new computer; various problems!!!

[evilfantasy]

Download OTMoveIt2 by OldTimer

• Save it to your desktop.
  
  
  • Double-click OTMoveIt2.exe to run it.
    
  • Copy the lines in the codebox below.

Code: [Select]

C:\Users\All Users\xkhgzgvk
C:\Users\All Users\guqwlhse
C:\ProgramData\xkhgzgvk
C:\ProgramData\guqwlhse
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uvxttdix

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste

• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) and paste it in your next reply.
  
• Close OTMoveIt2

[hotbot3808]

I 'm so THANKFUL you're sticking in there with me to get through all this , what I call computer madness.

well here is what I got after the steps you requested. Hope it helps you help me.

Then maybe we can fix my other problems and I can enjoy using my computer.

[recovering space - attachment deleted by admin]

[evilfantasy]

Use the Kaspersky Online Scanner

• Click Accept.
  
• Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
  
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
  • Extended
• Scan Options:
• Scan Archives
  
• Scan Mail Bases

• Click OK & have it scan My Computer

When the scan is done, in the Scan is complete window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As...

• Next, in the Save as prompt, Save in area, select: Desktop.
  
• In the File name area, use KScan, or something similar.
  
• In Save as type: click the drop arrow and select: Text file [*.txt]
  
• Then, click: Save

Please copy and paste the Kaspersky Online Scanner Report in your next post.

[hotbot3808]

finally found this text , IE put it in temp files and had to learn how to find it.

Sorry it took so long, hope this helps you.

P.S Trojan.WIN32.Blackbird still on desktop even though report says no infection, Is that not one?

[recovering space - attachment deleted by admin]

[evilfantasy]

Can you attach a screenshot of the desktop?

How to take a screen shot

• Open up your Web Browser.
• Or from the desktop. (for desktop screenshots)
• Look on your keyboard and there should be a button (usually in the top right corner) that reads PrtSc or Print Screen, press that button.

• Once the PrtSc button is pressed, Open up Microsoft Paint.
  • Click Start
    
  • Click Run
    
  • Type in MSpaint
    
  • Press Ok.

• Once Paint is open
• On the Menu bar click Edit > Paste

• On the menu bar click File > Save as...
  
• Choose the Save as type click the drop arrow, and choose Jpeg
  
• Choose the save to location as the Desktop.
  
• The click Save.

[hotbot3808]

WOW! THANX Evilfantasy That was cool learning how to take a screen shot of my desktop. hope I remember for future reference.

Yeah for the other stuff too.

here is the attachment.

after combofix I still haven't gotten  bac regular time  and my regular goggle toolbar  with access to  browse my timeline ,  where I can see the sites my kids have visited. That was a important bar for me. it did not return after did the  system restore point
just a quick mention. If this is something that we will tackle after wards, sorry for the mention.

[recovering space - attachment deleted by admin]

[evilfantasy]

Right click it and choose Properties.

Take a screenshot of the properties box and post it here.

[recovering space - attachment deleted by admin]

[hotbot3808]

I hope this is what you mean or I lost.

[recovering space - attachment deleted by admin]

[evilfantasy]

It's just a picture file. Right click it and choose delete. Then run CCleaner.

----------

Let's clear out the programs we've been using to clean up your computer, they are not suitable for
general malware removal and could cause damage if launched accidentally. These steps will also help secure the work you have done.
.

• Click START then RUN
  
• Now type Combofix /u in the runbox
  
• Make sure there's a space between Combofix and /u
• Then hit Enter.

.

.
The above procedure will:

• Delete:
• ComboFix and its associated files and folders.
• VundoFix backups, if present
• The C:\Deckard folder, if present
• The C:_OtMoveIt folder, if present

• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

.
----------

1. Double click OTMoveIt2.exe to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. Once complete exit out of OTMoveIt2

----------

Clear your infected System restore points. See HERE for instructions.

----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
Here are some great tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

To prevent unknown applications from being installed on your computer install WinPatrol 2008

Another thing I would suggest installing SiteAdvisor. SiteAdvisor rates sites on business practices and spam.

SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.

Using SpywareBlaster to protect your computer from Spyware and Malware

Check out Keeping Yourself Safe On The Web for tips and free tools to keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

Let me know how everthing is now.

[hotbot3808]

OK did I misunderstand, did you say you wanted this properties screenshot or was the one I attached in post #37 correct.

[recovering space - attachment deleted by admin]

[hotbot3808]

Well did the Secunia scan, results say needed the macromedia flash player 9, but looked for it site only says adobe flash player.

Are adobe and macromedia the same.
tried to install, not successful.

still no toolbar to browse timeline

sorry I think It's called the google toolbar, has the icon to seach web pages and browse timeline throug google desktop.

[evilfantasy]

Use the Adobe Online Uninstaller to get rid of all old remnants.

Then install a Fresh Version

Try reinstalling the Google toolbar or Google desktop, or both.

That last screenshot is different from the first. Is the shortcut still there?

[hotbot3808]

I have Adobe Flash Player ActiveX

Adobe Reader 8.1.2
and  Adobe Shockwave Player
do I get rid of these?

got bac my google tool bar and have desktop, you're the best Evilfantasy.

shortcut of TrojanWIN32Blackbird still there, will use cleaner to rid  and also delete it.

[evilfantasy]

Just do these two steps and everything will be OK.

Adobe Online Uninstaller

Then install a Fresh Version

[hotbot3808]

Every thing seems to be OK you truly have been a tremendous help to me Evilfantasy.

 I'm so extremely  happy I found this site,  had those pesky files on my desktop for weeks, did'nt know what it meant but thankful for the help
 


Will carefully go throug your tips and try to stay safe.

Do I keep the other programs on the desktop and run how often , not sure?
Super-anti spyware , Mallwarebytes and ccleaner?


Should I also delete logs on desktop?

Are you done with me ? do you have suggestions for hooking up printer or  should I continue to search data base?   You're truly the BEST!!!!!!


MORE THANX  FOR YOUR HELP.