Going through Malware steps, java won't install

Hello, first thanks to you guys who run this place, I have been hit with a trojan, I think it is the ZLOB.videoactivexaccess, at least thats what AVG antispyware says it removed, along with virusprotectpro. I still keep getting the flashingwindows security looking bagde in the lower right toolbar with a popup that keeps saying "system alert" I may be infected (duh), when clicked it opens to virusprotectpro webpage.

Interestingly, I have three computers, all with Kapersky 6 antivirus, two machines killed the trojan, this one didn't. I have XP SP2.

Anyway, while doing the steps for malware removal on the dead machine, everything was going great till I get to step 6A, I used the recommended java removal tool, then tried to reinstall java6u2, but the computer won't let it get past the initial load, a windows alert window says something to the effect that the administrator has forbidden the operation. I have tried to download in safe mode and normal mode, online and download mode, using both administrator access and regular account access, still no luck. When I look at my control panel, it shows I still have a java control panal with java se6 version 1.6.0

Any ideas? Did I not get the old java out first? thanks.

 

Try going into Add/Remove Programs and uninstall them from here.

Unless something is corrupt you should be able to install the latest version.

Sun Java Runtime Environment 6 Update 2

 

Thanks big, just did that, now I'm back up with Java6u2 properly working. on to step 6b!

 

Good Deal!

I will be awaiting your logs. Just for a reference I will post the instructions below.

 

trojans: ZLOB, win32 agent bkd, videoactivexaccess infections

Hello, Attached are the files as requested by the malware removal guide. I did screw up the order as described below, i started over..

Thanks for being here guys.

Symptoms: Sony Viao desktop running XP SP2. Ad-Aware7, Spywareblaster, Kaspersky 6 antiVirus, Network magic network firewall. Office 2k with outlook and IE This is my first virus in 15 years of computers... 2 Other computers running this software are unnaffected.

Youngest son turned off Kaspersky 6 antiV while we were on a trip last week, came home to find a computer having lots of popups which looked amazingly like the windows security center requesting that I buy the recommended malware software from the following sites: virusprotectpro, websecuritypage. It would also rewrite my IEhome page to one of these two sites, then if you reset it to a different homepage, it would go back to the virus homepage. In the lower right corner on the lower windows bar, I have a red and blue flashing shield with a

and

, when selected it launches and goes to one of the above two webpages. If not selected, about every 1 minute, it popsup the following

When I try to close one of the virus webpages you would get a small popup window with "asD" in the title, below that it would say "release" then the button would say "OK", unlike the normal IE closing window which asks if you want to close all windows or just the one page.

I turned on and ran Kapersky 6 antivirus, which found a trojan.crytor, but it did not delete it. When I rebooted, kapersky was again offline, and evertime I shutdown, kapersky would be offline, once I sware it turned off by itself...

Thinking I was being hacked from outside, I unplugged the LAN, called all my financial folks and changed passwords. I ran Kaspewrsky again and best I can remember it found bad imsmain, svchost.exe, iemn.exe, but I didn't save it as the popups where going crazy, I went to Kapersky website and downloaded Kaspersky 7 internet and let it run. Again, it only found the same things mentioned above. I then came to majorgeeks and started doing the malware removal checklist.

Malware removal steps:
0: I followed the link and could see I had two of these so I removed them, sorry, I didn't keep track of which I removed.
1:Emptied the folders from kapersky, adaware, spywareblaster, downloaded ccleaner, emptied IE cashes/cookies
2:no problem
3:no problem
4:counterspy would not work, I used AVG antispyware
5:cleaning with ccleaner no problem.
sbybot S&D found a zlob.videoactivexaccess, it deleted/imunized, ran again and found nothing. I could not get counterspy to work.
I ran AVG, it found 6 cookies plus not-a-virus.exploit.multi.qtb.b and adware.qworke
6A: had problem reloading Java6u2, but finally did it. At this point it was late and I screwed up, I turned two pages on the malware removal text and toggled the system restore off... Then went to bed and came back and realized my mistake, so
Ran bitdefender 2 versions provided, once before the toggle restore and once after labeled bdscan2.
Panda scan, lost my LAN during scan, tried again next day, scan clean.
6B: did runkeys, newfiles, hijackthis, toggled system restore again. Files attached

6C, still have fake security badge in lower right window toolbar with X/? which continually flashes the "system alert"

I then ran trojanscan from emsi found nothing
I ran Kapersky online scan and it found: trojandownloader.win32.agent.bkd and asked if I would like to buy it to clean it!!

