Flywelder's HJT log

SHaba Thank you I will follow your instructions.....

SHaba, What you told me in your last posting has greatly helped put me at ease .

I will follow your instructions and report back when I have completed them.

Meanwhile I ran spy bot S&D again last night 9-04-09 and the only virus is still that V virus. below is the report from Spybot S&D for 9-05-09 if it is of help to you I post it here. Later today I will run sypbot S&D in advanced mode, and report the finding s here.

Again , I say Thank you Shaba! Double thumbs up to you!

The report below I had to shorten because it was too large for this posting, I hope I have included all important info.
Flywelder

--- Search result list ---
Virtumonde: [SBI $3BE84E58] Settings (Registry key, nothing done)
HKEY_USERS\S-1-5-21-789336058-725345543-839522115-1004\Software\mwc


--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-08-28 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-07-28 advcheck.dll (1.6.3.17)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-09-01 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-05-19 Includes\Dialer.sbi (*)
2009-09-01 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-09-01 Includes\HijackersC.sbi (*)
2009-06-23 Includes\Keyloggers.sbi (*)
2009-09-01 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-08-19 Includes\Malware.sbi (*)
2009-09-01 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-09-01 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-09-01 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-09-01 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-08-25 Includes\Trojans.sbi (*)
2009-09-01 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Windows XP (Build: 2600) Service Pack 3 (5.1.2600)
/ MSXML4SP2: Security update for MSXML4 SP2 (KB936181)
/ MSXML4SP2: Security update for MSXML4 SP2 (KB954430)
/ Windows / SP1: Microsoft Internationalized Domain Names Mitigation APIs
/ Windows / SP1: Microsoft National Language Support Downlevel APIs
/ Windows Media Format 11 SDK: Hotfix for Windows Media Format 11 SDK (KB929399)
/ Windows Media Player: Security Update for Windows Media Player (KB952069)
/ Windows Media Player: Security Update for Windows Media Player (KB973540)
/ Windows Media Player 11: Security Update for Windows Media Player 11 (KB936782)
/ Windows Media Player 11: Hotfix for Windows Media Player 11 (KB939683)
/ Windows Media Player 11: Security Update for Windows Media Player 11 (KB954154)
/ Windows Media Player 11: Critical Update for Windows Media Player 11 (KB959772)
/ Windows Media Player 6.4: Security Update for Windows Media Player 6.4 (KB925398)
/ Windows Media Player 9: Security Update for Windows Media Player 9 (KB936782)
/ Windows XP: Security Update for Windows XP (KB923689)
/ Windows XP: Security Update for Windows XP (KB941569)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB937143)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB938127)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB939653)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB942615)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB950759)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB953838)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB956390)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB958215)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB960714)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB961260)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB963027)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 7 (KB969897)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 8 (KB969897)
