Webwatcher infection

[muzzabra]

did an mbam scan. All clean. This is the log jst in case :

Malwarebytes' Anti-Malware 1.36
Database version: 2047
Windows 5.1.2600 Service Pack 2

28/04/2009 22:29:47
mbam-log-2009-04-28 (22-29-47).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 117616
Time elapsed: 20 minute(s), 57 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-----------------------

I'm out of ideas now. I'll be waiting for your reply. Thanks a lot.

 

[pskelley]

Looks like it may be the TeaTimer memory keeping the item in the registry, let's try this.

1) Download TeaTimerWipe.bat to the Desktop
www.neoshine.co.uk/mina/Downloads/TTWipe.bat
Double click TeaTimerWipe.bat then read and follow the prompts carefully.
to remove all entries set by TeaTimer (and preventing TeaTimer from restoring them upon reactivation).

2) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

O4 - HKLM\..\Run: [POL Agent] C:\Program Files\POL\POL.exe

Close all programs but HJT and all browser windows, then click on "Fix Checked"

3) Restart the computer and check a new HJT log to be sure the item is gone. No need to post again if that is the case.

Thanks...Phil

 

[muzzabra]

Did that, and tried scanning the system with Tea Timer on and off, and with reboots. Everything is back to normal again. Thanks a lot and I wish you the best. Take care and see you around!