So whats up with that, I own Kapersky7, it didn't find it??

I figured I would give my version of Kaspersky7 internet another chance, updated it once again, ran it and it still only showed a quaranteened trojan.cryptor...???

While I was getting ready to right this topic, a small window popsup in the lower right from kaspersky saying that "zlob.videoactivexaccess is password protected: and before I could get to it and see what it was the alert went away, and the kaspersky mainwindow still shows nothing other than the previous fixed trojan.cryptor....

So I have something, I have no clue what it is, nor how I got it...

 

Re: trojans: ZLOB, win32 agent bkd, videoactivexaccess infections

rest of files

 

Re: trojans: ZLOB, win32 agent bkd, videoactivexaccess infections

last files

I just completed a third complete scan using my kaspersky 7, it found nothing, it says all threats have been neutralized, but it still shows two things detected, and I can't tell if they are deleted, one is

trojan.cryptor Running process: C:\WINDOWS\System32\svchost.exe

and

detected: riskware Hidden data sending Running process: C:\Program Files\Video ActiveX Access\imsmain.exe

 

Re: trojans: ZLOB, win32 agent bkd, videoactivexaccess infections

NEWS FLASH!!!:cool

So 20 minutes after I post the info below, Kaspersky7 all by itself finally gives a loud squeel as it finds a trojan and says it will be deleted on next restart, which, it shutdown by itself, restarted and deleted the following:

deleted: Trojan program Trojan-Downloader.Win32.Agent.bkd File: C:\WINDOWS\system32\xtsyynm.dll

The popup badge is now gone!!

However, when opening this webpage, I get a kaspersky proactive defense alert asking if I want to allow or deny the following, should Ilet it??:confused


Process is trying to create value in system registry key that belongs to group System Security.\These keys control computer security settings.


You are advised to grant access to these settings only if you are sure you want to allow these settings to be modified. Otherwise it is better to deny access.

Key: HKEY_USERS\S-1-5-21-1570277279-87681348-1836190843-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced

Value: Start_ShowNetConn_ShouldShow

New data(32-bit number):
0x00000042 (66)

 

First, please disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Pre-Instructions:
Please print out these instructions so that you can operate with All Browser Windows CLOSED.


Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 4:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 5: Begin here after rebooting from Step 5!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 6:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 7:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Thanks all, it's free of virus and working fats as ever.

A few last question, is there a way to know what the virus could have done as far as my info and is there a way to know how it got on my computer, where did it come from?

 

Please attach the following fresh logs so we can confirm you're clean.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

 

There isn't anyway to know what it has done, each infection does it own thing. Serious infections such as rootkits are more serious because they can potentially steal information such as passwords, user names, bank account numbers, etc; Certain infections such as these we recommend your changing passwords and such but in your case I think you're fine.

It's hard to say, it could have came from many different places such as malicious websites to P2P programs such as Limewire,Kazaa.

It's hard to pinpoint where it comes from because there is no way for me to find out what the user has done.

 

News flash, it's back looks like kaspersky picked this up:
deleted: Trojan program Trojan-Downloader.Win32.Agent.bkd File: C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP1\A0000011.dll

It is also finding some password protected file. I'll run all the steps again, post the files later.:confused

here is what kaspersky is also blocking every two or three minutes

8/18/2007 3:34:26 PM C:\WINDOWS\Explorer.EXE HKEY_USERS\S-1-5-21-1570277279-87681348-1836190843-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Start_ShowNetConn_ShouldShow 0x00000042 (66) 32-bit number Create blocked

 

That's because we haven't finished! You to flush your System Restore points. Please follow the instructions below:

• Disable and Re-enable System Restore
  
• Turn OFF System Restore to flush any bad Restore Points.
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

Once you complete the above, reboot once more and let me know how things are running and if any detections are being flagged.

 

bjgarick, I did flush, did the toggle of the restore, it's still here.

All steps run again, logs attached as requested, saved with the number 2 in the file name to show it's the second time.

