Help!! How to stop all the Popups, Adwares and Trojans??!!!

[evilfantasy]

Go to My Computer->Tools->Folder Options->View tab:

• Under the Hidden files and folders heading:
• Select Show hidden files and folders.
  
• Uncheck Hide protected operating system files (recommended) option.
  
• Also, make sure there is no checkmark beside Hide file extensions for known file types.
  
• Click OK

The double click My Computer on the desktop. Double click C:\ to open it. Then open System32 folder.

Look for tpueedfx.dll and right click it and choose delete.

[green tea]

Am looking through all the folders in system32.

[evilfantasy]

Just go ahead and run the Dr Web for now, We will see if it comes back in the next Hijackthis log,

Next post please add:
Dr Web log
New Hijackthis log

[green tea]

Morning, I ran this overnight, and when I went to sleep, it was halfway done. I just turned my screen on and the computer rebooted by itself, so I didn't get a chance to save the report.

Is there a way I can get Dr Web log from last night?

Oh yes, when I logged in, that annoying RUNDLL popup for tpueed.fx.dll didn't show up.

And here is the new HJT log in the meantime.


[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

Look in c:\DoctorWeb\CureIt.log for the Dr Web log.

The Hijackthis log looks fine.

Once we see the Dr Web log (if there) we can probably wrap this up.

[green tea]

Hi, I went into the C drive but don't see any DoctorWeb folder at all

What should I do? And it's really good to see "wrap up" in your post. Let's hope it's true

[evilfantasy]

How is the computer now?

[green tea]

Running quite well. It's been rebooting smoothly since yesterday, and now when I login, I don't have to wait forever for the computer to load. I had a bunch of unnecessary icons in my taskbar (before the infection), and I always exited those the moment I could.

Now, the taskbar only has the "Safely remove hardware" and Volume icons.

Also, when I open a new IE window, no popups. And I keep checking to see if anything's been installed without my knowing, and nada.

Seems ok for now.
.....

Should I go back and reselect "Hide protected operating system files, etc" and unselect "Show hidden files and folders"?

[evilfantasy]

Should I go back and reselect "Hide protected operating system files, etc" and unselect "Show hidden files and folders"?

No we will take care of that now.


Go to Start > Run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /
Then hit Enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again

----------

Let's clear out the programs we've been using to clean up your computer, they are not suitable for
general malware removal and could cause damage if launched accidentally.

Please download OTMoveIt2 by OldTimer OTMoveIt2.exe and place it on your desktop.

1. Double click OTMoveIt2.exe to launch it.
2. Click on the CleanUp! button.
3. OTMoveIt2 will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)

• When finished exit out of OTMoveIt2

----------

To learn more about how to protect yourself while on the internet read this article by Tony Klien: So how did I get infected in the first place?


Let us know if anything else comes up.

[green tea]

Ok, uninstalled Combofix. How do I reset the clock setting and reset System Restore again? I just went into My Computer and its back to the default selections (hide protected operating system files, hide file extensions for known file types, etc).

And for the OTMoiveIt2 program, do I delete everything on the list. Would it include stuff like iTunes, etc?

Do I do all this and then reboot?

[evilfantasy]

Combofix reset everything for you so nothing to do there.

As for OTMoveIt this is the list that it should produce to remove.

Can you copy and paste the list in the next reply that shows where it is wanting to remove iTunes.

[nobackups]
avenger.zip     <Avenger by Swandog46>
Avenger
avenger.txt
bfu.zip         <BFU by Merijn>
BFU
combofix.exe    <ComboFix by sUBs>
QooBox
ComboFix*.txt
catchme.exe
nircmd.exe
swreg.exe
Swxcacls.exe
Swsc.exe
dss.exe         <Deckard's System Scanner by Deckard>
Deckard
FindAWF.exe     <FindAWF by noahdfear>
AWF.txt
fixwareout.exe  <FixWareout by LonnyRJones>
fixwareout
fsbl.exe        <F-Secure BlackLight>
fsbl*.log
gmer.exe        <GMER by Gmer>
gmer.dll
gmer.ini
gmer.log
gmer_uninstall.cmd
gmer.sys
gmer            <delete service>
haxfix.exe      <Haxfix by Markie>
haxfix.txt
killbox.exe     <Killbox by Option^Explicit>
!Killbox
NoLop.exe       <NoLop by ?>
NoLop.txt
NoLopOLD.txt
delete.bat
OTMoveIt.exe    <OTMoveIt by OldTimer>
OTMoveIt2.exe
_OTMoveIt
rustbfix.exe    <Rustbfix by Ejvindh>
Rustbfix
sdfix.exe       <SDFix by Andy_Manchesta>
SDFix
SmitfraudFix.exe <SmitfraudFix by S!Ri>
SmitfraudFix
rapport.txt
SysInsite       <System Insite by Bobbi Flekman>
VundoFix.exe    <VundoFix by Atribune>
VundoFix Backups
vundofix.txt
vundofix.vft
win32delfkil.exe <WinDelfKil by Markie>
_backupD
windelf.txt
winpfind.exe    <WinPfind by OldTimer>
WinPfind
winpfind3u.exe  <WinPFind3 by OldTimer>
WinPFind3u
winpfind35u.exe  <WinPFind35 by OldTimer>
WinPFind35u
cleanup.txt
[deleteself]

[green tea]

Oh, there's no list saying iTunes was going to be removed. I asked because I was worry that OTMoveIt might delete EVERYTHING.

.....

[evilfantasy]

It just takes out what could be damaging if not used for the right purposes.

[green tea]

Just ran OTMoveIt2 and after the cleanup, it said it needed to reboot. I clicked ok, and the computer rebooted BUT it didn't reboot properly. It shut down in the middle of the reboot. But the next reboot was fine.

However, once I logged in, a screen titled "VPN Client"with this message: "usage: vpngui [-c l -sc [-d] [-user <username>] [-pwd<password> l -eraseuserpwd]] <connection entry"

I used VPN a couple years ago at my school, but haven't used it since. I guess the cleanup wiped the password away?
............

Anyways, CCleaner, SuperAntispyware, VundoFix, VirtumundoBegone, Hijackthis, and all the logs I saved on the desktop are still here.

Don't have to worry about them right?

.......

Also, the clock still has not changed back to normal. It's still showing 22:25 for me. How to change?

[evilfantasy]

You can delete the logs you no longer need them.

Why the clock is set to 24hr format I don't know. I didn't know it had that ability. Let me look around and find out how to get it back to normal.