/ Windows XP / SP0: Update for Windows Internet Explorer 8 (KB971930)
/ Windows XP / SP0: Security Update for Windows Internet Explorer 8 (KB972260)
/ Windows XP / SP10: Microsoft Compression Client Pack 1.0 for Windows XP
/ Windows XP / SP3: Windows XP Service Pack 3
/ Windows XP / SP4: Security Update for Windows XP (KB923561)
/ Windows XP / SP4: Security Update for Windows XP (KB938464)
/ Windows XP / SP4: Security Update for Windows XP (KB946648)
/ Windows XP / SP4: Security Update for Windows XP (KB950760)
/ Windows XP / SP4: Security Update for Windows XP (KB950762)
/ Windows XP / SP4: Security Update for Windows XP (KB950974)
/ Windows XP / SP4: Security Update for Windows XP (KB951066)
/ Windows XP / SP4: Update for Windows XP (KB951072-v2)
/ Windows XP / SP4: Security Update for Windows XP (KB951376-v2)
/ Windows XP / SP4: Security Update for Windows XP (KB951698)
/ Windows XP / SP4: Security Update for Windows XP (KB951748)
/ Windows XP / SP4: Update for Windows XP (KB951978)
/ Windows XP / SP4: Security Update for Windows XP (KB952004)
/ Windows XP / SP4: Hotfix for Windows XP (KB952287)
/ Windows XP / SP4: Security Update for Windows XP (KB952954)
/ Windows XP / SP4: Security Update for Windows XP (KB953839)
/ Windows XP / SP4: Security Update for Windows XP (KB954211)
/ Windows XP / SP4: Security Update for Windows XP (KB954459)
/ Windows XP / SP4: Hotfix for Windows XP (KB954550-v5)
/ Windows XP / SP4: Security Update for Windows XP (KB954600)
/ Windows XP / SP4: Security Update for Windows XP (KB955069)
/ Windows XP / SP4: Update for Windows XP (KB955839)
/ Windows XP / SP4: Security Update for Windows XP (KB956391)
/ Windows XP / SP4: Security Update for Windows XP (KB956572)
/ Windows XP / SP4: Security Update for Windows XP (KB956744)
/ Windows XP / SP4: Security Update for Windows XP (KB956802)
/ Windows XP / SP4: Security Update for Windows XP (KB956803)
/ Windows XP / SP4: Security Update for Windows XP (KB956841)
/ Windows XP / SP4: Security Update for Windows XP (KB957095)
/ Windows XP / SP4: Security Update for Windows XP (KB957097)
/ Windows XP / SP4: Security Update for Windows XP (KB958644)
/ Windows XP / SP4: Security Update for Windows XP (KB958687)
/ Windows XP / SP4: Security Update for Windows XP (KB958690)
/ Windows XP / SP4: Security Update for Windows XP (KB959426)
/ Windows XP / SP4: Security Update for Windows XP (KB960225)
/ Windows XP / SP4: Security Update for Windows XP (KB960715)
/ Windows XP / SP4: Security Update for Windows XP (KB960803)
/ Windows XP / SP4: Security Update for Windows XP (KB960859)
/ Windows XP / SP4: Hotfix for Windows XP (KB961118)
/ Windows XP / SP4: Security Update for Windows XP (KB961371)
/ Windows XP / SP4: Security Update for Windows XP (KB961373)
/ Windows XP / SP4: Security Update for Windows XP (KB961501)
/ Windows XP / SP4: Update for Windows XP (KB967715)
/ Windows XP / SP4: Security Update for Windows XP (KB968537)
/ Windows XP / SP4: Security Update for Windows XP (KB969898)
/ Windows XP / SP4: Security Update for Windows XP (KB970238)
/ Windows XP / SP4: Hotfix for Windows XP (KB970653-v3)
/ Windows XP / SP4: Security Update for Windows XP (KB971557)
/ Windows XP / SP4: Security Update for Windows XP (KB971633)
/ Windows XP / SP4: Security Update for Windows XP (KB971657)
/ Windows XP / SP4: Security Update for Windows XP (KB973346)
/ Windows XP / SP4: Security Update for Windows XP (KB973354)
/ Windows XP / SP4: Security Update for Windows XP (KB973507)
/ Windows XP / SP4: Update for Windows XP (KB973815)
/ Windows XP / SP4: Security Update for Windows XP (KB973869)


