Lots of Adware/Spyware

[VvWolverinevV]

MyWebSearch Adware + more

Hi,

I recently moved, and my landlord was complaining about his computer acting up. I did the scans from the TS guide, and, sure enough, he had hundreds of instances of adware/spyware. Would someone please take a look at the logs from my scans?

Thanks!

 

[touch]

Hello VvWolverinevV

Download the Norton Removal Tool (SymNRT) to your Desktop.
http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2005033108162039

Once downloaded please close ALL open browsers, also save any work because this may require a restart.

Go to your desktop and double click on the removal tool and then click Setup.
Once open Click Next
Accept the license agreement and click Next
Type in the letters/numbers that you see into the text box then click Next.
Then click Next and the tool will start running.
Once finished restart the PC and run the tool again to ensure everything has been removed.
Delete Nortonremoval tool from your Desktop.

Atttach new hijackthis log, and tell how things are running ?

 

[VvWolverinevV]

Thanks for your reply, touch. Here is my new HJT log. I removed a lot of other crap from his computer too. Basically, I sat him down and uninstalled everything that I thought was unnecessary that he didn't recognize And it seems to be running about as well as I would expect a 3-year-old Lenovo desktop to run.

 

[touch]

He even removed Comodo´s Firewall
I´ll suggest he install it again. A 3-year-old Lenovo computer probably don´t have more than 1 GB ram ?

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=0
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O20 - AppInit_DLLs: ~1??????(

Reboot, run another scan with hijackthis and tell if the 020 line have disappeared ?

 

[VvWolverinevV]

Yessir, that line is gone. I will install a different firewall for him. Comodo has an annoying number of popups. Is his machine clean now?

 

[touch]

The machine is clean. You´re right about Comodo´s popups.

I´ll suggest he read this article -

To learn more about how to protect yourself while on the internet, please read Tony Klein´s guide:
http://www.spywareinfoforum.com/index.php?showtopic=60955

 

[VvWolverinevV]

Great, thanks again, touch! I will go over Tony Klein's guide with him.

 

[touch]

You´re welcome, and it sound like an good idea