Click.Gifltoad - HijackerC

ESET scan done

Here is the result :

C:\System Volume Information\_restore{252295B3-C40E-48B4-9091-1C42FC8617DF}\RP17\A0007549.lnk Win32/Adware.ADON application
C:\System Volume Information\_restore{252295B3-C40E-48B4-9091-1C42FC8617DF}\RP18\A0008972.lnk Win32/Adware.ADON application
C:\System Volume Information\_restore{252295B3-C40E-48B4-9091-1C42FC8617DF}\RP18\A0008975.lnk Win32/Adware.ADON application
C:\System Volume Information\_restore{252295B3-C40E-48B4-9091-1C42FC8617DF}\RP23\A0010774.lnk Win32/Adware.ADON application
D:\DONNEES\Downloads\unlocker1.8.7.exe a variant of Win32/Adware.ADON application
D:\DONNEES\Downloads\unlocker1.8.8.exe Win32/Adware.ADON application
D:\DONNEES\Downloads\Unlocker1.9.0.exe Win32/Adware.ADON application
D:\DONNEES\Downloads Scanned\Nero-7.7.5.1_fra_trial.exe Win32/Toolbar.AskSBar application
D:\DONNEES\Downloads Scanned\unlocker1.8.6.exe Win32/Adware.ADON application
 
Hi,

Delete those ESET findings on D: drive. Like I said earlier, system restore items will be swept off by a system restore reset.

Are you familiar with both these IP addresses: 192.74.208.65 & 194.119.228.67?

Update Antivir and run a full scan with again. Let's see what it finds.
 
Done

Hi again,

OK, ESET cleaned the found adwares on drive D:\. Report hereunder.

Avira Antivir full scan performed... Here is the report.
But I am curious : Avira found nothing but 2 "hidden objects" as stated in the last line of the log but did not give any warning, nor did it ask for actions to take (??)
So, I do not even know what are these objects and where they are located...

Regarding the 2 IP adresses you pointed out : I did noticed these ones in the previous logs but did not check carefully... I recognized the 2nd one being one of my internet provider's DNS addresses, but the 1st one is unknown !
After checking with whois, it appears to be located in Australia.
Remark :
Comment: This IP address range is not registered in the ARIN database.
Comment: This range was transferred to the APNIC Whois Database as
Comment: part of the ERX (Early Registration Transfer) project.

Thanks again for your time.

ESET cleaning result :
D:\DONNEES\Downloads\unlocker1.8.7.exe a variant of Win32/Adware.ADON application deleted - quarantined
D:\DONNEES\Downloads\unlocker1.8.8.exe Win32/Adware.ADON application deleted - quarantined
D:\DONNEES\Downloads\Unlocker1.9.0.exe Win32/Adware.ADON application deleted - quarantined
D:\DONNEES\Downloads Scanned\Nero-7.7.5.1_fra_trial.exe Win32/Toolbar.AskSBar application deleted - quarantined
D:\DONNEES\Downloads Scanned\unlocker1.8.6.exe Win32/Adware.ADON application deleted - quarantined


Avira AntiVir Premium
Date de création du fichier de rapport : mercredi 13 avril 2011 22:13

La recherche porte sur 2553189 souches de virus.

Le programme fonctionne en version intégrale illimitée.
Les services en ligne sont disponibles.

Détenteur de la licence : xx
Numéro de série : xx
Plateforme : Windows XP
Version de Windows : (Service Pack 3) [5.1.2600]
Mode Boot : Démarré normalement
Identifiant : SYSTEM
Nom de l'ordinateur : ACER_TM5730

