Ole99
08-07-2005, 07:10 PM
My computer has recently given me the warnings "WARNING: Windows Firewall detected suspicious network activity on yor computer" and "Your computer might be at risk." In addition Internet Explorer starts by itself when I start/reboot my pc.
I have the McAfee security package. I've installed and ran Spybot S&D, Bazooka and CWS Shredder but the problem is still there. I would be greatful for some help. HijackThis logfile attached
RealBlackStuff
08-08-2005, 09:10 AM
Download RapidBlaster Killer here: http://www.spywareinfo.com/downloads/rbkiller/rbkiller.exe
Don't run it till I tell you!
Boot in Safe Mode.
Switch System restore OFF, see how here (www.bleepingcomputer.com/forums/tutorial56.html).
In Windows Explorer, turn on "show all files and folders, including hidden and system". See how here (www.bleepingcomputer.com/forums/tutorial62.html).
Next, run RapidBlaster Killer
Next, open Windows Task Manager.
On Windows 95/98/ME, press CTRL+ALT+DELETE.
On Windows NT/2000/XP, press CTRL+SHIFT+ESC.
Click the Processes tab, select the process (if there), click End Process for:
STDSB.exe
Icon.exe
d3tf32.exe
ClickMe.exe
Next, try to UNinstall anything to do with (not delete yet!):
C:\apps\ClickMe\ClickMe.exe
Next, run a HJT scan and (if still there) place a tick-mark in the little square before:
........................................................................... ........................
C:\WINDOWS\system32\drivers\STDSB.exe
C:\WINDOWS\system32\drivers\Icon.exe
C:\WINDOWS\system32\d3tf32.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer Provided by blueyonder
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O4 - HKLM\..\Run: [STDSB] C:\WINDOWS\system32\drivers\STDSB.exe
O4 - HKLM\..\Run: [Icon] C:\WINDOWS\system32\drivers\Icon.exe
O4 - HKLM\..\Run: [ClickMe] C:\apps\ClickMe\ClickMe.exe
O4 - HKLM\..\Run: [iexplore.exe] C:\Program Files\Internet Explorer\iexplore.exe (this starts IE at boottime)
O4 - HKLM\..\Run: [d3tf32.exe] C:\WINDOWS\system32\d3tf32.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
........................................................................... ........................
Now click on the Fix Checked button in HJT.
When done, from between the above dotted lines, delete the highlighted bold files.
When a \directory-name\ is bold, delete everything in it, including that directory itself.
Delete all files and directories from: C:\Documents and Settings\[username]\Local Settings\Temp
Repeat this for ALL [usernames].
Delete all files and directories from: C:\WINDOWS\Temp (except files dated from TODAY).
Boot normal. When all OK, switch System Restore back on.