Also, kaspersky keeps blocking this:

8/18/2007 8:22:05 PM C:\WINDOWS\Explorer.EXE HKEY_USERS\S-1-5-21-1570277279-87681348-1836190843-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Start_ShowNetConn_ShouldShow 0x00000042 (66) 32-bit number Create detected

 

rest of files

this is what kaspersky has detected/blocked

detected: riskware Trojan.cryptor Running process: C:\WINDOWS\System32\svchost.exe
detected: riskware Hidden data sending Running process: C:\Program Files\Video ActiveX Access\imsmain.exe
deleted: Trojan program Trojan-Downloader.Win32.Agent.bkd File: C:\WINDOWS\system32\xtsyynm.dll
deleted: Trojan program Trojan-Downloader.Win32.Agent.bkd File: C:\System Volume Information\_restore{47E7117B-18F3-4A10-B47C-105BED1BFF9B}\RP1\A0000011.dll

 

Are you familiar with Toro Ecxtra?

 

Yes, its software from toro to run the lawn sprinkler, some others that you may see are

moostro, wbid, used for work

sorry about the order, I evidently missed one of your replies, i'll go and look for that stuff right now.

 

First! you MUST disable any antivirus and/or antispy programs you have installed so they will not block this fix.

Pre-Instructions:
Please print out these instructions so that you can operate with All Browser Windows CLOSED.


Step 1:
Please look in Add/Remove Programs for the following and uninstall if found. If you get any errors just make a note and proceed.

Step 2:
Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

Again, make sure ALL browser windows are closed when you click FIX.

Step 3:
Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Step 4:
Now download The Avenger by Swandog46, and save it to your Desktop.

• Extract avenger.exe from the Zip file and save it to your desktop
• Run avenger.exe by double-clicking on it.
• Check the 'Input script manually' box.
• Click on the magnifying glass icon.
• Copy everything in the Quote box below, and paste it in the box that opens:

• Now click the 'Done' button.
• Click on the traffic light icon and OK the prompt.
• You will be prompted to restart, OK the prompt and your PC should reboot, if not, reboot it yourself.
• A log file from Avenger will be produced at C:\avenger.txt

Step 5: Begin here after rebooting from Step 4!
Next Reset Web Settings & Default Security Settings

Note for IE 6 users:
To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK

To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites. For IE 7 users, simply click the "Reset all zones to default level" button.

Note for IE 7 users:
Select Internet Options, then the Advanced Tab and then the Reset button under Reset Internet Explorer Settings.


Step 6:
Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.


Step 7:
After you have completed ALL of the above in the correct order, please attach the following logs.

• HijackThis Log
• ShowNew Log
• GetRunKey Log
• Avenger Log

Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Be sure you read closey and follow the previous instructions exactly as stated.

I think the reason you're getting the prompts from Kaspersky is possible because "svchost.exe" and "explorer.exe" are infected themselves. They are legit files and are a part of the WinXP OS however they can be infected.

If this is the case we will have to do further in depth cleaning.

Complete my previous post, reboot and attach the new logs. Let me know if you get more prompts from Kaspersky after you have completed the fix.

Also, be sure you SHUT DOWN Kaspersky before proceding with that fix.

Also, I think you need to uninstall Ad-Aware 2007 for now.

 

stuck on fixme.reg

OK, i'm stuck at fixme reg.

when I paste the block of text to notepad and save as all files to a folder or the desktop, when I look at the icon for it it looks like a reg file but when I click on it it opens with notepad only as a text file again. What now?

I searched the forum and seems fixme.reg is different everytime for each user, right?



adaware 7 uninstalled.

 

Re: stuck on fixme.reg

Right click and select merge, click ok at the prompt. Be sure you add the .REG extension.

Yes! It's based on what you have that needs removed.

 

bj, sorry, but when I copy the text, then open notepad, paste the text, then save as all files, then right click on the fixme.reg icon which looks like little blocks, click on merge, it opens as a notepad.

There is no option given, it just opens as a notepad. When I save as all files, there is another set of options given during the save: ansi, unicode, utf-8, whatever those are... It defaults to ansi.


???

 

on a side note, something is still not right, when I go into internet tools to select homepage default and try to change it, it now always adds a http:/// at the bottom.

I'm doomed.:confused

 

Okay! Attach new logs from ShowNew, GetRunKey and HijackThis.

 

here ya go.

I think my previous post is erronious about internet homepage, it appears when you delete a homepage, it leaves a blank window, with http:/// in the homepage default window.

