Search:

No other issues found. Have scanned with malwarebytes and spybot. Mcaffee found 6 or so viruses in email attachments but they were never opened emails and were quarantined anyway. Other than that...

Thank you Tashi.

Just wanted to be sure as don't use RootAlyzer very often but was quite surprised when it suggested there might be a problem. :thanks:

Hi

Could you cast en eye over my log from yesterday please.

Thank you.

:: RootAlyzer Results
File:"Hidden file","C:\Windows\”óÉ"
File:"Unknown ADS","C:\Windows\PLA\System\System...

Thank you Ken you're a gem. :-)

Going to register and post over there now. :thanks:

HI Ken

Good to hear everything looks good. However problems still exist. I recovered my boot. ini for a second time. Msconfig & autoexec still same problem and I still have no recovery consol as...

OTL Extras logfile created on: 28/11/2010 12:04:38 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Ali\Desktop
Windows XP Home Edition Service Pack 2 (Version =...

HI

OTL logs.

OTL logfile created on: 28/11/2010 12:04:38 - Run 1
OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Ali\Desktop
Windows XP Home Edition Service Pack 2...

Took a while to run, and one tiny glitch, despite turning off norton idle scan it tried to start. Hope it doesn't affect the scan, it was only only the screen for less than 5 seconds.

GMER...

Ran ATF. MB log below.


Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5193

Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

Sorry for the delay.

Despite scanning with Norton daily, which finds nothing.

Eset found a Virtumonde. Here's the log.

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx -...

In the last 48 hours normal startup has changed, my option to chose normal xp or recovery console went. System does still boot though. Noticed today at startup now said boot.ini was missing....

Done :bigthumb:

So do I need to uninstall any of the things used combofix dds etc?

Indeed it does, thanks.

So would you say I'm all clean and safe now? Or is that one issue with multiple windows still risky?

Evening

Have got a solution for the yellow bar issue. It is only 1 item that it is causing it to appear and for now I will have to wait as the software does not currently have an IE8 fix.

Have...

Morning .

"C:\Program Files\Internet Explorer\iexplore.exe"

Hi
Phew well I now have IE8 and bookmarks appear to be back.
Computer slowed a lot though. No annoying page openings yet but only had it done for about 10 mins.

Being thick about this new...

Hi
Just now had time to get back to pc, busy busy day. Anyway just had to check something before installing new IE, and I've discovered a new problem. NONE of my favourites are working in IE...

Ok I will give it a go in the morning as I want an early night tonight :-)
Thanks for your continuing help.

Oh and should I be concerned about the MBAM report?

3 attempts later and Adobe 9.3 now installed. :)

Forgot to mention since having this current problem, intermittently when clicking on a link in IE I am having to click twice rather than the normal...

Ok will try and reinstall it now.
I am still getting numerous copies of IE open up randomly. Last episode was just after my last post where about 30 windows appeared. I had to shut it down in...

Afternoon :-)

Ok ran Mbam twice, crashed first time after it found infection. Which I notice is adobe reader 9.3 which as I said failed to install, although I see it did manage to install the...

Uninstalled abobe even though I was only prompted with an update about a week ago. New one doesn't want to install. So will try something else at a later date. Ran ATF for IE and FF.

Still having...

As requested combofix log & new DDS logs.

ComboFix 10-07-12.06 - Ali 13/07/2010 19:28:44.19.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.289 [GMT 1:00]
Running...

Hi
Thanks for replying. Pc still playing up. Something still using resources and IE keeps radomly opening numerous copies of same window. Event log appears to also indicate someone has attempted to...

HI
My pc has been really slow since I accidently clicked on a link on facebook.
I have run Norton & Spybot and nothing showed up except cookies which I deleted.
Something is using my sytem...

Peku006
Thank you so very much for your help. This forum and others like it, and their helpers are an absolute godsend. I don't know where the pc world would be without you all, from the bottom of...

Hi
Removed that entry.
That awful little warning and pop ups have gone. In fact they went as soon as combofix ran :-)
Seems good except that startup is slower than normal, and if I look at...

HI again

Ran ATF. Kaspersky found nothing. Latest HJT.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:59:41, on 20/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE:...

Mbam found nothing. New HJT.

Malwarebytes' Anti-Malware 1.34
Database version: 1866
Windows 5.1.2600 Service Pack 2

20/03/2009 20:28:07
mbam-log-2009-03-20 (20-28-07).txt

Scan type: Full...

Hello Peku006
Thank you for your help.

Have run combofix and fresh HJT attached as requested. Did have slight hiccup with combofix, it did its thing uninterrupted produced the log, but I lost my...

HI
Something managed to bypass my spybot and norton.

Have a red circle with white cross on task bar saying "warning you have a security problem" sends me to skfjkhcdcsh.com or antivrus 2009....

Thank you very much for your time and help. Us mere mortals would be lost without these forums, and people like yourselves giving so freely to help.

Much appreciated.

Fixed item with HJT.

New Pandascan, dont believe its found more adware!!! Dam stuff is awful.


Incident Status ...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:22:23, on 13/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
...

Thank you very much for your help. Pc is running a lot better now. Your help has been invaluable.

:2thumb::2thumb::bow:

ok will do, thank you.

ATF run successfully, and Malwarebytes.
Haven't posted log as it just says "nothing found"

Panda scan from last night. I've not been able to access the forum for 48hrs.



Incident Status ...

Sorry for delay have been unwell again. I will run new Panda scan tomorrow. Thank you for waiting.

Done.

Just so you are aware, something is using a lot of system resources, I had thought it might be related to what now appears to have gone (thank you) also when logging off one a/c to log on...

Malwarebytes' Anti-Malware 1.05
Database version: 394

Scan type: Full Scan (A:\|C:\|F:\|G:\|H:\|I:\|K:\|L:\|)
Objects scanned: 93358
Time elapsed: 29 minute(s), 34 second(s)

Memory Processes...

Sorry for delaying in responding, been laid low with stinking cold.

Ran ATF, then Panda as requested.

Heres Panda results. Seem different to what Kaspersky found?


Incident ...

Been redirected twice, and the latest kaspersky scan showed the following. Help really appreciated thank you.

Trojan-Downloader.JS.Psyme.ou & Trojan-Downloader.JS.Agent.rn


Logfile of Trend...

I posted earlier about a win32.agent.cmn problem. I was running kaspersky & HJT for that problem when kaspersky found win32.navipromo.ao which I believe is a more urgent problem.
I have posted a...

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, December 10, 2007 10:41:31 PM
Operating System: Microsoft Windows XP Home...

One of my kids used the laptop last night, and lo and behold spybot has just thrown up win32.agent.cmn.
Have had spybot get rid of it but can someone make sure its definately gone for me please.
...

Pc still slow but stopped behaving odd.
TT has not mentioned the errant item again. So all is looking hopeful.
Many thanks for all your help.

Seasons Greetings to you.

Followed your instructions to the letter.
When I turned Teatimer back ok, it said updater was trying to change registry/ I denied it access. I guess that means it still lurking somewhere.

Heres...