Lockbr.exe giving me grief

[PG-13]

After startup, I get a Window Security notification asking me if I want to open lockbr.exe

Can't seem to figure it out, so I have attached my log and will be grateful for any help I can get. Thanks

edit: Actually forgot to attach my log. Fixed.

 

[howard_hopkinso]

Hello and welcome to Techspot.

Name: freexstyle
Filename: lockbr.exe
Command: lockbr.exe
Description: Added by the W32.Loxbot.C worm and IRC backdoor.
File Location: %System%

Go HERE and have your computer scanned.

Then, go and read both these threads by RBS. follow all the instructions exactly.

How to remove Trojans and its ilk! and How to remove Begin2search / coolwebsearch and other nasties.

Then see. How to post your Hijackthis log-file as an ATTACHMENT.

Regards Howard :wave: :wave:

 

[PG-13]

Sorry about that, I actually read everything posted and had created a log, I just forgot to attach it, lol.

I posted my own thread because that's what my dad advised me to do, so I apolgize if I went wrong somewhere.

Also, I cleared out my cookies and updated the log in log03.

 

[howard_hopkinso]

Boot into safe mode. See how HERE

Turn off system restore.(XP/ME only) See how HERE

In Windows Explorer, turn on "Show all files and folders, including hidden and system". See how HERE

Go to add remove programmes in your control panel, and uninstall anything to do with(if there).

C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot

Close control panel.

Open your task manager by pressing the ctrl/alt/delete keys together, and click on the processes tab. End process for(if there)

lockbr.exe
AdwareAlert.Exe

Close control panel.

Run HJT with no other programmes open, and let HJT fixx the folloing, by placing a tick in the little box next to(if there).

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.squareinsider.com/forums/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=presario&pf=laptop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://register.hp.com/servlet/Web...YEAR=2005&gwCountry=US&language=EN&prodOS=012

O4 - HKLM\..\Run: [freexstyle] lockbr.exe
O4 - HKLM\..\Run: [AdwareAlert] C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot
O4 - HKLM\..\RunServices: [freexstyle] lockbr.exe
O4 - HKLM\..\RunOnce: [isDeleteMe] "C:\WINDOWS\system32\cmd.exe" /c "C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\isDel.bat"

O15 - Trusted Zone: http://s8.invisionfree.com

Fix all 016 DPF entries.

O23 - Service: MSMPSVC - Unknown owner - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MSMPSVC.exe" -n 4 (file missing)

Now click on the fix checked button.

Close HJT.

Locate, and delete the following bold files(if there).

C:\Program Files\AdwareAlert\AdwareAlert.Exe -boot

lockbr.exe

Reboot into normal mode, and turn system restore back on.

Please post a fresh HJT log.

Regards Howard

 

[howard_hopkinso]

HERE are further removal instructions. If required.

Regards Howard

 

[PG-13]

The windows one care live log seems to replant itself at every startup. It should be noted that that is a certified MS program, as I downloaded it Friday night.

New log attached.

 

[howard_hopkinso]

Your HJt log is clean.

Regards Howard