 

OK, I guess I'm being the clown act.

I just tried again to open fixme.reg, but right clicked and tried "open with" it gave an option as text or xml editor. I selected xml editor andf another window opened and asked if i would like to run fixme,reg, for whatever reason I clicked yes and it ran.

Do I get my red nose and big black shoes now, or did this put the fixme into the reg?

 

Reboot into Safe Mode and manually locate the folder below.

If you locate it, hold shift and press delete.

C:\Program Files\Video ActiveX Access

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fixme1.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fixme1.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Once you complete the above, reboot back to normal mode and run then run the below utility.

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log to your next reply

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

 

BJ, I can't find any file or folder in programs with the name C:\Program Files\Video ActiveX Access. A search of windows found no video activex files.

In safe mode, the fixme1.reg icon opens just like it does in normal mode, as a text notepad, it does not prompt me to merge or add or run or nothing, just opens like when I pasted it. When I merge, it opens as a text notepad. When I right click on it, it gives me the option to open with notepad or xml editor, do I want to do the xml thing? When I look at properties of the file, it says it will open with notepad, should I change something there?

 

Download the attached file, save to desktop, extract and double click. What does it do?

If it says it merged, try my previous fixme.reg again and let me know how it goes.

 

It opens as a notepad text window with the text for the .reg stuff, no merge...

if I right click and select merge, it opens as a text notepad.

 

Click Start > Run > type control folders and press ENTER.

When it open, click the File Type tab and scroll down to the REG extension. Make sure this is set to open with Registry Editor. If it is not then modify it to open with Registry Editor.

If you do not have a REG extension in the list, create it and have it open with Registry Editor.

Let me know how this works.

 

I can get to control folders/file type and see the .reg and it opens with notepad, there is no option for registry editor, I have all sorts of others such as xml editor, word, powerpoint, excel, etc.... No registry editor, how do I get one of those? How did I loose that?

this keeps getting blocked by kaspersky...

8/20/2007 10:17:45 PM Process C:\WINDOWS\explorer.exe (PID: 2616): suspicious action. Attempt to create computer security settings (key HKEY_USERS\S-1-5-21-1570277279-87681348-1836190843-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, value Start_ShowNetConn_ShouldShow, data 0x00000042 (66)).

 

In Folder Options, go back to the REG extension, select it and click the CHANGE button. When it opens the click the browse button and enter "C:\WINDOWS\regedit.exe" and press enter.

This should set Registry Editor to open REG files. Let me know how this works.

As I've said previously, I think this is due to Explorer being infected, for this we will have to configure Kaspersky to scan from Safe Mode and a few more options we will have to configure. This scan will take hours to run, you will have to leave it running.

I will write the instructions for this now and post it in my next post. Go ahead and be sure it's updated!

 

Since I do not have Kaspersky I will post the instructions below on configuring it for this scan. These settings are from version 5.0, some things may be a little different. If they are let me know!

Click Settings > Configure On-Demand Scan Settings and Set Scan Level to Maximum > Perform Recommended Action > OK

NOW, Close ALL Programs (including Kaspersky) and Browsers!

Physically Disconnect from the Internet - Pull the Cable!!

Boot into SAFE MODE

OPEN Kaspersky BUT DO NOT RUN IT YET!!!

Open Task Manager (Ctrl-Alt-Del) and RightClick explorer.exe and END IT! Don't be alarmed when all of your desktop items disappear. That is normal.

Everything will go blank except for Kaspersky and Task Manager. DO NOT CLOSE THEM!!

Now : Start a FULL SYSTEM SCAN. Click the Protection Tab and select Scan My Computer .


This process may take HOURS . . . . LET IT RUN!

When the Scan and Cleanup are done, go to Task Manager and select File / New Task and type explorer.

Close Kaspersky and TaskManager and reboot to Normal Windows and let me know how things look! Also, if you can get a log from this scan, please attach it to your next post.

 

OK, I can now get reg to work, thanks so much, and while doing that about every 5 seconds the kaspersky kept blocking that IE security change, it knows your coming for it!!!

I clicked on your fixme1.reg and it was loaded.

Now what? Do you want me to do the other fixme's or do the kaspersky thing?

I am going to be off on a business trip for three days, so I may not get back to you after tommorrow morning.

