Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Antivirus Xp 2008


  • Please log in to reply
18 replies to this topic

#1 Lennyd

Lennyd

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 23 September 2008 - 10:14 AM

My buddy just dropped his laptop off for me to look at. At power up it goes into this virus checker. Is there a Free removal tool to download and run. I haven't done anything else at this point.
Thanks

Mod Edit: Topic moved from HJT to more appropriate forum~ TMacK

Edited by TMacK, 23 September 2008 - 10:18 AM.


BC AdBot (Login to Remove)

 


#2 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:03:26 AM

Posted 23 September 2008 - 10:29 AM

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan.
  • If an update is found, the program will automatically update itself.
  • Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Reagardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#3 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 23 September 2008 - 12:40 PM

Well this seems to work but it took out my internet access. Suggestions? Not sure how to upload the log

#4 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:26 AM

Posted 23 September 2008 - 01:13 PM

To retrieve the MBAM scan log information, launch MBAB.
• Click the Logs Tab at the top.
mbam-log-7-18-2008(09-52-04).txt should show in the list. <- your dates will be different from this exampe
• Click on the log name to highlight it.
• Go to the bottom and click on Open.
• The log should automatically open in notepad as a text file.
• Go to Edit and choose Select all.
• Go back to Edit and choose Copy or right-click on the highlighted text and choose copy from there.
• Come back to this thread, click Add Reply, then right-click and choose Paste.

Most Internet connectivity problems arise out of corrupt Winsock settings due to the installation of a networking software or Malware infestation.

Try resetting the IP address:
Go to Start > Run and type: cmd
Press OK or Hit Enter. A dos Window will appear.
At the command prompt type or copy/paste:: ipconfig /release
Hit Enter.
When the prompt comes back, type: ipconfig /renew
Hit Enter.
Close the command box and and see if that fixes the connection. No reboot needed.

If not, go to Start > Run > type: cmd
Press OK or Hit Enter.
At the command prompt, type or copy/paste: ipconfig /flushdns
Hit Enter.
You will get a confirmation that the flush was successful.
Close the command box.

If the above commands did not resolve the problem, the next thing to try is to Configure TCP/IP to use DNS.
  • Go to Start > Control Panel, and choose Network Connections.
  • Right click on your default connection, usually Local Area Connection for cable and DSL or Dial-up Connection if you are using Dial-up, and and choose Properties.
  • Double-click on the Internet Protocol (TCP/IP) item.
  • Write down the settings in case you should need to change them back.
  • Select the radio button that says "Obtain DNS servers automatically".
  • Click OK twice to get out of the properties screen and restart your computer. If not prompted to reboot go ahead and reboot manually.
CAUTION: It's possible that your ISP (Internet Service Provider) requires specific DNS settings here. Make sure you know if you need these settings or not BEFORE you make any changes or you may lose your Internet connection. If you're sure you do not need a specific DNS address, then you may proceed.

If that still does not help and your using Windows XP SP2, log on as an administrator.
Go to Start > Run and type: cmd
Press OK or Hit Enter. A dos Window will appear.
At the command prompt, type or copy/paste: netsh winsock reset
Hit Enter.
When the program is finished, you will receive the message: "Successfully reset the Winsock Catalog. You must restart the machine in order to complete the reset."
Close the command box and reboot your computer.

Finally, if you continue to have connectivity problems, download WinSock XP Fix from another computer, save to a usb stick, and transfer it to your computer. <- for Windows XP ONLY.
Be sure to print out and follow the instructions for using this tool provided in the Winsock Repair Tutorial.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#5 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 23 September 2008 - 02:18 PM

Thanks Quietman. AFter looking farther somehow I only had 4 sevices running. All the others were disabled. I'm real good in this area, so I just compared to my PC and enabled quite a few. I can get on the internet now but some stuff in the control panel won't execute. Like Add/Remove programs, and I still can't get into the Task Manager. Other suggestions anyone?

#6 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:26 AM

Posted 23 September 2008 - 02:29 PM

Please post the results of the MBAM scan for review.
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#7 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 23 September 2008 - 02:57 PM

This is from the second scan I ran. Can't find the first one, Maybe it overwrote it? The first did find 33 infections. This second one only said 4. Wonder why they all weren't found on the first scan?

