Multiple xp problems

[Ried]

Hi gsf,

Click START…RUN…Type in regedit. Make sure just "My Computer" is showing in the left pane and click..FILE….EXPORT…and save a copy some were in case you make a mistake. Now navigate to the following keys and delete the file/folder/entry I highlighted in RED

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ TV Media]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared
Tools\MSConfig\startupreg\ TV Media]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\App Management\ARPCache\ TV Media]


If the above registry keys are giving you problems deleting, right click on them and click on Permissions. Then click on the Advanced button. Make sure the first box (Inherit from parent...) is checked. Click OK and OK. Then try deleting the entry again. Once you're done, close the Registry Editor.

Please post the results of the Panda scan, its seems you copy/pasted the Regsrch files twice.

Also, make sure you turn off WordWrap, it's difficult to read when it's in that format.

Your questions are not an imposition, my friend. There just is not a simple answer. Training and experience, in addition to your clear and full description of the problems this PC was having, led me to choose the tools I did, which then revealed what didn't belong.

[galefly]

Ried,

1.Regedit deletions went ok but the first two seemed identical to me. Am I missing something?

2. The following is the Panda file from 3/16/06 that i failed to post

Incident Status Location

Adware:adware/tvmedia Not disinfected C:\Documents and Settings\Brenda\Application Data\tvmcwrd.dll
Adware:adware/ncase Not disinfected C:\WINDOWS\didduid.ini
Adware:adware/sidesearch Not disinfected C:\PROGRAM FILES\Lycos
Adware:adware/xupiter Not disinfected C:\Documents and Settings\Brenda\Favorites\Inernet
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@ads.pointroll[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@tribalfusion[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.mediaplex.com/]
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.advertising.com/]
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.2o7.net/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.atwola.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.ads.pointroll.com/]
Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[.questionmarket.com/]
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Application Data\Mozilla\Firefox\Profiles\b3d10u8h.default\cookies.txt[]
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@ads.pointroll[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@tribalfusion[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brenda\Desktop\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brenda\Desktop\l2mfix.exe[Process.exe]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\You have successfully updated your password\new-password.zip[new-password.htm .scr]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\YOUR ACCOUNT IS SUSPENDED FOR SECURITY REASONS\email-details.zip[email-details.htm .exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\HJT\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\HJT\l2mfix.exe[Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-2818146379-640212105-3790383986-1005\Dc1\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\SYSTEM32\Process.exe
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\You have successfully updated your password\new-password.zip[new-password.htm .scr]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\YOUR ACCOUNT IS SUSPENDED FOR SECURITY REASONS\email-details.zip[email-details.htm .exe]

Thanks again, gsf

[Ried]

Hi gsf,

Download Hoster
Run Hoster.exe.
Click "Make Hosts Writable?" in the upper right corner (If available).
Click Restore Original Hosts and then click OK.
Click the X to exit the program.

----------------------------

Reboot into Safe Mode.

----------------------------

Uninstall the following via the Add/Remove Panel (Start->(Settings)->Control Panel->Add/Remove Programs) if it exists:

Lycos

----------------------------

Delete the following files/ folders:

C:\Documents and Settings\Brenda\Application Data\ tvmcwrd.dll
C:\WINDOWS\ didduid.ini
C:\PROGRAM FILES\ Lycos
Search for these via Start>Search>All files and folders:
Personal Folders\Inbox\COMPUTER\ Your Account is Suspended For Security Reasons
Personal Folders\Inbox\COMPUTER\ You have successfully updated your password

----------------------------

Clear Firefox cookies: Tools>Options>Privacy>Cookies>Clear

Clear Internet Explorer Cookies: Launch Internet Explorer>Tools>Internet Options>Delete Cookies

----------------------------

Reboot into Normal Mode.

----------------------------

Please go to Microsoft and download all the critical updates.

Run another scan at Panda and post the results here.

Yes, I did duplicate the one registry entry, my apologies.