--- Startup entries list ---
Located: HK_LM:Run, Acrobat Assistant 8.0
command: "L:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
file: L:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
size: 623992
MD5: 4A0BBDF88636F2EF08420BDCD343D286

Located: HK_LM:Run, Adobe Reader Speed Launcher
command: "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
file: C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
size: 34672
MD5: 69B16C7B7746BA5C642FC05B3561FC73

Located: HK_LM:Run, Adobe_ID0EYTHM
command: C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
file: C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
size: 1884160
MD5: C1873D880786B6B03AF781E23835D925

Located: HK_LM:Run, Ad-Watch
command: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
file: C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
size: 520024
MD5: 2CD3C21B57B2B1E5CC4C82519461C9D2

Located: HK_LM:Run, AVG8_TRAY
command: C:\PROGRA~1\AVG\AVG8\avgtray.exe
file: C:\PROGRA~1\AVG\AVG8\avgtray.exe
size: 2007832
MD5: ADB19E69937A076BDE7D08928248F5C8
 
Shaba, I still have slow page loading times.

Web pages load slowly.
Also, every time I click the fire fox icon on my desk top, in order to go to the WWW. .........Spybot S&D is prompting me with : " New processes are being scanned"
And so i must wait 50 secs. and sometimes 70-80- sec. for my yahoo home page to appear on my monitor., plus, I am stuck for at these times,.....the computer will not respond to any other commands from the key board...I just sit and wait on Sybot to finish. ...i don't have to tell you , I don't like this waiting. I am used to Yahoo being on my monitor within 3-6 secs. or less.

This is not a normal characteristic to spybot I hope?...is it.

Is there any changes we can make ourselves to eliminate this?
 
Shaba,
I frequently get this Prompt on my monitor when I go from one web page to another.

The prompt is an attachment below.

Flywelder 9-05-09
 
SHaba, I am off to bed, my eyes are very heavy now. I'll read your replies and instructions in the morning.
Thanks Shaba!
 
Shaba, AN update since our last correspondence. Today is 9-07-09. I Disabled Tea Timer. and rebooted.
I the ran spybot in Advanced mode.
Later, Sybot reported that it only found the V virus and I instructed Spybot to remove and repair. It must have did so, as I now notice a green check mark was placed beside the virus listing.

I then re-enabled Tea Timer

Shaba, answer me this. Should I Immunize now, which would be the first time since having a clean machine? yes I immunized as instructed when I first installed Spybot S&D I am asking if I should do so again?

Shaba how often do i need to immunize?

Shaba, please answer for me ... should I and then how do i then do the following:

****** Locking the hosts file.........because as you know, doing so will prevent most hosts hijackers (even unknown) from doing harm;

should I and how do I do this:
*****lock the IE settings in order to prevent other users of your computer to change your preferences.

And should I, and then how do i do this:

******change the Internet Explorer title to a user-defined text, or remove a pre-defined text.

Shaba, any tips for me on avoiding getting any of these viruses and malware and Trojans again?..... other than not using lime wire... :)

Once again, A big thank you is sent to you Shaba!
flywelder
 
"Shaba, answer me this. Should I Immunize now, which would be the first time since having a clean machine? yes I immunized as instructed when I first installed Spybot S&D I am asking if I should do so again?

Shaba how often do i need to immunize?"

Yes you should. After each spybot update.

"Shaba, please answer for me ... should I and then how do i then do the following:

****** Locking the hosts file.........because as you know, doing so will prevent most hosts hijackers (even unknown) from doing harm;

should I and how do I do this:
*****lock the IE settings in order to prevent other users of your computer to change your preferences.

And should I, and then how do i do this:

******change the Internet Explorer title to a user-defined text, or remove a pre-defined text."

No, I don't think that those are 100% needed, at least last one isn't needed.

Does spybot still find something?
 
Shaba,
I think the virus is gone???? I will run another scan today and report back the results.
Meanwhile, please answer these Qs.
1) Is it OK to delete temporary update files for AVG?




2) Will there be temporary update files left on my hard drive by spybot S&D that I will need to get rid of?
and if so,how do I get rid of them?
 
Shaba
Sybot's latest report is that it finds no contamination.
Yippeee!!!!!
below is a copy of the report.
First is resident: SHaba some where near the bottom of the resident report I saw the words " changed in session manager!!" ........shaba should this set off alrms for you and me?? or is it just nothing?