Informations de version :
BUILD.DAT : 10.0.0.104 35932 Bytes 7/03/2011 14:25:00
AVSCAN.EXE : 10.0.3.5 435368 Bytes 14/03/2011 14:40:38
AVSCAN.DLL : 10.0.3.0 56168 Bytes 14/03/2011 14:40:37
LUKE.DLL : 10.0.3.2 104296 Bytes 14/03/2011 14:40:47
LUKERES.DLL : 10.0.0.0 13672 Bytes 14/03/2011 14:40:47
VBASE000.VDF : 7.10.0.0 19875328 Bytes 6/11/2009 14:40:12
VBASE001.VDF : 7.11.0.0 13342208 Bytes 14/12/2010 14:40:24
VBASE002.VDF : 7.11.3.0 1950720 Bytes 9/02/2011 14:40:25
VBASE003.VDF : 7.11.5.225 1980416 Bytes 7/04/2011 11:16:37
VBASE004.VDF : 7.11.5.226 2048 Bytes 7/04/2011 11:16:37
VBASE005.VDF : 7.11.5.227 2048 Bytes 7/04/2011 11:16:37
VBASE006.VDF : 7.11.5.228 2048 Bytes 7/04/2011 11:16:37
VBASE007.VDF : 7.11.5.229 2048 Bytes 7/04/2011 11:16:37
VBASE008.VDF : 7.11.5.230 2048 Bytes 7/04/2011 11:16:37
VBASE009.VDF : 7.11.5.231 2048 Bytes 7/04/2011 11:16:37
VBASE010.VDF : 7.11.5.232 2048 Bytes 7/04/2011 11:16:37
VBASE011.VDF : 7.11.5.233 2048 Bytes 7/04/2011 11:16:37
VBASE012.VDF : 7.11.5.234 2048 Bytes 7/04/2011 11:16:37
VBASE013.VDF : 7.11.6.28 158208 Bytes 11/04/2011 11:43:47
VBASE014.VDF : 7.11.6.74 116224 Bytes 13/04/2011 10:06:48
VBASE015.VDF : 7.11.6.75 2048 Bytes 13/04/2011 10:06:48
VBASE016.VDF : 7.11.6.76 2048 Bytes 13/04/2011 10:06:48
VBASE017.VDF : 7.11.6.77 2048 Bytes 13/04/2011 10:06:48
VBASE018.VDF : 7.11.6.78 2048 Bytes 13/04/2011 10:06:48
VBASE019.VDF : 7.11.6.79 2048 Bytes 13/04/2011 10:06:48
VBASE020.VDF : 7.11.6.80 2048 Bytes 13/04/2011 10:06:48
VBASE021.VDF : 7.11.6.81 2048 Bytes 13/04/2011 10:06:48
VBASE022.VDF : 7.11.6.82 2048 Bytes 13/04/2011 10:06:48
VBASE023.VDF : 7.11.6.83 2048 Bytes 13/04/2011 10:06:48
VBASE024.VDF : 7.11.6.84 2048 Bytes 13/04/2011 10:06:48
VBASE025.VDF : 7.11.6.85 2048 Bytes 13/04/2011 10:06:48
VBASE026.VDF : 7.11.6.86 2048 Bytes 13/04/2011 10:06:48
VBASE027.VDF : 7.11.6.87 2048 Bytes 13/04/2011 10:06:48
VBASE028.VDF : 7.11.6.88 2048 Bytes 13/04/2011 10:06:48
VBASE029.VDF : 7.11.6.89 2048 Bytes 13/04/2011 10:06:48
VBASE030.VDF : 7.11.6.90 2048 Bytes 13/04/2011 10:06:48
VBASE031.VDF : 7.11.6.99 33280 Bytes 13/04/2011 16:39:33
Version du moteur : 8.2.4.206
AEVDF.DLL : 8.1.2.1 106868 Bytes 14/03/2011 14:40:32
AESCRIPT.DLL : 8.1.3.58 1266042 Bytes 4/04/2011 08:40:44
AESCN.DLL : 8.1.7.2 127349 Bytes 14/03/2011 14:40:31
AESBX.DLL : 8.1.3.2 254324 Bytes 14/03/2011 14:40:32
AERDL.DLL : 8.1.9.9 639347 Bytes 25/03/2011 17:44:40
AEPACK.DLL : 8.2.6.0 549237 Bytes 7/04/2011 19:16:39
AEOFFICE.DLL : 8.1.1.20 205177 Bytes 4/04/2011 08:40:43
AEHEUR.DLL : 8.1.2.97 3428726 Bytes 7/04/2011 19:16:39
AEHELP.DLL : 8.1.16.1 246134 Bytes 14/03/2011 14:40:29
AEGEN.DLL : 8.1.5.4 397684 Bytes 4/04/2011 08:40:41
AEEMU.DLL : 8.1.3.0 393589 Bytes 14/03/2011 14:40:29
AECORE.DLL : 8.1.20.2 196982 Bytes 7/04/2011 19:16:37
AEBB.DLL : 8.1.1.0 53618 Bytes 14/03/2011 14:40:29
AVWINLL.DLL : 10.0.0.0 19304 Bytes 14/03/2011 14:39:47
AVPREF.DLL : 10.0.0.0 44904 Bytes 14/03/2011 14:40:37
AVREP.DLL : 10.0.0.8 62209 Bytes 14/03/2011 14:40:37
AVREG.DLL : 10.0.3.2 53096 Bytes 14/03/2011 14:40:37
AVSCPLR.DLL : 10.0.3.2 84328 Bytes 14/03/2011 14:40:38
AVARKT.DLL : 10.0.22.6 231784 Bytes 14/03/2011 14:40:33
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 14/03/2011 14:40:34
SQLITE3.DLL : 3.6.19.0 355688 Bytes 14/03/2011 14:40:50
AVSMTP.DLL : 10.0.0.17 63848 Bytes 14/03/2011 14:40:38
NETNT.DLL : 10.0.0.0 11624 Bytes 14/03/2011 14:40:47
RCIMAGE.DLL : 10.0.0.32 2631528 Bytes 14/03/2011 14:39:49
RCTEXT.DLL : 10.0.58.0 99688 Bytes 14/03/2011 14:39:49

