Spybot Blocked

[diggerdave]

Kaspersky found no threats.

[evilfantasy]

Run CCleaner.

There may be a lot of fragmented sections on the drive after cleaning the malware.

You can use the built in Windows Defrag or a faster FREE program. Defraggler is very effective and easy to use. Be sure to clean out temp files and restart the computer just before using this.

[dexuk]

Programme files - find the Spybot search and Destroy executable and rename it to anything you want ( sb.exe for example) - double click it.........  use this trick if other AV, Malware or Spyware apps fail to start. Try Malwarebytes. rename to mb.exe if fails to start. Don't change the .exe part!

[evilfantasy]

@ dexuk

Did you even read through all of the posts?

That method is just avoiding the problem, not fixing it....

[diggerdave]

The memory test is still excruciatingly long, but all else seems to be running well.

[evilfantasy]

OK let's clean up. Let me know if you have any questions.

Download OTCleanIt.exe and save it to your Desktop.

• Double-click OTCleanIt.exe.
  
• Click the CleanUp! button.
  
• Select Yes when the "Begin cleanup Process?" prompt appears.
  
• If you are prompted to Reboot during the cleanup, select Yes.
  
• The tool will delete itself once it finishes, if not delete it yourself.

.
----------

Set a New Restore Point to prevent possible reinfection from an old one
Setting a new restore point AFTER cleaning your system will enable your computer to roll-back to a clean working state if needed.

• Go to Start > Programs > Accessories > System Tools and click System Restore
  
• Choose the radio button marked Create a Restore Point on the first screen then click Next Give the Restore Point a name then click Create.
  
• The new restore point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.
• Next go to Start > Run and type Cleanmgr
  
• Click OK
  
• Click the More Options Tab.
  
• Click Clean Up in the System Restore section to remove all previous restore points except the newly created clean one.

You can find instructions on how to enable and re-enable system restore here:

Windows XP System Restore Guide or Windows Vista System Restore Guide
.
----------

Use the Secunia Software Inspector to check for out of date software.

• Click Start Now
  
• Check the box next to Enable thorough system inspection.
  
• Click Start
  
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

.
----------

Go to Microsoft Windows Update and get all critical updates.

----------

Here are some great FREE tools to help you keep from getting infected again. These tools use little or no resources so won't slow down your PC.

Concerned about Browser Security? Consider using Mozilla Firefox. With more than 15,000 improvements, Firefox 3 is faster, safer and smarter than ever before.

For Internet Explorer 7 users there is IE7Pro. IE7Pro is a must have add-on for Internet Explorer, which includes a lot of features and tweaks to make your IE friendlier, more useful, more secure and customizable.

To prevent unknown applications from being installed on your computer install WinPatrol 2008
* Using Winpatrol to protect your computer from malicious software

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Check out Keeping Yourself Safe On The Web for tips and free tools to help keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[diggerdave]

Thank you for your help. It's only slow right after the post when it's doing the memory check.

[diggerdave]

Is it possible that during the cleaning up process that my bios settings were changed?

[evilfantasy]

No, the BIOS wasn't touched.

There may be a lot of fragmented sections on the drive after cleaning the malware.

You can use the built in Windows Defrag or a faster FREE program. Defraggler is very effective and easy to use. Be sure to clean out temp files and restart the computer just before using this.

[diggerdave]

I've run defraggler a couple of times over the weekend.

[evilfantasy]

It's possible something might have gotten back in.

Use the ESET Online Antivirus Scanner

This scanner requires Internet Explorer

1. Check the box next to YES, I accept the Terms of Use.
2. Click Start
3. When asked, allow the activex control to install
4. Click Start
5. Make sure that the option Remove found threats and the option Scan unwanted applications is check marked.
6. Click Scan
7. Wait for the scan to finish
8. Use notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
9. Add the C:\Program Files\EsetOnlineScanner\log.txt log into your next reply.

----------

Download GMER and save it to your desktop

• Unzip (extract) it to your desktop.
• Disconnect from Internet and close all running programs.
• There is a small chance this application may crash your computer so save any work you have open.
• Double-click gmer.exe to run it.
  
• Let the gmer.sys driver to load if asked.
• If it gives you a warning at program start about rootkit activity and asks if you want to run a scan... click NO
  
• Click the Rootkit tab.
  
• Make sure all the boxes on the right of the screen are checked, EXCEPT for "Show All".
  
• Then click the Scan button. Wait for the scan to finish.
  
• Once done, click the Copy button.
  
• This will copy the results to the clipboard. Open Notepad and press CTRL + V to paste the log, and save it to your desktop.
  
• Add this log to your next reply.

NOTE: If you're having problems with running gmer.exe, try it in Safe Mode. This tool works in Safe Mode whereas many other rootkit revealers do not.

[cliffdodger]

ESET is a fantastic A/V program.

But... every virus scanner whether they like to admit it or not misses the occasional well built trojan - even with great heuristic scanning.

I tend to keep a copy of A squared free anti-trojan around just for those days when spybot and eset/nod32 don't get the job done (those days are very few and very far between - once a year perhaps?)

When something's wrong and no results are turning up I've often found stealthy trojans with A squared.
FYI - trojans work fast.. once they infect you they may be set up to waste no time forwarding your saved passwords and other information to a hackers network.  They may install a keylogger so they can log what websites you go to and record the usernames and passwords you enter.  The real danger being either identity theft or waking up with your bank accounts drained.  I'd update all your passwords anytime you've cleaned a trojan on your machine.  The other thing people neglect is liability.  Being infected by a trojan means the trojan can hack into other systems via your computer or host illegal material on your computer leaving you liable to your countries laws for that crime because it's happening on your computer.  Trojan's are NASTY.

http://www.emsisoft.com/en/software/free/ - A squared Free Anti-trojan

[evilfantasy]

Please let the above instructions be posted before moving on to anything else.

aSquared is an advanced tool and it's results are easily misunderstood.

See here http://www.computerhope.com/forum/index.php/topic,57605.0.html

[cliffdodger]

p.s. if you're really worried about protecting account passwords you have on your pc you should install a software firewall even if you have a hardware firewall already.  Set the software firewall to manual.  You'll have to know your windows processes and recognize what's your hardware, what's windows and what's not (it comes with time - just look them up on google if you're not sure)

This way - any time a program wants to connect to the internet it must manually ask you for permission.  When you see a tmp file accessing the internet when you're not in the middle of installing a program that's an obvious clue you may have just caught a trojan - but if you didn't have the software firewall the trojan could already be sending it's data to a hacker or doing whatever it's programmed to do around the web.

[evilfantasy]

@cliffdodger 

Remove the link in your signature or your posts will be deleted..