your computer, please do so.
Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

[Vince]

Thanks again Juliet

I used TFC and then went to safe mode and scanned with Spybot. It found 9 tracking cookies.

TFC log

Getting user folders.

Stopping running processes.

Emptying Temp folders.


User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Public

User: Vince and Mel
->Temp folder emptied: 46857397 bytes
->Temporary Internet Files folder emptied: 134624565 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Apple Safari cache emptied: 14571520 bytes
->Flash cache emptied: 1434 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1014002 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 99 bytes
Process complete!

Total Files Cleaned = 188.00 mb


Once Spybot had finished I reloaded windows and sat at the desktop for 5 mins.
I then exited back to safe mode and scanned again.
spybot tempfiles(b1).png spybot tempfiles(b).png

Maybe I'm being over paranoid.... but 300+ temp files for going to my desktop... just seems excessive?

[Juliet]

Are you experiencing anything abnormal or malware related?

I've asked one of the administrators to look in and give me an opinion.

[Vince]

Honestly no....

Once you removed evilhook from the system, the tell that something was wrong had gone... thanks

I probably am paranoid (being robbed does not help)... the only "odd" behaviour that I have noticed has been my tabs in IE11. I cannot pull a tab out anymore (in a window of its own).
That and the large amount of temp files.

[Juliet]

The IE settings

Change or reset Internet Explorer settings

Let me know if this helps

[Juliet]

Which version of Spybot do you have?
http://www.safer-networking.org/shop/

Post #5
"Should I have given elevated rights?"

How can I get administrator rights under Windows Vista / Windows 7 / Windows 8?

If you run it again with elevated permissions and that doesn't resolve the issue please post in the Spybot forum providing a link to his malware topic.
http://forums.spybot.info/forumdisplay.php?4-Spybot

[Vince]

I tried the reset IE but still have the same problem with not being able to drag out tabs to a new window... they move from side to side, but will not leave the box

I tried running mbam again with elevated rights, it gave the same result.
I forgot to say last time that it said about appInit.dll's and to hit no if not sure... that's what I did... and again this time.

I'm using Spybot 1.6.2.46

Did you want me to post in the spybot forum?