Configuration pour la recherche actuelle :
Nom de la tâche...............................: Contrôle intégral du système
Fichier de configuration......................: C:\Program Files\Avira\AntiVir Desktop\sysscan.avp
Documentation.................................: bas
Action principale.............................: interactif
Action secondaire.............................: renommer
Recherche sur les secteurs d'amorçage maître..: marche
Recherche sur les secteurs d'amorçage.........: marche
Secteurs d'amorçage...........................: C:, D:,
Recherche dans les programmes actifs..........: marche
Programmes en cours étendus...................: marche
Recherche en cours sur l'enregistrement.......: marche
Recherche de Rootkits.........................: marche
Contrôle d'intégrité de fichiers système......: arrêt
Fichier mode de recherche.....................: Tous les fichiers
Recherche sur les archives....................: marche
Limiter la profondeur de récursivité..........: 20
Archive Smart Extensions......................: marche
Heuristique de macrovirus.....................: marche
Heuristique fichier...........................: moyen
Fichiers à exclure............................: D:\DONNEES\Documents\EVMH\images, D:\DONNEES\Documents\EVMH\Photos, D:\DONNEES\Documents\Mes images,
Catégories de dangers divergentes.............: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Début de la recherche : mercredi 13 avril 2011 22:13

La recherche d'objets cachés commence.
c:\windows\system32\shlcmd.exe
c:\windows\system32\shlcmd.exe
[REMARQUE] Le processus n'est pas visible.
c:\windows\system32\shlcmd.exe

