Another messed up system

Hi Gouge

Been busy!

Don't uninstall MBAM or SAS but run them when you go to work or bed once every 2 weeks or so.

When not under the gun these long scans can be scheduled at a time as not to interfere with computer time.

Additionally running them every couple of weeks should help prevent multiple infections etc. Which are much harder for us to clean.

The SDFix, ComboFix should be cleared as they need to be downloaded again if needed.

Type
combofix /u
at Run command click ok.

The rest is in the closing below.

Thread closing-------------------------------------------------------------------
Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

Save to desktop.

This will remove all the tools we used to clean your computer.
These tools update so often they require downloading again later if needed.

Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

Approve all if prompted by Firewall, Widows Defender or other guards or security programs about OTCleanIt attempting access to the Internet, allow all.

If prompted to Reboot click Yes.
OTCleanit will delete itself when finished, if not delete it by yourself.

-------------------------------------------------------------------------------------
Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

D/L install and run ATF-Cleaner clear all except passwords in all browsers you have. Run repeatedly until no more found.

http://www.majorgeeks.com/ATF_Cleaner_d4949.html
-------------------------------------------------------------------------------------
The issues found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.
-------------------------------------------------------------------------------------

Every 2 weeks or so run mbam and sas until clean They take a while so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be schedules not to interfere with computer time.

If they find something they can not clean then get back to us.

Additionally run CCleaner.

I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

It was designed to co-exist with other Virus scanners.

Additionally it uses totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity. It's like looking at it with 2 sets of eyes and from a different angle.

http://www.threatfire.com/Download/
-------------------------------------------------------------------------------------
Look at http://www.javacoolsoftware.com/spywareblaster.html

Run SpyBot ocassionally and use the Immunize function.
http://www.safer-networking.org/en/download/

Install Hostman and allow it to disable DNS Client and select all 4 Host files and the Update
Hostman http://www.abelhadigital.com/2008/07...-released.html

A Disk scan and Defrag are in order.

Mike

I will be glad to help you with that. My concern has been that with all the program downloads and the resulting scans, you might get to the point where your hard drive was compromised:

To remove the cleaning tools:

Clear your existing System Restore points and establish a new clean restore point:
Quote:

Please let me know if you need additional help with this.

I meant to post those instructions, but I didn't read the post to see I already had!!

Thanks,
Bobbye

@mflynn

This thread is up to page 4 with 64 replies!
http://www.techspot.com/vb/topic116414.html

I feel this is too much
Yes, you have helped immensely and your support welcomed. But it may be time for you to learn about reading HJT logs, I feel

There's an excellent guide here to start with: http://www.bleepingcomputer.com/tutorials/tutorial42.html

Thank you Sir

I understand where you are coming from and will try to do better!

I did go and read it again sure hasn't changed much since last few times I read it. I always try to read it at any new minor update.

I will endeavor to keep all threads to one page and 6 or eight posts and a day or so. But there may be a time when someone only posts back one post a day or even skips a few days in between.

And then they might not respond or answer my questions and I might have to ask a lot of questions that ups the page and post count.

And sometimes I might even feel that just getting the tools to work at all to be more important than an additional HJT log.

On those occasions the page time could go up to weeks the page count up to 40 and the post count over 100. If it does it is beyond my control as I don't stop or give up.

But my goal will be! to keep all threads to one page and 6 or eight posts and a day or so. And to reread the HJT logs more often even if I already know what is there!

Mike

Not required, there are too many reasons that this can't work (you already mentioned a few)

Yes this will do nicely

While I can understand your points, guys, I have a PC that is not running well and need help and clarification. If it could have been cleaned and back to A1 performance in 1 page, then fine by me, but it wasn't. Mine was a complex problem, hence I started a new thread on the soundcard problem (for which I have had no real help yet!!) to stop this thread getting any longer.

In your #61 post, Mike, you said to "let it disable DNS Client". I did everything else, but I'm not sure how to do this bit.

Hi Gouge

Pay no mind to our bantering amongst ourselves! It has nothing to do with you. Just a little procedural debate beside the road.

I will try to get a look at your other thread.

OK the DNS Client was turned off via the Services tweaks we did earlier so Hostman detected it as already off and did not ask.

The Threatfire has a learning curve how is that coming along. If you are used to it then click settings and max the sensitivity (looks like a cell phone signal) this will make it more wordy as it checks deeper. But once all are approved you will only get a prompt ocasionally.

OK besides the Audio how are things performance wise.

Mike

No, it's not 'bantering among ourselves'. It's an attempt to draw attention to something that needs to be handled and that's the entries in the HijackThis log. Unless this is done, you are spinning wheels.

Most of us work in a team work environment. Some members are more experienced in some things, so we ask for their help. Unfortunately, not everyone recognizes this so they fail to get the additional help and as a result, the person with the problem can't get a resolution.

A thread going on this long and with so many things already tried without resolution indicates there is a problem somewhere. Unless it is addressed, it isn't going to be handled..

OK. Here's the latest Hijackthis log file.

Please let me know what, if anything is still wrong and an agreed resolution.

Martin

The only entries I'd have you remove from the HijackThis log are:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

You have a lot of unnecessary processes starting on boot such as Adobe Photoshop, Java, all of the Canon printer references (including Easy Web-Print), the Creative processes, PC Pitstop Utilities, Musicnotes Viewer, NVIDIA Smart Scan, Scorch and Tiscali Music downloads:

To stop Start-ups:

NOTE: If you do take processes off of startup, when you reboot, you will get a nag message that you can ignore after checking 'don't shown this message again.' Stay in Selective Start to maintain the changes.

I'd change the Startup type of these services to Manual:

To change Service Startup type:

Please let me know if I can be of further help.

I agree!

But instead of msconfig I like http://www.mlin.net/StartupCPL.shtml

More flexibility just uncheck and if later you want it back just recheck.

Mike

Followed instructions.

System worse now than before I started this!

XP screen boot takes over 90 secs and opening programs is so slow when opening IE7 I went away and returned later to enter this post.

Forget it guys.

I've invested in a new Music PC with a different soundcard as I can't wait any longer.

I'll flatten this hard drive and use this as a spare.

I am very sorry you have ended up in this state. sometimes, when logs aren't check thoroughly in the beginning and entries removed, problems get worse. I don't think anything I had you do caused this.

Please take a few minutes and get all the cleaning programs off:
* Download OTCleanIt (http://download.bleepingcomputer.com.../OTCleanIt.exe)
* Click the CleanUp! button.
* It will go thorough the list and remove all of the tools it finds and then delete itself (requiring a reboot).

Clear your existing System Restore points and establish a new clean restore point:
Quote:
Go to Start > All Programs > Accessories > System Tools > System Restore> Select Create a restore point> OK.
* Next, go to Start > Run and type in cleanmgr
"Ensure the selection is on C:\ and click on OK"-
* Select the *More options* tab
* Choose the option to clean up System Restore and OK it.
* This will remove all restore points except the new one you just created.