ThinkPoint?

[BigMac100]

Dave, I believe I have done as instructed. Not real sure about "Open the text file and copy/paste the log here

" (Sysprot.exe)

I did copy the file and paste for you to see. Please let me know what is next. Seems like things are running a little better. Thanks

[SuperDave]

Ok. Let's try one more scan.

I'd like to scan your machine with ESET OnlineScan

•Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan
•Click the button.
•For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on to download the ESET Smart Installer. Save it to your desktop.
  
• Double click on the icon on your desktop.
  

•Check
•Click the button.
•Accept any security warnings from your browser.
•Check
•Push the Start button.
•ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
•When the scan completes, push
•Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
•Push the button.
•Push
A log file will be saved here: C:\Program Files\ESET\ESET Online Scanner\log.txt

[BigMac100]

C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\17\47b9e491-5cd80ec8   a variant of Java/TrojanDownloader.OpenStream.NAS trojan   deleted - quarantined
C:\Documents and Settings\NetworkService\Application Data\Sun\Java\Deployment\cache\6.0\58\2606caba-2b0bc1c3   multiple threats   deleted - quarantined
C:\Documents and Settings\Owner\Shared\monking bird.mp3   WMA/TrojanDownloader.GetCodec.C trojan   cleaned by deleting - quarantined
C:\Documents and Settings\Owner\Shared\yael naim-ima new soul.mp3   WMA/TrojanDownloader.GetCodec.C trojan   cleaned by deleting - quarantined
C:\QooBox\Quarantine\MBR_HardDisk0.mbr   Win32/Olmarik.ADA trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1508\A0135460.DLL   Win32/Toolbar.AskSBar application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1531\A0138914.exe   a variant of Win32/Kryptik.INB trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1531\A0138918.exe   a variant of Win32/Kryptik.INB trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155017.exe   Win32/Spy.Zbot.YW trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155018.dll   Win32/Cimag.DU trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155019.exe   Win32/Cimag.DU trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155020.exe   Win32/Adware.FakeAntiSpy.Q application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155021.exe   Win32/Cimag.DU trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155022.exe   Win32/Adware.FakeAntiSpy.Q application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155023.exe   Win32/Cimag.DU trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155024.exe   Win32/Adware.FakeAntiSpy.Q application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155026.DLL   a variant of Win32/Toolbar.MyWebSearch application   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1532\A0155028.exe   a variant of Win32/Kryptik.INB trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1538\A0164538.dll   a variant of Win32/Cimag.EV trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1538\A0166597.exe   a variant of Win32/Kryptik.INB trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1538\A0166598.exe   a variant of Win32/Kryptik.INB trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1538\A0166599.exe   a variant of Win32/Olmarik.AJE trojan   cleaned by deleting - quarantined
C:\System Volume Information\_restore{C289E17B-7714-4E43-B22E-77069D407D7C}\RP1538\A0166601.exe   a variant of Win32/Kryptik.INB trojan   cleaned by deleting - quarantined

[BigMac100]

Dave, ESET OnlineScan results are complete. Please let me know what is next. Thanks

[BigMac100]

Dave, I still have AVG on my computer. My windows security alert says it is "turned off" should it be removed completely?
You gave a link to remove it but I'm not sure which one to use.
Should I run:
AVG remover (32bit) etc....
AVG remover (64bit) etc....
or any of the other options.

I continue to have a "AVG Secure Search" bar on my machine. Thanks

[SuperDave]

You gave a link to remove it but I'm not sure which one to use.
Should I run:
AVG remover (32bit) etc....
AVG remover (64bit) etc....
or any of the other options.

Your computer is 32 bit.
How's your computer running now?

[BigMac100]

Dave, Computer running much better. Tried to uninstall AVG again and computer just kinda "sits there" and states that the program is not installed. Did one of the programs you had me run uninstall AVG? The "windows security alert" icon hasen't popped up with AVG on it like normal. I still have a red shield and yellow shield in the lower right side of my screen. Is this normal? and should I update whenever the yellow shield tells me there are updates?

Thanks.

[SuperDave]

Please try running this again.

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.

[BigMac100]

Dave, sorry it's been a few days, but this is the last instructions you gave me to do. Thanks. Please let me know what is next.