8/28/2009 10:32:15 PM Allowed (based on authenticode whitelist) value "Spybot - Search & Destroy" (new data: ""C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck") added in System Startup global entry!
8/29/2009 3:41:16 PM Allowed (based on user decision) value "SpybotDeletingB585" (new data: "command.com /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_31 PM_796.log"") added in System Startup user entry!
8/29/2009 3:41:24 PM Allowed (based on user decision) value "SpybotDeletingD6831" (new data: "cmd.exe /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_31 PM_796.log"") added in System Startup user entry!
8/29/2009 3:41:24 PM Allowed (based on user decision) value "SpybotDeletingB6042" (new data: "command.com /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_34 PM_218.log"") added in System Startup user entry!
8/29/2009 3:41:32 PM Allowed (based on user decision) value "SpybotDeletingD5251" (new data: "cmd.exe /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_34 PM_218.log"") added in System Startup user entry!
8/29/2009 3:41:32 PM Allowed (based on user decision) value "SpybotDeletingA495" (new data: "command.com /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_31 PM_796.log"") added in System Startup global entry!
8/29/2009 3:41:36 PM Allowed (based on user decision) value "SpybotDeletingC8327" (new data: "cmd.exe /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_31 PM_796.log"") added in System Startup global entry!
8/29/2009 3:41:36 PM Allowed (based on user decision) value "SpybotDeletingA3020" (new data: "command.com /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_34 PM_218.log"") added in System Startup global entry!
8/29/2009 3:41:41 PM Allowed (based on user decision) value "SpybotDeletingC1129" (new data: "cmd.exe /c del "C:\Documents and Settings\David Trompower\Application Data\SpywareBot\Log\2007 Sep 24 - 01_58_34 PM_218.log"") added in System Startup global entry!
8/29/2009 3:41:41 PM Allowed (based on user decision) value "System" (new data: "") changed in Winlogon!
9/3/2009 8:11:36 PM Allowed (based on user decision) value "SpybotDeletingB585" (new data: "") deleted in System Startup user entry!
9/3/2009 8:11:40 PM Allowed (based on user decision) value "SpybotDeletingD6831" (new data: "") deleted in System Startup user entry!
9/3/2009 8:11:40 PM Allowed (based on user decision) value "SpybotDeletingB6042" (new data: "") deleted in System Startup user entry!
9/3/2009 8:11:40 PM Allowed (based on user decision) value "SpybotDeletingD5251" (new data: "") deleted in System Startup user entry!
9/3/2009 8:11:47 PM Allowed (based on user decision) value "Spybot - Search & Destroy" (new data: "") deleted in System Startup global entry!
9/3/2009 8:11:49 PM Allowed (based on user decision) value "SpybotDeletingA495" (new data: "") deleted in System Startup global entry!
9/3/2009 8:11:49 PM Allowed (based on user decision) value "SpybotDeletingC8327" (new data: "") deleted in System Startup global entry!
9/3/2009 8:11:49 PM Allowed (based on user decision) value "SpybotDeletingA3020" (new data: "") deleted in System Startup global entry!
9/3/2009 8:11:49 PM Allowed (based on user decision) value "SpybotDeletingC1129" (new data: "") deleted in System Startup global entry!
9/5/2009 10:46:05 PM Allowed (based on user decision) value "ctfmon.exe" (new data: "") deleted in System Startup user entry!
9/5/2009 10:46:08 PM Allowed (based on user decision) value "TkBellExe" (new data: "") deleted in System Startup global entry!
9/5/2009 10:46:16 PM Allowed (based on user decision) value "SunJavaUpdateSched" (new data: "") deleted in System Startup global entry!
9/5/2009 10:46:16 PM Allowed (based on lassh blacklist) value "SoundMan" (new data: "") deleted in System Startup global entry!
9/5/2009 10:46:17 PM Allowed (based on user decision) value "QuickTime Task" (new data: "") deleted in System Startup global entry!
9/5/2009 10:46:17 PM Allowed (based on user decision) value "iTunesHelper" (new data: "") deleted in System Startup global entry!
9/5/2009 10:46:17 PM Allowed (based on lassh blacklist) value "GhostStartTrayApp" (new data: "") deleted in System Startup global entry!
9/6/2009 10:20:17 PM Allowed (based on user decision) value "BootExecute" (new data: "autocheck autochk /r \??\C:
autocheck autochk *
lsdelete
") changed in Session manager!
9/7/2009 10:23:19 PM Allowed (based on user decision) value "ctfmon.exe" (new data: "C:\WINDOWS\system32\ctfmon.exe") added in System Startup user entry!
9/7/2009 10:23:29 PM Allowed (based on user decision) value "SpybotSD TeaTimer" (new data: "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe") added in System Startup user entry!