[galefly]

Ried,

1. Hoster done
2. Lycos not in add/remove
3. could not locate c:\window\didduid.dll
4. I did not understand the "Personal Folders... " instructions...what am iI missing?
5. Cleared all cookies
6. All MS critical updates applied

7. Panda follows...

Incident Status Location

Adware:adware/ncase Not disinfected C:\WINDOWS\didduid.ini
Adware:adware/xupiter Not disinfected C:\Documents and Settings\Brenda\Favorites\Inernet
Adware:adware/sidesearch Not disinfected C:\Documents and Settings\Brenda\Application Data\Lycos
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@ads.pointroll[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@tribalfusion[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@ads.pointroll[2].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@tribalfusion[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brenda\Desktop\Gales Stuff\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brenda\Desktop\Gales Stuff\l2mfix.exe[Process.exe]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\You have successfully updated your password\new-password.zip[new-password.htm .scr]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\YOUR ACCOUNT IS SUSPENDED FOR SECURITY REASONS\email-details.zip[email-details.htm .exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\HJT\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\HJT\l2mfix.exe[Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-2818146379-640212105-3790383986-1005\Dc1\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\SYSTEM32\Process.exe
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\You have successfully updated your password\new-password.zip[new-password.htm .scr]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\YOUR ACCOUNT IS SUSPENDED FOR SECURITY REASONS\email-details.zip[email-details.htm .exe]

[galefly]

Ried,

I started to think about the Inbox thing and figured out what you wanted. I deleted both messages and then deleted them from the "Delete" folder. this was done after the Panda run.

[Ried]

Hi gsf,

These programs will help reduce the number of cookies placed on this system:

Download SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.

Download IE-SPYAD.EXE to block access to malicious websites so you cannot be redirected to them from an infected site or email. This is a self-extracting .ZIP file, and save it to your desktop. Once downloaded, double-click on it to extract the files inside (default dir is C:\IE-SPYAD)
From within the folder, double-click install.bat
Select Option #2 - Install the new IE-SPYAD list, by typing 2
Then return to the main menu.
Select option #4 - Add the old porn sites domain, by typing 4

I deleted both messages and then deleted them from the "Delete" folder. this was done after the Panda run.

I'll need you to run another scan at Panda and post the results here once more. How is the system behaving now?

[galefly]

Panda 032306


Incident Status Location

Adware:adware/ncase Not disinfected C:\WINDOWS\didduid.ini
Adware:adware/xupiter Not disinfected C:\Documents and Settings\Brenda\Favorites\Inernet
Adware:adware/sidesearch Not disinfected C:\Documents and Settings\Brenda\Application Data\Lycos
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@2o7[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@ads.pointroll[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@com[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@tribalfusion[2].txt
Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@2o7[2].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@ads.pointroll[2].txt
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@com[1].txt
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Brenda\Cookies\brenda@tribalfusion[2].txt
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brenda\Desktop\Gales Stuff\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Brenda\Desktop\Gales Stuff\l2mfix.exe[Process.exe]
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]
Potentially unwanted tool:Application/Processor Not disinfected C:\HJT\l2mfix\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\HJT\l2mfix.exe[Process.exe]
Potentially unwanted tool:Application/Processor Not disinfected C:\RECYCLER\S-1-5-21-2818146379-640212105-3790383986-1005\Dc1\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\SYSTEM32\Process.exe
Virus:W32/Mytob.FK.worm Not disinfected Personal Folders\Inbox\COMPUTER\Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]

The system is running fine, they are ready to be rid of me.
Thanks again, Ried

[Ried]

Well, they get to enjoy your company just a bit longer.

This folder is still turning up infected. It's odd that a full path isn't being shown. Where did you find this last time?

Personal Folders\Inbox\COMPUTER\ Your Account is Suspended For Security Reasons\fufriv.zip[fufriv.doc .pif]

Look through the COMPUTER folder listed above. Delete anything similar to the entry I've marked in red.

Delete the following:

C:\WINDOWS\didduid.ini
C:\Documents and Settings\Brenda\Favorites\Inernet
C:\Documents and Settings\Brenda\Application Data\Lycos

[galefly]

Ried,

This time I found them all and carried out all instructions. I did not run Panda.