Thanks again

Malwarebytes' Anti-Malware 1.27
Database version: 1127
Windows 5.1.2600 Service Pack 2

9/23/2008 12:15:07 PM
mbam-log-2008-09-23 (12-14-59).txt

Scan type: Quick Scan
Objects scanned: 45584
Time elapsed: 6 minute(s), 56 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 21
Registry Values Infected: 5
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9dd4258a-7138-49c4-8d34-587879a5c7a4} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b8c0220d-763d-49a4-95f4-61dfdec66ee6} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c3bcc488-1ae7-11d4-ab82-0010a4ec2338} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000000da-0786-4633-87c6-1aa7a4429ef1} (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\dpcproxy (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\HOL5_VXIEWER.FULL.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Classes\hol5_vxiewer.full.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Classes\applications\accessdiver.exe (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\fwbd (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\HolLol (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Inet Delivery (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Inet Delivery (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mslagent (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Invictus (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Golden Palace Casino PT (Trojan.DNSChanger) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Golden Palace Casino NEW (Trojan.DNSChanger) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adwarepromfct (Rogue.Ad-WarePro) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

#8 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:03:26 AM

Posted 23 September 2008 - 03:14 PM

Hi LennyD,

Please update and rerun MalwareBytes. Make sure you follow the instructions below:
On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen:
  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply and exit MBAM.
Thanks

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#9 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 23 September 2008 - 05:28 PM

Things are looking good! Thanks man.

Malwarebytes' Anti-Malware 1.28
Database version: 1200
Windows 5.1.2600 Service Pack 3

9/23/2008 4:46:23 PM
mbam-log-2008-09-23 (16-46-23).txt

Scan type: Quick Scan
Objects scanned: 47894
Time elapsed: 7 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\User\Local Settings\Temp\d.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MSVolume.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.

#10 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:26 AM

Posted 23 September 2008 - 06:27 PM

Lets do another scan to see if we find anything else that MBAM may have missed.

Please download ATF Cleaner by Atribune & save it to your desktop. alternate download link DO NOT use yet.
Please download and install SUPERAntiSpyware Free
  • Double-click SUPERAntiSypware.exe and use the default settings for installation.
  • An icon will be created on your desktop. Double-click that icon to launch the program.
  • If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download them from here and unzip into the program's folder.)
  • In the Main Menu, click the Preferences... button.
  • Click the "General and Startup" tab, and under Start-up Options, make sure "Start SUPERAntiSpyware when Windows starts" box is unchecked.
  • Click the "Scanning Control" tab, and under Scanner Options, make sure the following are checked (leave all others unchecked):
    • Close browsers before scanning.
    • Scan for tracking cookies.
    • Terminate memory threats before quarantining.
  • Click the "Close" button to leave the control center screen and exit the program.
  • Do not run a scan just yet.
Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Double-click ATF-Cleaner.exe to run the program.
  • Under Main "Select Files to Delete" choose: Select All.
  • Click the Empty Selected button.
  • If you use Firefox browser click Firefox at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • If you use Opera browser click Opera at the top and choose: Select All
  • Click the Empty Selected button.
    If you would like to keep your saved passwords, please click No at the prompt.
  • Click Exit on the Main menu to close the program.
Note: On Vista, "Windows Temp" is disabled. To empty "Windows Temp" ATF-Cleaner must be "Run as an Administrator".

Scan with SUPERAntiSpyware as follows:
  • Launch the program and back on the main screen, under "Scan for Harmful Software" click Scan your computer.
  • On the left, make sure you check C:\Fixed Drive.
  • On the right, under "Complete Scan", choose Perform Complete Scan and click "Next".
  • After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
  • Make sure everything has a checkmark next to it and click "Next".
  • A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
  • If asked if you want to reboot, click "Yes" and reboot normally.
  • To retrieve the removal information after reboot, launch SUPERAntispyware again.
    • Click Preferences, then click the Statistics/Logs tab.
    • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    • Please copy and paste the Scan Log results in your next reply.
  • Click Close to exit the program.

.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#11 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 23 September 2008 - 06:41 PM

Ok will give these scans a go. Still concerned of all the Services that were stopped. Will it hurt to turn them all to Manual or Automatic?
Thanks

#12 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 24 September 2008 - 07:09 AM

Here are the results from that scan. One other question. When going into IE it goes into that first screen you get when IE 7 was introduced. It won't let me save my choices, just gives a generic error that they can't be saved. Any thoughts. Mozilla is on here also, and that works fine. IE will to after I bypass the error.


SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/23/2008 at 08:02 PM

Application Version : 4.21.1004

Core Rules Database Version : 3577
Trace Rules Database Version: 1565

Scan type : Complete Scan
Total Scan Time : 00:52:33

Memory items scanned : 204
Memory threats detected : 0
Registry items scanned : 6037
Registry threats detected : 1
File items scanned : 52922
File threats detected : 61

Trojan.DNSChanger-Codec
HKU\S-1-5-21-1390067357-1343024091-854245398-1004\Software\uninstall

Rogue.System AntiVirus 2008
C:\Program Files\SAV

Adware.Tracking Cookie
.msnportal.112.2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.media.fastclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.mediaplex.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.tribalfusion.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.clickbank.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.atdmt.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.fastclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.www6.addfreestats.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.fastclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.fastclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.advertising.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.www.googleadservices.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.fastclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.doubleclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\0on8awhx.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
.atwola.com [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
.revsci.net [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
.doubleclick.net [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
.ad.us-ec.adtechus.com [ C:\Documents and Settings\Administrator\Len\Application Data\Mozilla\Firefox\Profiles\wjg7muao.default\cookies.txt ]
C:\Documents and Settings\Administrator\Len\Cookies\user@2o7[2].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@advertising[2].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@apmebf[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@at.atwola[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@atdmt[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@atwola[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@bs.serving-sys[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@clickbank[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@doubleclick[2].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@ehg-autozone.hitbox[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@hitbox[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@mediaplex[2].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@overture[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@questionmarket[2].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@revsci[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@serving-sys[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@statcounter[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@tacoda[1].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@upclick[2].txt
C:\Documents and Settings\Administrator\Len\Cookies\user@www.findstuff[1].txt

Trojan.Unknown Origin
C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\LEN\APPLICATION DATA\MICROSOFT\WINDOWS\AVICORE.DLL
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\C.EXE.BAK

Rogue.AntiSpywareSolutionPro
C:\DOCUMENTS AND SETTINGS\USER\LOCAL SETTINGS\TEMP\PCPC_SETUP_FREE.EXE

#13 quietman7

quietman7

    Bleepin' Janitor


  • Global Moderator
  • 51,490 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Virginia, USA
  • Local time:03:26 AM

Posted 24 September 2008 - 07:22 AM

I don't use IE7 so I'm not sure what the first screen looked like. This forum is primarily for malware removal. Once we ensure you are cleaned up, your issues with IE7 is something you can ask about in a new topic in the Web Browsing or Windows XP Forum unless rigel has a suggestion about it.

Other than that, how is the computer running now? Any more reports/signs of infection?
.
.
Windows Insider MVP 2017-2018
Microsoft MVP Reconnect 2016
Microsoft MVP Consumer Security 2007-2015 kO7xOZh.gif
Member of UNITE, Unified Network of Instructors and Trusted Eliminators

If I have been helpful & you'd like to consider a donation, click 38WxTfO.gif

#14 rigel

rigel

    FD-BC


  • Members
  • 12,944 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:South Carolina - USA
  • Local time:03:26 AM

Posted 24 September 2008 - 07:37 AM

Can you give me the exact error? Screenshot?

"In a world where you can be anything, be yourself." ~ unknown

"Fall in love with someone who deserves your heart. Not someone who plays with it. Will Smith


#15 Lennyd

Lennyd
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Local time:02:26 AM

Posted 24 September 2008 - 09:08 AM

Couldn't do a screen shot. What keystrokes are they again. Just did a paste copy. Not much of an error.

Thanks for choosing Internet Explorer 7
Welcome Back
Setup is quick and easy
Settings saved successfully;
you're good to go.


Settings were not able to be saved successfully





Internet Explorer®is better than ever, which you'll see in just a few quick clicks.
Are you ready to choose your settings?
Take the Tour
Learn more about the new features in Internet Explorer 7
Go to your homepage
Start experiencing Internet Explorer 7 now
Get add-ons
Make your browser more productive, safe, and fun!
Need help?
Check out our support options
a) Required settings
Please choose your default search provider.
Internet Explorer allows you to easily find information on the Web using any search provider.
Your current default search provider is:
Please select 1 of the 2 following options:
Keep my current default search provider.
Let me select from a list of other search providers.
Click "Save your settings" below to see the list of search providers.
Before you can continue, please choose your default search provider.
Applying settings...




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users