La recherche sur les processus démarrés commence :
Processus de recherche 'rsmsink.exe' - '31' module(s) sont contrôlés
Processus de recherche 'WINWORD.EXE' - '86' module(s) sont contrôlés
Processus de recherche 'msdtc.exe' - '42' module(s) sont contrôlés
Processus de recherche 'dllhost.exe' - '63' module(s) sont contrôlés
Processus de recherche 'dllhost.exe' - '47' module(s) sont contrôlés
Processus de recherche 'vssvc.exe' - '50' module(s) sont contrôlés
Processus de recherche 'avscan.exe' - '73' module(s) sont contrôlés
Processus de recherche 'GUARDGUI.EXE' - '44' module(s) sont contrôlés
Processus de recherche 'DESKTO~1.EXE' - '95' module(s) sont contrôlés
Processus de recherche 'DESKTO~3.EXE' - '66' module(s) sont contrôlés
Processus de recherche 'opera.exe' - '97' module(s) sont contrôlés
Processus de recherche 'OUTLOOK.EXE' - '157' module(s) sont contrôlés
Processus de recherche 'wmiapsrv.exe' - '47' module(s) sont contrôlés
Processus de recherche 'wmiprvse.exe' - '49' module(s) sont contrôlés
Processus de recherche 'X-Lite4.exe' - '152' module(s) sont contrôlés
Processus de recherche 'Skype.exe' - '157' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '132' module(s) sont contrôlés
Processus de recherche 'wuauclt.exe' - '36' module(s) sont contrôlés
Processus de recherche 'PresentationFontCache.exe' - '31' module(s) sont contrôlés
Processus de recherche 'ctfmon.exe' - '31' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '36' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '37' module(s) sont contrôlés
Processus de recherche 'AVWEBGRD.EXE' - '39' module(s) sont contrôlés
Processus de recherche 'avmailc.exe' - '33' module(s) sont contrôlés
Processus de recherche 'SpySweeper.exe' - '83' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '44' module(s) sont contrôlés
Processus de recherche 'o2flash.exe' - '17' module(s) sont contrôlés
Processus de recherche 'BackupSvc.exe' - '48' module(s) sont contrôlés
Processus de recherche 'MDM.EXE' - '24' module(s) sont contrôlés
Processus de recherche 'LSSrvc.exe' - '21' module(s) sont contrôlés
Processus de recherche 'IAANTMon.exe' - '39' module(s) sont contrôlés
Processus de recherche 'avshadow.exe' - '32' module(s) sont contrôlés
Processus de recherche 'PLFSetL.exe' - '20' module(s) sont contrôlés
Processus de recherche 'igfxpers.exe' - '29' module(s) sont contrôlés
Processus de recherche 'igfxsrvc.exe' - '25' module(s) sont contrôlés
Processus de recherche 'Agentsvc.exe' - '33' module(s) sont contrôlés
Processus de recherche 'hkcmd.exe' - '32' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '35' module(s) sont contrôlés
Processus de recherche 'igfxtray.exe' - '33' module(s) sont contrôlés
Processus de recherche 'iaanotif.exe' - '43' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '97' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '49' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '91' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '75' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '44' module(s) sont contrôlés
Processus de recherche 'btwdins.exe' - '24' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '177' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '44' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '53' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '61' module(s) sont contrôlés
Processus de recherche 'services.exe' - '41' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '94' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '16' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '2' module(s) sont contrôlés

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
[INFO] Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
[INFO] Aucun virus trouvé !
Secteur d'amorçage 'D:\'
[INFO] Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence :
Le registre a été contrôlé ( '496' fichiers).

La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\' <ACER>
Recherche débutant dans 'D:\' <Data>
Le répertoire 'D:\DONNEES\Documents\EVMH\images\' a été exclu par la recherche !
Le répertoire 'D:\DONNEES\Documents\EVMH\Photos\' a été exclu par la recherche !
Le répertoire 'D:\DONNEES\Documents\Mes images\' a été exclu par la recherche !

Fin de la recherche : mercredi 13 avril 2011 23:04
Temps nécessaire: 50:02 Minute(s)

La recherche a été effectuée intégralement

6003 Les répertoires ont été contrôlés
531221 Des fichiers ont été contrôlés
0 Des virus ou programmes indésirables ont été trouvés
0 Des fichiers ont été classés comme suspects
0 Des fichiers ont été supprimés
0 Des virus ou programmes indésirables ont été réparés
0 Les fichiers ont été déplacés dans la quarantaine
0 Les fichiers ont été renommés
0 Impossible de scanner des fichiers
531221 Fichiers non infectés
10873 Les archives ont été contrôlées
0 Avertissements
0 Consignes
510659 Des objets ont été contrôlés lors du Rootkitscan
2 Des objets cachés ont été trouvés
 
Last edited by a moderator:
Hi,

You may ignore those 2 hidden objects thing Antivir noticed.