Are we through? It was a mess wasn't it?

Many thqnks, gale fly

[galefly]

Ried,

Somewhere early on in this endeavor i installed AVG Free and add/removed Symantec. My client complained yesterday about problems with incoming email not being delivered ("rejected", whatever that means). I noticed that there are remnants of Symantec in add/remove and i cannot get rid of it all. Got any suggestions? As you can see I am a bit short of facts at this point. The party who tried to send the email received a message from Norton that included "cannot route mail to user (xxxxx@yyyy.com)". This user is in the group and has never had trouble receiving emial before. Got any ideas? Some other forum?

thanks, gale

[Ried]

Hi gale,

Symantec doesn't always uninstall cleanly. If the version of Norton uninstalled was 2004 or later, please download and run SymNRT.

Delete the following folders if present:
C:\Program Files\ (Delete all folders beginning with Norton or Symantec.)
C:\Program Files\Common Files\Symantec Shared
C:\Documents and Settings\All Users\Application Data\Symantec

------------------------------

If you had Norton Internet Security. Use the uninstallers below (choose the uninstaller for the version you have):

NIS 2005 Uninstaller

NIS 2003 Uninstaller

If you still have difficulty, post another HijackThis log so I can take a look at the Services. Let me know how it goes.

**Your friend will need a Firewall. Please download ZoneAlarm Free

[galefly]

Ried, (please notice that it has been days since i referred to you as Neil)

I ran into a problem... the Symantec product was "Norton Anivirus 2006". I am also running PCAnywhere and Ghost on this PC and the tool wants to remove them all. I don't see any strong incentive to pursue this further, do you?

I assume that you guys prefer Zone Alarm over the Windows Firewall, right?

thanks, gsf

[Ried]

Hi gale,

Has the e-mail issue been resolved? If so, then I would concur that there is no need to pursue this further.

Regarding ZoneAlarm over Windows Firewall, it really is user's choice. Some of us do use ZA, others are fine with Windows Firewall. As long as you have multi-layered protection installed, Windows Firewall should suffice. (refer to my links in previous post for IESpyAd and Spyware Blaster. See below for additional free programs)

Let's wrap this up.

Reset hidden/system files and folders
Windows XP
===============
Click Start.
* Open My Computer.
* Select the Tools menu and click Folder Options.
* Select the View tab.
* Deselect the Show hidden files and folders option.
* Select the Hide file extensions for known types option.
* Select the Hide protected operating system files option.
Click Yes to confirm.
Click OK.

Enable Windows Auto Update
*Go to Start>Run - type wuaucpl.cpl
*Tick on the checkbox - "Keep my computer up to date"
*Under Settings, choose "Automatically download the updates, and install them on the schedule that I specify".
Click on "OK".

Create a new System Restore point
Click Start >> Run - type SYSDM.CPL & press Enter
* Select the System Restore Tab
* Tick on the checkbox - "Turn off System Restore on all drives"
Click Apply
* Then untick the same checkbox & click OK
This will prevent any reinfection from previous restore points.

In light of your recent issue, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles:

HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein
THE ANTI-SPYWARE TUTORIAL
MAKING INTERNET EXPLORER SAFER

Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly.
For a tutorial on Firewalls and a listing of some available ones see the link below:
Understanding and Using Firewalls

More information and free downloads are available at the following links:

Download Spyware Guard to catch and block spyware before it can execute.


Download Spybot Search & Destroy 1.4 Run Spybot and click on the 'Search for Updates' button. Install any updates that are available. Now click Mode menu and choose 'Advanced Mode'. Next click on Immunize to your left. Click the Immunize button on top to Immunize your computer - you should do this each time there is an update. Click 'Check for Problems' and fix all the entries, which are indicated in RED.

Download Adaware SE and install it if you don't have it already. Make sure it's the newest version and check for any updates before running it. Go to this Site to get the plug-in for fixing VX2 variants. Also make sure to Customize the settings in Adaware for better scan results. Run the scan and fix everything that it finds.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.