Help!! How to stop all the Popups, Adwares and Trojans??!!!

[green tea]

Ok, deleted the two imsins file and emptied my recycle bin.

I did a search for the Antispyware one in my Search box, and got these results. I don't know if any of them are relevant to this or not

[evilfantasy]

One is the windows prefetch which we will be cleaning shortly, and the other (qoobox) is the combofix backup files, which we will delete later.

[green tea]

So, should I go ahead and do the part about creating and dragging that log into RenV? Or should I keep looking for the C:\Program Files\AntiSpywareApp\AntiSpyware .ex

Good job!!!!

Still a few to delete.

Make sure hidden files and folders are showing and delete these files/folder (in bold)
C:\WINDOWS\imsins.BAK
C:\Program Files\AntiSpywareApp\AntiSpyware .ex << Delete the file and folder.


* Copy the entire contents of the quote Box below to Notepad.
** It MUST be Notepad
* Name the file as Log.txt
* Change the Save as Type to All Files
* and Save it on the Desktop

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy .exe
C:\Program Files\Common Files\Symantec Shared\ccApp .exe
C:\Program Files\Common Files\Symantec Shared\ccRegVfy .exe
C:\Program Files\Creative\ShareDLL\CtNotify .exe
C:\Program Files\IC Card Reader Driver v1.8e2\Disk_Monitor .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\Keymaestro\Multimedia Keyboard\MMKeybd .exe
C:\Program Files\SymNetDrv\SNDMon .exe
C:\WINDOWS\ime\imjp8_1\IMJPMIG .EXE
C:\WINDOWS\ime\imkr6_1\IMEKRMIG .EXE
C:\WINDOWS\system32\IME\PINTLGNT\ImScInst .exe
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP .EXE

Refering to the picture below, drag Log.txt into RenV.exe and attach the resulting report to your reply.

-

Next post
RenV log

[evilfantasy]

You do have hidden files and folders enabled?

If you cant find them then just do the RenV step.

[green tea]

Yes, "Show hidden files and folders" is selected, and "hide extensions..." and "hide protected operating system files" are unselected.

[evilfantasy]

They are probably not there now. You searched and only found the two mentioned so I am pretty sure they are gone already.

[green tea]

Ok here is the RenV log

How much longer are you going to stay up?

[file cleanup - saving space - attachment deleted by admin]

[evilfantasy]

I will be up until we run the next scan which will take a while.

Create another notepad file and copy this file path into it. 
Name it Log.txt (replace the old one)

C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100 .EXE

Drag the file into RenV.exe

Post the log.

You can just copy and paste it.

[green tea]

Code: [Select]

Ran on 2008-01-14 -  0:04:43.95

----a-w            77,887 2008-01-08 15:27:09  C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100 .EXE

 Entries:                1  (1)
 Directories:            0  Files:             1
 Bytes:             77,887  Blocks:          153


[evilfantasy]

OK, try to find the QFSCHD100 .EXE and delete it.

C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100 .EXE

Next:

Please use the Internet Explorer browser (or FireFox with IETab), and do an online scan with Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

 Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.

• Once the files are downloaded click on Next
  
• Click on Scan Settings and configure as follows:
  • Scan using the following Anti-Virus database:
  • Extended
• Scan Options:
• Scan Archives

• Scan Mail Bases

[/LIST]

• Click OK and, under select a target to scan, select My Computer

When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.


To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please attach the Kaspersky Online Scanner Report in your next post.



----------

Next post
Kaspersky log[/color]

This scan will take a while, so i will see it in the morning or whenever you get ot posted.

[green tea]

Ok, I deleted C:\Program Files\Corel\WordPerfect Office 2002\Programs\QFSCHD100 .EXE
and ran the ATF cleaner.

I will do the Kaspersky log tomorrow evening since I want to be awake when it does the scan. No more overnight scans for me!

Thanks EvilF, I'll talk to you tomorrow

[evilfantasy]

No problem we will start again tomorrow.

Later....

[green tea]

Question, when you say run Kaspersky with Internet Explorer, do I save the program to my desktop?

Or do I just click Run without clicking "Save" first?

or do I use the "Kaspersky File Scanner" located on the bottom of the page, under the section OTHER TOOLS??

[evilfantasy]

Follow the link http://usa.kaspersky.com/products_services/free-virus-scanner.php

You have to use the Internet Explorer browser because it runs in the browser, it isn't going to install anything but an ActiveX control. Everything is done right in the browser window. Firefox and the other browsers don't use ActiveX so it will not work with them.

[green tea]

I did click on that link, but there was no activeX prompt or anything.

And I only use IE.