HJT Log - Can I remove the ones listed as file missing?

[rapada]

Originally Posted by Ried

Go ahead and get that last C:\winstall.exe

Back to your original issue with Outlook Express--how is your system behaving?

Done, :)

So far... It seems to be better :) But I can't get firefox to work.. should I uninstall and reinstall it?

[rapada]

I fixed the firefox...

everything seems good.. is that it? Are we done?

[rapada]

I just did a partial scan on panda.. and I keep getting these?? What are they?

Incident Status Location

Adware:adware/superspider Not disinfected c:\windows\system32\services
Potentially unwanted tool:application/funweb Not disinfected HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

[Ried]

They are 'real' malware entries, and the last of what we need to do here.

From Normal Mode:

Navigate to, and delete the following which appears to be a folder:

c:\windows\system32\services <--Careful here. Do not delete the legit services.exe or the services.msc

**If you're not sure which to delete, right click any services entries you see in that path, select 'Properties', bring that info back here for me and I'll guide you.

------------------------------------------------------------

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now.

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}]

Save the file as "delete.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the delete.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

------------------------------------------------------------

Reboot your system.

------------------------------------------------------------

Run a full online scan at Panda and post those results here.

[rapada]

Originally Posted by Ried

They are 'real' malware entries, and the last of what we need to do here.

From Normal Mode:

Navigate to, and delete the following which appears to be a folder:

c:\windows\system32\services <--Careful here. Do not delete the legit services.exe or the services.msc

**If you're not sure which to delete, right click any services entries you see in that path, select 'Properties', bring that info back here for me and I'll guide you.

There isn't a folder.. there is a file called services.exe and a file called services

Are they what I remove?

[rapada]

Here is a photo of the file ;)

[rapada]

Oh, and the services.msc is there too

[Ried]

Ok--delete the one on the left--the one listed simply as services with no file extension.

[rapada]

ok done... Rebooting and I'll do the panda scan tomorrow morning then post it ... off to bed.

Thanks again for all your help :D

[Ried]

You're welcome--you've been a great help to us as well.

'See' you tomorrow.

[rapada]

New panda scan...


Incident Status Location

Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\1vp33fd7.Britt\cookies.txt[.did-it.com/]
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Owner\SmitfraudFix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\system32\Process.exe

[Ried]

Hi Britt,

Other than the one cookie reported there, your logs are clean.

Since it's only 1 cookie, you can just follow the path shown in Panda to delete it.

If you wish, you can delete Avenger, SmitfraudFix, Killbox and the regfix.

Please keep ComboScan.exe and use that in place of HijackThis should you ever need our services again.

If there aren't any more problems, please continue with these final instructions and helpful links:

Reset hidden/system files and folders
Windows XP
===============
Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View tab.
* Deselect the Show hidden files and folders option.
* Select the Hide file extensions for known types option.
* Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

Enable Windows Auto Update
*Go to Start>Run - type wuaucpl.cpl
*Tick on the checkbox - "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

Create a new System Restore point
Click Start >> Run - type SYSDM.CPL & press Enter
* Select the System Restore Tab
* Tick on the checkbox - "Turn off System Restore on all drives"
Click Apply
* Then untick the same checkbox & click OK
This will prevent any reinfection from previous restore points.


To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.

SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

Spyware Guard to catch and block spyware before it can execute.

IE-SPYAD.EXE to block access to malicious websites so you cannot be redirected to them from an infected site or email. IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. This is a self-extracting .ZIP file, save it to your desktop. Once downloaded, double-click on it to extract the files inside (default dir is C:\IE-SPYAD)

• Now navigate to C:\ie-spyad. Double click to open it.
• From within the folder, double-click install.bat
• Select Option #2 - Install the new IE-SPYAD list, by typing 2
• Then return to the main menu.
• Select option #4 - Add the old porn sites domain, by typing 4

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

-----------------------------------------------------

Follow the list above and the potential for infection will reduce dramatically.

[rapada]

All done!

Thankyou SO much!!!! I really appreciate all your help!

[Ried]

You're welcome, Britt--it was a pleasure working with you.