Results of screen317's Security Check version 0.99.8 
 Windows XP Service Pack 2 
 Out of date service pack!!
 Internet Explorer 8 
``````````````````````````````
Antivirus/Firewall Check:
 Windows Firewall Disabled! 
 avast! Free Antivirus   
 ESET Online Scanner v3   
 McAfee Security Scan Plus   
```````````````````````````````
Anti-malware/Other Utilities Check:
 Malwarebytes' Anti-Malware   
 CCleaner     
 Java(TM) 6 Update 22 
 Out of date Java installed!
 Adobe Flash Player   
Adobe Reader X
````````````````````````````````
Process Check: 
objlist.exe by Laurent
 Alwil Software Avast5 AvastSvc.exe 
 Alwil Software Avast5 avastUI.exe 
``````````End of Log````````````

[SuperDave]

Did one of the programs you had me run uninstall AVG?

Yes. Here it is again.

AVG Antivirus - AVG Antivirus Remover utility

Please let me know if it removes AVG.

[BigMac100]

Dave, from what I can see, It looks like AVG is uninstalled. The program you had me run the black screen with white lettering all shows things like "AVGAdmin Server is not installed", "AVG ID sf i l terw7x is not installed" among other  jarga, or "param empty" Does this lead you to believe it is uninstalled?

Machine is working much better.

[SuperDave]

Let's do some cleanup.

* Click START then RUN - Vista users press the Windows Key and the R keys together for the Run box.
* Now type commy /uninstall in the runbox
* Make sure there's a space between commy and /Uninstall
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.
If you have problems doing the above, please try this:

Delete the Combo-Fix.exe file, C:\Combo-Fix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, C:\combo-fix.txt and C:\Combo-Fix-quarantined-files.txt
Please let me know which method works for you.

Clean out your temporary internet files and temp files.

Download TFC by OldTimer to your desktop.

Double-click TFC.exe to run it.

Note: If you are running on Vista, right-click on the file and choose Run As Administrator

TFC will close all programs when run, so make sure you have saved all your work before you begin.

* Click the Start button to begin the cleaning process.
* Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two.
* Please let TFC run uninterrupted until it is finished.

Once TFC is finished it should restart your computer. If it does not, please manually restart the computer yourself to ensure a complete cleaning.
*******************************************
Use the Secunia Software Inspector to check for out of date software.

•Click Start Now

•Check the box next to Enable thorough system inspection.

•Click Start

•Allow the scan to finish and scroll down to see if any updates are needed.
•Update anything listed.
.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster- Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It may not be Malware for free cleaning/maintenance tools to help keep your computer running smoothly.
Safe Surfing!

[BigMac100]

Dave,

The "Start then Run" option did not work for me. I had to Delete "Combo-Fix.exe file....etc

All other instructions are complete and machine seems to be running fine. I have to let it sit when I power it up for several minutes. Is it because Avast is updating? If I try to access the web, it just sits and tries to connect then after a while it will connect.

What programs can I uninstall and what programs do you "recommend" I continue to run and how frequently.

Thanks

[SuperDave]

Ok. Do this:
To turn off Windows XP System Restore:

NOTE: These instructions assume that you are using the default Windows XP Start Menu and have not changed to the Classic Start menu. To re-enable the default menu, right-click Start, click Properties, click Start menu (not Classic) and then click OK.

1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives"
5. Click Apply.
6.  When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
8. Restart the computer and follow the instructions in the next section to turn on System Restore.

To turn on Windows XP System Restore:

1. Click Start.
2. Right-click My Computer, and then click Properties.
3. Click the System Restore tab.
4. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply, and then click OK.
This will give you a new, clean Restore Point.
********************************************

Is it because Avast is updating? If I try to access the web, it just sits and tries to connect then after a while it will connect.

Yes, my computer does the same thing. I usually try to let it warm up for about 10 mins. so that it can get all the updates. That's the price we have to pay for added security.

The only ones you should keep are SAS and MBAM. Update them and run them on a regular basis.Anything else can be deleted or uninstalled.

[BigMac100]

Dave,

The above instructions are complete.

Just to be sure, you recommend I keep SUPERAntiSpyware and Malwarebtyes Anti-Malware and run them frequently? Is this correct?

Do I also keep Avast?

And one last thing. When I power up my computer, I get a popup window in the lower right hand side from a Red shield with a little white "x" that state

"Your computer might be at risk
  AVG Firewall is turned off
  Click this balloon to fix this problem"

Is this something I want to do? I though we got rid of AVG

Thanks