HELP WINSPYWAREPROTECT

[evilfantasy]

Launch IE and see if it accepts that.

[Google]

I tried, doesnt work.

System requirements


Your computer must meet the following minimum requirements:


30 MB available on the disk
Microsoft Windows 2000 Professional SP4, Microsoft Windows XP SP2 32 bit and 64 bit or Microsoft Windows Vista 32 bit and 64 bit: Microsoft Internet Explorer 6 and 7, Opera 9 and Firefox 2
Ubuntu 7.10: Firefox 2
Sun Java SE Runtime Environment (JRE): in Microsoft Windows Vista, minimum version 1.6.0; in other operating systems, minimum version 1.5.0
Java and JavaScript enabled in the Web browser

I'm on Windows XP BTW.

[evilfantasy]

Try this one. IE only.

Scan with Panda ActiveScan

• Once you are on the Panda site click the Scan your PC now button
  
• A new window will open...click the Check Now button
  
• Enter your Country
  
• Enter your State/Province
  
• Enter your e-mail address and click send
  
• Select either Home User or Company
  
• Select the appropriate Yes or No to receiving marketing information
• Click the Free Online Scan button
  
• If it wants to install an ActiveX component allow it
• It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  
• When download is complete, click on My Computer to start the scan
  
• When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

Post the contents of the ActiveScan report in your next reply.

[Google]

Alright, it didnt work in IE but its working with mozilla.
"This process can take more than an hour, depending on the amount of information stored on your computer".

Its taking a while lol, but I'll post it when it's done thanks alot again.

[Google]

And, When we are done here, I am planning to browse through add/remove programs and delete MANY programs that I do not use. When I am completely done everything and I am satisfied that my pc is restored well. Can I make another system restore and delete the old one again?

[evilfantasy]

Yep, make sure everything is running OK for a few hours and then delete them.

The scan will take atleast an hour, maybe more. But it is an excellent scanner and will tell the tale if we got everything already or not.

[Google]

Ok thanks, will let you know when its done:)

[evilfantasy]

No problem, I should be around for a while... I think I'm going to put something new on my MP3

[Google]

20% complete and 97 files are apparently infected.

[evilfantasy]

Uh oh.... Be sure to keep the log!

[Google]

Ok, the scan finished and this is what I got to. The attatchment1.
I clicked the little notepad button and it gave me the second attatchment. I'm not sure if its right, but just let me know....


PS-where did you get your sig?

[recovering disk space -- attachment deleted by admin]

[evilfantasy]

Not too bad. It reported your Keylogger which is why I purposely ran a scan that would not delete what it found.

----------

Also found are a bunch of RECYCLER files in the E:\ drive. The recycler files are the hidden system storage area of the Recycle bin. These are stored by Windows until deemed useless then they will drop off.

They can be deleted manually (although it isn't necessary) by going to Start > Run > type CMD and click OK.

In the window type

Code: [Select]

E:
Press enter

Then type

Code: [Select]

attrib -R -A -S -H /S /D RECYCLER

Press enter

----------

Also found were a bunch of Cookies in your Firefox profile.

1. In Firefox go to Tools > Clear Private Data > make sure Cookies and Cache are checked, either select or de-select any others you choose.

----------

Now for the actual trojans/virus.

Download

OTMoveIt2 by OldTimer

• Save it to your desktop.

Note: If you are running on Vista, right-click on OTMoveIt2.exe and choose Run As Administrator.

• Double-click OTMoveIt2.exe to run it.
  
• Copy the lines in the codebox below.

[/list]

Code: [Select]

[kill explorer]
C:\Documents and Settings\User\My Documents\My Music\!1Asongs!1A\celabrat good times.zip
C:\Documents and Settings\User\Desktop\CE\VE5 1032\cakepub3.exe
EmptyTemp
[start explorer]

• Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste

• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) and paste it in your next reply.
  
• Close OTMoveIt2

.
Post the OTMoveIt2 log in the next reply.

[Google]

I did everything you said, but OTMoveIt2 froze and I cant copy anything???

[Google]

Nevermind, it eventually unfroze and said to reboot but I said no. Heres what I got:

Code: [Select]

Explorer killed successfully
C:\Documents and Settings\User\My Documents\My Music\!1Asongs!1A\celabrat good times.zip moved successfully.
C:\Documents and Settings\User\Desktop\CE\VE5 1032\cakepub3.exe moved successfully.
< EmptyTemp >
File delete failed. C:\DOCUME~1\User\LOCALS~1\Temp\ee366d2b2e4ede8287de879e85a0dcc2PSK_PLUGINS_2 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\User\LOCALS~1\Temp\Perflib_Perfdata_f60.dat scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\User\LOCALS~1\Temp\~DF8402.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\User\LOCALS~1\Temp\~DFB995.tmp scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcafee_zRPq6WfSUPrnCdu scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_mox5dUUfCSadLgD scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_uWv7OvkZCZYjfpf scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_ea4.dat scheduled to be deleted on reboot.
Temp folders emptied.
IE temp folders emptied.
Explorer started successfully
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 07282008_200928


[evilfantasy]

OK you will need to reboot to finish the deletions.