Multiple infections

[ohno]

Activescan.txt


Incident Status Location

Spyware:Cookie/Xiti Not disinfected C:\Deckard\System Scanner\20070507042631\backup\DOCUME~1\dale\LOCALS~1\Temp\Cookies\dale@xiti[1].txt
Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\dale\Cookies\dale@anm.co[1].txt
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\dale\Cookies\dale@atwola[2].txt
Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\dale\Cookies\dale@azjmp[2].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\dale\Cookies\dale@cgi-bin[11].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\dale\Cookies\dale@cgi-bin[4].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\dale\Cookies\dale@cgi-bin[7].txt
Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\dale\Cookies\dale@cgi-bin[9].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\dale\Cookies\dale@com[1].txt
Spyware:Cookie/GoStats Not disinfected C:\Documents and Settings\dale\Cookies\dale@gostats[2].txt
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\dale\Cookies\dale@go[1].txt
Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\dale\Cookies\dale@xiti[1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\nircmd.exe
Potentially unwanted tool:Application/NirCmd.A Not disinfected D:\dump\ComboFix.exe[ComboFixT\nircmd.exe]
Spyware:Cookie/NewMedia Not disinfected F:\safehold\setup\Cookies\dale@anm.co[1].txt
Spyware:Cookie/Atwola Not disinfected F:\safehold\setup\Cookies\dale@atwola[1].txt
Spyware:Cookie/Azjmp Not disinfected F:\safehold\setup\Cookies\dale@azjmp[2].txt
Spyware:Cookie/Cgi-bin Not disinfected F:\safehold\setup\Cookies\dale@cgi-bin[11].txt
Spyware:Cookie/Cgi-bin Not disinfected F:\safehold\setup\Cookies\dale@cgi-bin[4].txt
Spyware:Cookie/Cgi-bin Not disinfected F:\safehold\setup\Cookies\dale@cgi-bin[7].txt
Spyware:Cookie/Cgi-bin Not disinfected F:\safehold\setup\Cookies\dale@cgi-bin[9].txt
Spyware:Cookie/GoStats Not disinfected F:\safehold\setup\Cookies\dale@gostats[2].txt
Spyware:Cookie/Go Not disinfected F:\safehold\setup\Cookies\dale@go[1].txt
Spyware:Cookie/Xiti Not disinfected F:\safehold\setup\Cookies\dale@xiti[1].txt
Spyware:Cookie/Xiti Not disinfected F:\safehold\setup\Local Settings\Temp\Cookies\dale@xiti[1].txt
Spyware:Cookie/Atwola Not disinfected F:\storage\setup.old\Cookies\dale@atwola[1].txt
Spyware:Cookie/Cgi-bin Not disinfected F:\storage\setup.old\Cookies\dale@cgi-bin[6].txt
Spyware:Cookie/360i Not disinfected F:\storage\setup.old\Cookies\dale@ct.360i[2].txt
Spyware:Cookie/Go Not disinfected F:\storage\setup.old\Cookies\dale@go[2].txt
Spyware:Cookie/MediaTickets Not disinfected F:\storage\setup.old\Cookies\dale@kinghost[1].txt
Spyware:Cookie/Rn11 Not disinfected F:\storage\setup.old\Cookies\dale@rn11[2].txt
Spyware:Cookie/Target Not disinfected F:\storage\setup.old\Cookies\dale@target[2].txt
Spyware:Cookie/Xiti Not disinfected F:\storage\setup.old\Cookies\dale@xiti[1].txt
Spyware:Cookie/Atwola Not disinfected F:\storage\setup.old\Local Settings\Temp\Cookies\dale@atwola[1].txt
Spyware:Cookie/Belnk Not disinfected F:\storage\setup.old\Local Settings\Temp\Cookies\dale@belnk[1].txt
Spyware:Cookie/Belnk Not disinfected F:\storage\setup.old\Local Settings\Temp\Cookies\dale@dist.belnk[2].txt

[Ried]

Hi,

Other than cookies, your logs are clean.

Empty these folders:

F:\safehold\setup\Cookies
F:\storage\setup.old\Cookies

Your logs are clean. If there aren't any more problems, please continue with these final instructions and helpful links:

Reset hidden/system files and folders
Windows XP
===============
Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View tab.
* Deselect the Show hidden files and folders option.
* Select the Hide file extensions for known types option.
* Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

Ensure Windows Auto Update is Enabled
*Go to Start>Run - type wuaucpl.cpl
*Tick on the checkbox - "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

Create a new System Restore point
Click Start >> Run - type SYSDM.CPL & press Enter
* Select the System Restore Tab
* Tick on the checkbox - "Turn off System Restore on all drives"
Click Apply
* Then untick the same checkbox & click OK
This will prevent any reinfection from previous restore points.


To help protect your computer in the future I recommend that you get the following free programs if you do not already have them:

McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad.

SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

Spyware Guard to catch and block spyware before it can execute.

IE-SPYAD.EXE to block access to malicious websites so you cannot be redirected to them from an infected site or email. IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. This is a self-extracting .ZIP file, save it to your desktop. Once downloaded, double-click on it to extract the files inside (default dir is C:\IE-SPYAD)

• Now navigate to C:\ie-spyad. Double click to open it.
• From within the folder, double-click install.bat
• Select Option #2 - Install the new IE-SPYAD list, by typing 2
• Then return to the main menu.
• Select option #4 - Add the old porn sites domain, by typing 4

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles:

PC Safety and Security--What Do I Need?

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER
Understanding and Using Firewalls

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

-----------------------------------------------------

Follow the list above and the potential for infection will reduce dramatically.

[ohno]

Ried... Thank you so much! I am going through the list right now!!!

[Ried]

You're quite welcome--stay safe out there.