forhockey

Hi CamwynF,

Could you please stop attaching the logs, as it is making it is making the transition difficult for reading all the logs, thanks.

--------------------------------------------------------------

Before beginning the proposed fix, read this post completely. Any questions should be kindly asked before proceeding. Ensure that there are no open browsers when carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

--------------------------------------------------------------

Disable S& D Spybot's Tea Timer

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.

• Open Spybot Search & Destroy.
• In the Mode menu click "Advanced mode" if not already selected.
• Choose "Yes" at the Warning prompt.
• Expand the "Tools" menu.
• Click "Resident".
• Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
• In the File menu click "Exit" to exit Spybot Search & Destroy.

--------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

Save the file as "delete.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

--------------------------------------------------------------

Open My Computer. Select the View menu and click Folder Options. Select the View Tab then select Show all files in the Hidden files section. Also make sure there is no checkmark beside Hide file extensions for known file types. Click OK.

--------------------------------------------------------------

Delete the following File indicated in RED and Folder indicated in BLUE if they still exist.

C:\Program Files\ComPlus Applications
C:\WINDOWS\tsitra11.exe

Note: If you have trouble deleting the above entries, then boot into Safe Mode to delete them.

--------------------------------------------------------------

Do you recognize this folder? Please open the folder and tell me what files and folders are within.

C:\From the Earth to the Moon

--------------------------------------------------------------

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs:

Java 2 Runtime Environment, SE v1.4.2_13 <- Known to be vulnerable to current infections out there

K-Lite Mega Codec Pack 1.53 <- Known to contain malware


--------------------------------------------------------------

Restart your computer for the changes to take in effect.

--------------------------------------------------------------

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6 u3.
• Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". (4th one down)
• Click the "Download" button to the right.
• Check the box that says: "Accept License Agreement".
• The page will refresh.
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
• Close any programs you may have running - especially your web browser.
• Double-click on jre-6u3-windowsi586-p.exe to install the newest version.

--------------------------------------------------------------

Perform an online scan with Internet Explorer with Panda ActiveScan

1. Click on located at the bottom of the page.
2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
3. Enter your e-mail address, country, and state & click "Free Online Scan" * The download of the 8 MB Panda's ActiveX control will take place *

Begin the scan by selecting

• If it finds any malware, it will offer you a report.
• Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
• Click on then click

* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan

--------------------------------------------------------------

Please run HiJackThis again, and post the resulting log.

--------------------------------------------------------------

Please reply back with the following logs:

Inquiry about C:\From the Earth to the Moon
Panda Online Scan Results
New HiJackThis Log