Please run Notepad (start > All Programs > Accessories > Notepad) and copy and paste the text in the quote box into a new file:

@echo off
>Log1.txt (
ipconfig /all
nslookup google.com
ping -n 2 google.com
route print
)
start Log1.txt
del %0
Click to expand...

  • Go to the File menu at the top of the Notepad and select Save as.
  • Select save in: desktop
  • Fill in File name: test.bat
  • Save as type: All file types (*.*)
  • Click save.
  • Close the Notepad.
  • Locate and double-click test.bat on the desktop.
  • A notepad opens, copy and paste the content it (log1.txt) to your reply.
 
Hi,
Here is the log.
I checked myself the Connection Properties and I noticed that this IP address we are concerned about is (apparently) an old DNS address from my Internet Provider...
The today correct address is the same BUT beginning with 193.... instead of 192...
And to be honest it might as well be a mistake from my side when entering the "preferred DNS servers"... :red:


Configuration IP de Windows



Nom de l'hôte . . . . . . . . . . : ACER_TM5730

Suffixe DNS principal . . . . . . :

Type de nœud . . . . . . . . . . : Inconnu

Routage IP activé . . . . . . . . : Non

Proxy WINS activé . . . . . . . . : Non



Carte Ethernet Connexion réseau sans fil:



Statut du média . . . . . . . . . : Média déconnecté

Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 5100

Adresse physique . . . . . . . . .: 00-21-5D-3E-E8-68



Carte Ethernet Connexion au réseau local:



Suffixe DNS propre à la connexion :

Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet

Adresse physique . . . . . . . . .: 00-1D-72-D4-5F-B0

DHCP activé. . . . . . . . . . . : Non

Adresse IP. . . . . . . . .*. . . : 192.168.1.11

Masque de sous-réseau . . .*. . . : 255.255.255.0

Passerelle par défaut . . .*. . . : 192.168.1.1

Serveurs DNS . . . . . . . . . . : 192.74.208.65

194.119.228.67

DNS request timed out.
timeout was 2 seconds.
Serveur : dnsv.scarlet.be
Address: 194.119.228.67

Nom : google.com
Addresses: 74.125.79.99, 74.125.79.104, 74.125.79.147



Envoi d'une requˆte 'ping' sur google.com [74.125.79.99] avec 32 octets de donn‚esÿ:



R‚ponse de 74.125.79.99ÿ: octets=32 temps=38 ms TTL=54

R‚ponse de 74.125.79.99ÿ: octets=32 temps=38 ms TTL=54



Statistiques Ping pour 74.125.79.99:

Paquetsÿ: envoy‚s = 2, re‡us = 2, perdus = 0 (perte 0%),

Dur‚e approximative des boucles en millisecondes :

Minimum = 38ms, Maximum = 38ms, Moyenne = 38ms

===========================================================================
Liste d'Interfaces
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 5d 3e e8 68 ...... Intel(R) Wireless WiFi Link 5100 - Miniport d'ordonnancement de paquets
0x3 ...00 1d 72 d4 5f b0 ...... Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
===========================================================================
===========================================================================
Itin‚raires actifsÿ:
Destination r‚seau Masque r‚seau Adr. passerelle Adr. interface M‚trique
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.11 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.11 192.168.1.11 20
192.168.1.11 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.11 192.168.1.11 20
224.0.0.0 240.0.0.0 192.168.1.11 192.168.1.11 20
255.255.255.255 255.255.255.255 192.168.1.11 192.168.1.11 1
255.255.255.255 255.255.255.255 192.168.1.11 2 1
Passerelle par d‚fautÿ: 192.168.1.1
===========================================================================
Itin‚raires persistantsÿ:
Aucun







Configuration IP de Windows



Nom de l'hôte . . . . . . . . . . : ACER_TM5730

Suffixe DNS principal . . . . . . :

