Using the 'read first' instructions..

"EF" gave some read first instructions to getting started under the virus's and spyware section as follows:

Step 5 Update Your Java

Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run.

Please follow these steps to remove older version of Java components and update

Updating Java:
* Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
* Check for any item with Java Runtime Environment (JRE or J2SE) in the name.
** The latest version is Java 6 Update 3. Remove all other entries.
* Click the Remove or Change/Remove button.
* Repeat as many times as necessary to remove each of the Java versions.
* Reboot your computer once all Java components are removed.

* Download the latest version of Java Runtime Environment (JRE) 6
* Click the Free Java Download button.
* Click the Download Now button.
* When the Software Installation dialog box opens. Click on the Install Now button.
* Follow the prompts to complete installation.

Sorry I don't know how to use the quote function.

My question:  When I went to remove two older v's of JAVA;

JAVA (TM) SE Runtime Environment 6 Update 1 134MB &
JAVA (TM) 6 Update 2 111 MB to install your recommendation.

Clicking each item in Windows>control pnl>change or remove didn't offer a selection to remove.  It only said "rarely".  I couldn't delete 2 older items. 

Without me conjuring up thoughts and only adding to more confusion, please tell me how to go about removing the older JAVA versions so I can install the recommended updates.

Thank,  Tom

You've helped me before and I'm sure you have the answers this time around again.

   

[Malware Removal Specialist]

Go ahead and finish the instructions and post the logs. There may be something (malware) hiding buttons in add/remove programs.

We will see what we can find in the logs.

I don't know what 'logs' you want me to post.

Is this a dumb question or am I just not right on the same page (intellectually) as you?

[Malware Removal Specialist]

Well the first line of post #2 says

Below are steps to follow to begin the malware removal process. These steps will produce three logs which are requested to be added as attachments in your post. A guide on how to attach logs is included at the bottom of this post.

Then each set of instructions for the scans tells how to save each log.

'EF"

My first attempt at step two, too use CCleaner, I used the links, found myself at the Hippo web site where..  That took me to "PC Registry Cleaner".  Download a trial version and then be tasked to register and purchase.

Was that the right direction to wanted me to follow?. 

Your estimate, how much does it cost?

Thanks,
Tom

[Malware Removal Specialist]

CCleaner is totally free. Nothing we ask you to use will cost any money to use. There may be a trial version of something but it will work for the task needed and can then be uninstalled without paying anything.

Direct download to CCeaner.exe <---Here

Good news, I successfully downloaded and installed CCleaner with those additional setup instructions and the correct link. 

I apologize if I was supposed to create a document to post here; I didn't get a chance to.  I'm not sure where in step two I was to create a log to post.  I performed the 'analysis' and let it run the cleaner.  I went to "issues', it identified some and I again let them be fixed.  It looked like my PC had a garage sale.

I was able to uninstall the two previous JAVA applications through  program 'tools', which incidentally was the reason I solicited your help in the first place.

I will continue with step three and so on as time allows.  I really appreciate your help, I couldn't do it without your support.   

[Malware Removal Specialist]

Good news, I successfully downloaded and installed CCleaner with those additional setup instructions and the correct link. 

Good deal, I was worried when you mentioned paying for the service

I apologize if I was supposed to create a document to post here; I didn't get a chance to.  I'm not sure where in step two I was to create a log to post.  I performed the 'analysis' and let it run the cleaner.  I went to "issues', it identified some and I again let them be fixed.  It looked like my PC had a garage sale.

No logs to post from that scan. It simply helps to speed the process of the following scans. All of those dead/empty files would have been scanned for spyware so it is good to do some clean up before hand. Also, if you have more than one user account on the computer it is good to run it on all accounts.

I was able to uninstall the two previous JAVA applications through  program 'tools', which incidentally was the reason I solicited your help in the first place.

 

I will continue with step three and so on as time allows.  I really appreciate your help, I couldn't do it without your support.   

Don't hesitate to ask if you are unclear on something, better safe then sorry.

We will be here, I understand the time constraints and this can take a while.

Just my update:

There was nothing to log or report after installing and running in 'safe mode' Super Anti Spyware free.

I read an article from Kim Kommando once that said its possible for malware to hide behind 'restore points'; to turn off system restore before running your protection.  Now everytime before I started any new process, each time I created a new restore point.  Is that an obsolete technique of the people who create the malware or is the suggestion viable.

What is your opinion?

Tom 

[Malware Removal Specialist]

Opinions vary on when to turn off/on system restore.

That is something I do have users do but only when we are sure all malware is gone. If something happens during removal system restore might be needed and an infected restore point is better then no restore point at all.

Step 4 (On-line anti-virus) has to do with an on-line virus scan.

As a rule, we should only have 1 a/v running (installed) at any one time.  I am using the AVG 7.5 free version already.

Am I over thinking the process?  Do I need step 4, I'm not afraid as long as I have your go ahead.  Am I to conduct myself different?