Second is Fixes


--- Report generated: 2009-09-07 22:12 ---

Virtumonde: [SBI $3BE84E58] Settings (Registry key, fixed)
HKEY_USERS\S-1-5-21-789336058-725345543-839522115-1004\Software\mwc


--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-08-28 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-07-28 advcheck.dll (1.6.3.17)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-09-01 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-05-19 Includes\Dialer.sbi (*)
2009-09-01 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-09-01 Includes\HijackersC.sbi (*)
2009-06-23 Includes\Keyloggers.sbi (*)
2009-09-01 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-08-19 Includes\Malware.sbi (*)
2009-09-01 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-09-01 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-09-01 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-09-01 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-08-25 Includes\Trojans.sbi (*)
2009-09-01 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

Third is: A check report


--- Report generated: 2009-09-08 14:37 ---

Congratulations!: No immediate threats were found. (Status)



--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2009-08-28 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-07-28 advcheck.dll (1.6.3.17)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-05-19 Includes\Adware.sbi (*)
2009-09-01 Includes\AdwareC.sbi (*)
2009-01-22 Includes\Cookies.sbi (*)
2009-05-19 Includes\Dialer.sbi (*)
2009-09-01 Includes\DialerC.sbi (*)
2009-01-22 Includes\HeavyDuty.sbi (*)
2009-05-26 Includes\Hijackers.sbi (*)
2009-09-01 Includes\HijackersC.sbi (*)
2009-06-23 Includes\Keyloggers.sbi (*)
2009-09-01 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2009-08-19 Includes\Malware.sbi (*)
2009-09-01 Includes\MalwareC.sbi (*)
2009-03-25 Includes\PUPS.sbi (*)
2009-09-01 Includes\PUPSC.sbi (*)
2009-01-22 Includes\Revision.sbi (*)
2009-01-13 Includes\Security.sbi (*)
2009-09-01 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2009-04-07 Includes\Spyware.sbi (*)
2009-09-01 Includes\SpywareC.sbi (*)
2009-06-08 Includes\Tracks.uti
2009-08-25 Includes\Trojans.sbi (*)
2009-09-01 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

Updates

8/28/2009 9:05:24 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
8/28/2009 9:05:56 PM downloaded update Advanced detection library 1.6.3
8/28/2009 9:05:56 PM - URL: http://filequake.com/teamspybot/advcheck163.zip
8/28/2009 9:05:56 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\advcheck163.zip
8/28/2009 9:06:00 PM downloaded update English descriptions
8/28/2009 9:06:00 PM - URL: http://filequake.com/teamspybot/desc.english.zip
8/28/2009 9:06:00 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\desc.english.zip
8/28/2009 9:06:03 PM downloaded update Immunization database
8/28/2009 9:06:03 PM - URL: http://filequake.com/teamspybot/clsid.zip
8/28/2009 9:06:03 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\clsid.zip
8/28/2009 9:06:10 PM downloaded update TeaTimer update 1.6.6
8/28/2009 9:06:10 PM - URL: http://filequake.com/teamspybot/teatimer166.zip
8/28/2009 9:06:10 PM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\teatimer166.zip
8/28/2009 9:13:30 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
8/28/2009 10:09:05 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
9/2/2009 2:29:11 AM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
9/5/2009 1:51:50 AM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
9/5/2009 1:52:13 AM downloaded update Detection rules: Supplemental
9/5/2009 1:52:13 AM - URL: http://fastspeedtest.net/mirrors/spybot/supplemental.zip
9/5/2009 1:52:13 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\supplemental.zip
9/5/2009 1:52:32 AM downloaded update Detection rules: Update
9/5/2009 1:52:32 AM - URL: http://fastspeedtest.net/mirrors/spybot/includes.zip
9/5/2009 1:52:32 AM - Local file: C:\Program Files\Spybot - Search & Destroy\Updates\includes.zip
9/7/2009 1:57:22 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
9/7/2009 10:12:42 PM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)
9/8/2009 11:08:52 AM Downloaded update info file. (http://www.safer-networking.org/updates/spybotsd.ini)

SHaba, are there other reports I should post here?

Shaba, I should keep Tea Timer activated?
should I keep internet explorer protection activated even if do not use internet explorer but use Fire fox?
 