Take a long time? Heck, every scan takes an hour... No problem!!

 

You need to run run the Kaspersky ASAP because delaying the scan may allow things to come back and/or mutate in which case we would have to start over again.

You can go back and do the all the reg fixes from my previous posts just to be sure you got them.

 

BJ, combofix scan attached, scanned after run of all those fixme reg files, and before kaspersky scan.

Kaspersky scan took almost three hours to run in safeboot mode, it found nothing, BUT, i looked at the results and it LOOKS like it skipped a bunch of archived and embedded files. I would attach it but it's 45,900kb!! Did it skip those files?

example:

8/24/2007 2:13:31 PM File: C:\Documents and Settings\Scott & Lisa\My Documents\18-7 kagee mtg.doc archive Embedded
8/24/2007 2:13:31 PM File: C:\Documents and Settings\Scott & Lisa\My Documents\18-7 kagee mtg.doc//1Table ok scanned
8/24/2007 2:13:31 PM File: C:\Documents and Settings\Scott & Lisa\My Documents\18-7 kagee mtg.doc ok scanned
8/24/2007 2:13:31 PM File: C:\Documents and Settings\Scott & Lisa\My Documents\18-7.doc archive Embedded

What now?

 

Those are fine, I was wrong about the Explorer being infected. Everything looks fine from this point, the prompt from Kaspersky is something you need to allow.

Are you have any further malware problems?

 

None! I was wondering that myself, I'll start allowing the ie prompt.

Thanks for your help!!! Anything else I should do?

 

Oh, and sons computer is free after restoring, thanks again BJ!

Is there a place to donate for you guys or the website?

 

This is what kaspersky keeps blocking, since kaspersky is blocking it automatically, how do i go and tell it to let it go?its the proactive defense thats blocking this, can't figure how to allow it???

8/25/2007 11:07:00 AM C:\WINDOWS\Explorer.EXE HKEY_USERS\S-1-5-21-1570277279-87681348-1836190843-1005\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Start_ShowNetConn_ShouldShow 0x00000042 (66) 32-bit number Create blocked

as an asside, could you guys increase the time to edit a post, it would sure keep down multiple posts for same topic? thanks again

 

If you are not having any other malware problems, it is time to do our final steps:

1. If we used Pocket Killbox during your cleanup, do the below
   • Run Pocket Killbox and select File, Cleanup, Delete All Backups
2. If we used ComboFix, you can delete the ComboFix.exe file, C:\ComboFix folder, C:\QooBox folder, C:\WINDOWS\nircmd.exe, and the C:\combofix.txt log that was created.
3. If we used SDFix you can delete all the SDFix related files and folders from your Desktop or whereever you installed it.
4. If we used SmitFraudFix, you can delete all files and folders related to it now including the c:\rapport.txt log.
5. If we used VundoFix, you can delete the VundoFix.exe file and the C:\VundoFix Backups folder and C:\vundofix.txt log that was created.
6. If we had your run FixWareOut, you can delete the Fixwareout.exe file and the C:\fixwareout folder.
7. If we had you run Avenger, you can delete all files related to Avenger, the log (avenger.txt) and C:\avenger.
8. If we had you download any registry patches like fixme.reg, fixme1.reg or fixWLK.reg (or any others), you can delete these files now.
9. You can delete the ShowNew.Zip and GetRunkey.Zip files and the files that you extracted from the ZIP files. You can also delete the C:\newfiles.txt and C:\runkeys.txt logs that were created
10. If you are running Windows XP or Windows ME, do the below:
    • go back to step 8 of the READ & RUN ME to Disable System Restore which will flush your Restore Points.
    • Then reboot and Enable System Restore to create a new clean Restore Point.
11. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Your Welcome!

No, we don't accept donations anymore.

If you want to support this site you can buy a Majorgeeks t-shirt or sweatshirt. Also, an email of appreciation to the owners (see there names and email addresses here: http://www.majorgeeks.com/page.php?id=2 ) is always appreciated. Also send your friends here.

 

As I've said before I don't use Kaspersky so I'm not familiar with the settings. I would just look around and see if I could fine. You may want to Google it or try looking on Kaspersky's website. Also, the Software Forum may be able to answer this question?

You can e-mail the owners and request it, I'm not over that part.
http://www.majorgeeks.com/page.php?id=2