Tom 

[Malware Removal Specialist]

Am I over thinking the process?

Yes and no. You are right on only having one AV installed at a time. But an online scan only installs an ActiveX component. So it isn't actually installed.

Many virus/malware can "hide" from installed security programs so online scans actually have much better chance of finding things. Also different AV vendors have different malicious file signatures they look for. Running an online scan once a month or so never hurts.

I ran the ESET O/L A/V and it didn't identify anything.

Question?  ESET was explicit in ensuring I was aware that they didn't defend against threats (only found them aftermath) unless I purchased the full version.  Is that the same thing with AVG since I use the free V? 

Next step is to install JAVA update and then I think HIJACK THIS.   

[Malware Removal Specialist]

The ESET doesn't offer any protection, it just scans and removes what it finds. No need to pay for the full version unless you just want to pay for what AVG does for free.

Looks like updating Java and attaching a HijackThis log is all that is left.

JAVA installed, no problems.

Off the 'do first' page notes I clicked the linked to Hijack This.  Went to\Filehippo\Trendmicro\Trendsecure.  It gave me three choices to click for a download as follows:
D/L HiJack This Installer
"     "         "      Zip
"     "         "      Executable.

I think I know what a .zip file is.  An installer sounds like something that happens after the install and before the run.

An executable changes and runs things.

So here I am at a crossroad whether I pick the right one by luck or choose the wrong one acting without knowledge.

I suppose there is a chance they all end up at the same place?

I'll wait till you can review my question.  Thanks again, Tom

[Malware Removal Specialist]

Click Here for the installer.

I need to update the instructions. Things have changed with the download since they were originally created.

Here is the hijack log...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:34:19 PM, on 12/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Metacafe\MetacafeAgent.exe
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.valp.net/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} -

C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [kis] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security

6.0\avp.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update

Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search &

Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User

'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User

'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User

'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User

'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat

7.0\Reader\reader_sl.exe
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Metacafe.lnk = C:\Program Files\Metacafe\MetacafeAgent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -

res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -

C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration -

{DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -

C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -

http://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) -

http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} -

http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -

http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?11622

37926812
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) -

http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab
O20 - AppInit_DLLs:  C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program

Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. -

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Kaspersky Lab - C:\Program

Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program

Files\COMODO\Firewall\cmdagent.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. -

C:\WINDOWS\system32\LEXBCES.EXE

--
End of file - 6964 bytes

[Malware Removal Specialist]

You are running two antivirus and two firewalls. This just causes system conflicts and slowdowns.
Kaspersky
AVG
Comodo

Either use AVG and Comodo or just Kaspersky.

Open HijackThis and select "Do a system scan only" then place a check mark next to:

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

Now close all browser windows and click "Fix checked"

Other then that the log looks fine.

It was the site advisor I once tried and subsquently removed.  Are there any more McAfee items in the log?

I found out what it was because Spybot pops up a warning that something or someone is attempting to make a change in the registry.

Am I supposed to learn from some library how to identify what each item in the log is?  There are some more 'unknown entries' later in the log.

EF.

I scanned and removed #3.  Spybot popped up warning me an attempt is being made to change the registry.  I let it happen.  Spybot ID'd it as McAfree 'site advisor' I once tried and removed.

Is there anymore McAfree entries in the log?

Is there a library one goes too to learn how to ID all the entries?  There are more 'unkown' items later at the end of the log.

[Malware Removal Specialist]

Google is the best library there is for searching out entries in the HijackThis log. I don't see any other entries from McAfee.

Did you take care of the multiple AV and Firewalls?

I don't care for Tea Timer and keep it off.

I want AVG free a/v and Comodo f/w; Lavasoft and Spybot plus the "read first" list of protections you provided to stay at this time. 

So I should check every item that has the recognizable words "symantec or kaspersky" in the log and selecting them for 'fix'? 

I think you've tried to get me thinking on my own to take action but the first instructions out of the mouths of babes was, you better know what your doing in Hijack before you just make changes.

[Malware Removal Specialist]

Go to add/remove programs to uninstall Kaspersky and anything to do with Norton or Symantec.

Anything else installed is OK to keep, but HijackThis should be used with caution.

Here is a tutorial on how to read the entries. But still, don't remove anything you have not researched first. How To Analyze HijackThis Logs

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?

As per your instructions I read the articles and requested support from "Spywareinfoforums' to review and recommend anymore changes to my Hijack log.  I'll let you know what happens.

EF.  The folks over at SWI reviewed my HiJack This log and reported no defects.  I wish they would have been able to answer my questions regarding some items still in the log that shared a name of a previously removed process like Symantec but are still present.

So far I have a clean bill of health and want to thank you for what you have taught me. 

I presume; in the interest of learning, there is no where else to look to see if any other malware is hiding anywhere because we have completed a full diagnostic check?  Just let me know if there is anything else I could learn. 

I wish I could learn how to identify malware.  Is that something taught in IT school?

Merry Christmas and I hope your weather is better this coming New Year.