SHaba, I just noticed that in those reports i posted , my name appears!!...should we remove the posts with the scan results because they have my name right out there for curious eyes? .....Others who come to this site and search for answers to their problems could stumble onto my postings, correct??......and could read my posts...correct?: confused:
 
That is fine :)

Keeping it active is up to you. Yes I still recommend to use it.

I can do that.
 
Good :)

See below for my tips for the future:

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer before continuing!***

  • Double-click on JavaRa.exe to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location.

Then download and install Java Runtime Environment (JRE) 6 Update 16.

Looking over your log, it seems you don't have any evidence of a third party firewall.

As the term conveys, a firewall is an extra layer of security installed onto computers, which restricts access to systems from the outside world. Firewalls protect against hackers and malicious intruders. I want you to download a free firewall NOW from one of these excellent vendors:

1) Comodo (Uncheck during installation "Install COMODO Antivirus (Recommended)"!, "Install Comodo SafeSurf..", Make Comodo my default search provider" and "Make Comodo Search my homepage")
2) Online Armor
3) PC Tools
4) Sunbelt/Kerio
5) ZoneAlarm (uncheck ZoneAlarm Spy Blocker during installation if you choose this one)

If you are using the built-in Windows XP firewall, it is not recommended as it does not block outgoing connections. This means that any malware on your computer is free to "phone home" for more instructions. Simply put, Windows XP contains a mediocre firewall. This firewall is NO replacement for a dedicated software solution. Remember to use only one firewall at the same time.

Next we remove all used tools.

Please download OTCleanIt and save it to desktop.
  • Double-click OTCleanIt.exe.
  • Click the CleanUp! button.
  • Select Yes when the "Begin cleanup Process?" prompt appears.
  • If you are prompted to Reboot during the cleanup, select Yes.
  • The tool will delete itself once it finishes, if not delete it by yourself.

Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.

  • Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and re-enable system restore here:

    Windows XP System Restore Guide

Re-enable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
  • Change the Download signed ActiveX controls to Prompt
  • Change the Download unsigned ActiveX controls to Disable
  • Change the Initialize and script ActiveX controls not marked as safe to Disable
  • Change the Installation of desktop items to Prompt
  • Change the Launching programs and files in an IFRAME to Prompt
  • Change the Navigate sub-frames across different domains to Prompt
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.

  • Update your AntiVirus Software and keep your other programs up-to-date
    Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
    You can use one of these sites to check if any updates are needed for your pc.
    Secunia Software Inspector
    F-secure Health Check

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
    totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:

    Malwarebytes' Anti-Malware Setup Guide

    Malwarebytes' Anti-Malware Scanning Guide

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

Here are some additional utilities that will enhance your safety


Stand Up and Be Counted ---> Malware Complaints <--- where you can make difference!

The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.

Also, please read this great article by Tony Klein So How Did I Get Infected In First Place

Happy surfing and stay clean! :bigthumb:
 
SHaba,
WOw ! that is great info you shared! thanks! I wil follow it! I am so glad you included the info on the Windows firewall ...for I was about to reply saying but, I have windows firewall operating......

SHaba I have a question about two things.
1) every now and then while i am reading a web page or my emails at yahoo a prompts will appear on my screen that says "spybot is scanning processes"... is this normal or alerting me to a problem? as I was just reading, not moving the mouse or anything.

2) I have attached a screen shot of a prompt I am still getting frequently, is this safe or alerting me to a problem and why is this prompt appearing?

3) should I keep or uninstall the "CW shredder program" icon you can see on my desk top in the screen shot?

4) should I delete or keep the "Java Water" icon you can see in the screen shot?..what does it do any way?
 
1) Yes as you have TeaTimer on.

2) Looks like to be related to yahoo! mail. Are you using NoScript?

3) You can uninstall it.

4) It seems to be a folder. What is inside?
 
Shaba, answers to your questions.

1) referring to the script question, you ask if i am using No Script...my answer is: I have not a clue, ....how do I determine if i do or do not, Shaba?

2)the Java water was an old picture from 2 years ago...I deleted it.

3) I will turn off Spybot S&D and occasionally reopen it and run a scan to hunt for problems... and install Spyware blaster do I understand this to be one of the things you want me to do?
 
You must log in or register to reply here.
Back
Top