Type de nœud . . . . . . . . . . : Inconnu

Routage IP activé . . . . . . . . : Non

Proxy WINS activé . . . . . . . . : Non



Carte Ethernet Connexion réseau sans fil:



Statut du média . . . . . . . . . : Média déconnecté

Description . . . . . . . . . . . : Intel(R) Wireless WiFi Link 5100

Adresse physique . . . . . . . . .: 00-21-5D-3E-E8-68



Carte Ethernet Connexion au réseau local:



Suffixe DNS propre à la connexion :

Description . . . . . . . . . . . : Broadcom NetXtreme Gigabit Ethernet

Adresse physique . . . . . . . . .: 00-1D-72-D4-5F-B0

DHCP activé. . . . . . . . . . . : Non

Adresse IP. . . . . . . . .*. . . : 192.168.1.11

Masque de sous-réseau . . .*. . . : 255.255.255.0

Passerelle par défaut . . .*. . . : 192.168.1.1

Serveurs DNS . . . . . . . . . . : 192.74.208.65

194.119.228.67

DNS request timed out.
timeout was 2 seconds.
Serveur : dnsv.scarlet.be
Address: 194.119.228.67

Nom : google.com
Addresses: 74.125.79.99, 74.125.79.104, 74.125.79.147



Envoi d'une requˆte 'ping' sur google.com [74.125.79.99] avec 32 octets de donn‚esÿ:



R‚ponse de 74.125.79.99ÿ: octets=32 temps=38 ms TTL=54

R‚ponse de 74.125.79.99ÿ: octets=32 temps=38 ms TTL=54



Statistiques Ping pour 74.125.79.99:

Paquetsÿ: envoy‚s = 2, re‡us = 2, perdus = 0 (perte 0%),

Dur‚e approximative des boucles en millisecondes :

Minimum = 38ms, Maximum = 38ms, Moyenne = 38ms

===========================================================================
Liste d'Interfaces
0x1 ........................... MS TCP Loopback interface
0x2 ...00 21 5d 3e e8 68 ...... Intel(R) Wireless WiFi Link 5100 - Miniport d'ordonnancement de paquets
0x3 ...00 1d 72 d4 5f b0 ...... Broadcom NetXtreme Gigabit Ethernet - Miniport d'ordonnancement de paquets
===========================================================================
===========================================================================
Itin‚raires actifsÿ:
Destination r‚seau Masque r‚seau Adr. passerelle Adr. interface M‚trique
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.11 20
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
192.168.1.0 255.255.255.0 192.168.1.11 192.168.1.11 20
192.168.1.11 255.255.255.255 127.0.0.1 127.0.0.1 20
192.168.1.255 255.255.255.255 192.168.1.11 192.168.1.11 20
224.0.0.0 240.0.0.0 192.168.1.11 192.168.1.11 20
255.255.255.255 255.255.255.255 192.168.1.11 192.168.1.11 1
255.255.255.255 255.255.255.255 192.168.1.11 2 1
Passerelle par d‚fautÿ: 192.168.1.1
===========================================================================
Itin‚raires persistantsÿ:
Aucun
 
Ok, so nothing malicious on those DNS servers then :)

Are there any other issues left or shall we see a list of the final steps?
 
Nope, I don't think there are any other issues.
I rebooted the laptop once again in "normal mode" and everything seems to be running smoothly :
Number of processes
Memory load
CPU usage
Connection time
Loading of more than 10pages at Opera startup...
No more pop up of Antivir regarding ComboFix...

The only thing I noticed is a much longer time to shut down and a terrible longer time to start up the computer. Do you think this has any relation to what we've done ?
Oh yes, one more question : can you pls remind me what plugins should I update once we finish...

Up to you for the final steps...
Thanks
 
THESE STEPS ARE VERY IMPORTANT

Let's reset system restore
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: You will lose all previous restore points which are likely to be infected. Please note you need Administrator Access to do clean the restore points.

1. Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

2. Reboot.

3. Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
NOTE: only do this ONCE,NOT on a regular basis


Now lets uninstall ComboFix:
  • Click START then RUN
  • Now copy-paste Combofix /uninstall in the runbox and click OK


UPDATING WINDOWS AND INTERNET EXPLORER

IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.


Make your Internet Explorer more secure

This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.



The following are recommended third party programs that are designed to keep your computer clean. A link as well as a brief description is included with each item.


Download and run Secunia Personal Software Inspector (PSI) and fix its findings.


Just a final reminder for you. I am trying to stress these two points.
UPDATE UPDATE UPDATE!!! Make sure you do this about every 1-2 weeks.
Make sure all of your security programs are up to date.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.


Once again, please post and tell me how things are going with your system... problems etc.

Have a great day,
Blade :cool:
 
Done

Hi,

I followed yr instructions carefully, updated everything, did a defrag, cleaned the empty space, ran MBAM & Spybot...
Everything is apparently clean and running correctly.
I'll be doing a full scan with Antivir in about an hour.

I still have 2 minor problems :
a. I now get a security warning immediately after each logon stating that "I am to view pages on a secure connection...etc......."
I thought this one was from IE but when switching between applications (Alt+tab) it shows the icon of Skype ????? I am running the last version of Skype.
I can not get rid of this. Any idea ?

b. I see that my laptop has remnants of MS Office 2007 & McAffee AV which I uninstalled at the very beginning of the setup of the computer.
The problem is that Seconia & Windows Update keep asking me to download all the updates for these programs... They do not appear in CCleaner however, nor in Windows "Add/Remove programs".
Can you recommend a tool to wipe this off or can you help me clean the registry ?

A huge thank you for your help and your time in following me up ! :)
 
Final step

Hi again,

OK. The last full scan with Antivir did not report any problem !
Would you consider that my laptop is now "safe" again ?

Regarding the 2 points I mentioned :
a. Great !! Could get rid of this annoying pop up. you're an encyclopedia yourself !
b. Revo could not retrieve any traces but I think I could locate and delete myself the last remnants as Windows Update is now silent about this...

Is there any further action to take (uninstall/delete/...) before you close this topic ? As far as I am concerned, everything seems OK. :bigthumb:

A terrific thanks to you for your help and advice ! I can hardly imagine there are still guys like you spending their time helping people like me !
All the best.
:thanks: :bow:
 
:lip:
Sorry, I might have been a little bit too enthusiast...
I get now an error message stating that "in order to protect your computer, this program has been closed : Windows Explorer" !!

Here are the path of the files enclosed in the report msg to MS :
C:\DOCUME~1\Etienne\LOCALS~1\Temp\WER160b.dir00\explorer.exe.mdmp
C:\DOCUME~1\Etienne\LOCALS~1\Temp\WER160b.dir00\appcompat.txt

And immediately after sending the report, I get memory address read errors. :sad:

Windows Explorer restarts, but...
 
Hi,

Has that re-occured? If so does it happen after some specific action?
 
It did not happen during the past last hour, but I was not in front of the computer which was idle.

This happened when opening XnView which gives twice the error msg " "This application failed to start because msvcp71.dll was not found. Re-installing the application may fix this problem."
I uninstalled the application with CCleaner and reinstalled a fresh download. But still get the same msg when trying to open.

Until now, the error msg from Win Explorer did not re-occur but I was not working on the laptop, so I don't know if this was a "spot" error or if this is to happen again...

Any clue ?
Txs
 
Hi,

That problem is likely with XnView. If you need the program then you may ask about possible solution on their forum. It's possible that their version isn't compatible with latest patched Windows component.
 
Ok

You were right once again : I found the fix for this problem.
It came from a badly supported plugin included in the software package. The bug is known by the developer.

As I did not get any other security warning, you can close this topic. I took enough of your time...

And once again :thanks: :thanks: :thanks:
All the best :bigthumb:
 
You're welcome

Since this issue appears to be resolved ... this Topic has been closed. Glad I could help. :)

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.
 
You must log in or register to reply here.
Back
Top