Malware Help

I must have downloaded something that has been creating havoc on my computer and hopefully has not spread spread through my network.
The malware changed my IE homepage and has several pop-ups telling me my computer is infected and that I should purchase a particular software. One was for Virusbuster. I have also been getting critical error messages in my system tray saying that I should download virus software.
I have a small office, 3 computers including a server.

I ran through the steps in the Read and Run First. There were several things detected but not cleaned. Here are my logs

 

Here are the rest of my log files.

Thanks very much for any help that can be given.

Chris

 

More

 

Download

- Pocket KillBox

Extract to its own folder somewhere that you will be able to locate later.

IMPORTANT: You should print or save the below locally, so you can refer to them while offline. You must exit all browsers before running the below steps and it would be best if you actually physically unplug your cable to the internet, reboot, and do not run anything but what I give you to do. Also it would be good to exit all processes and items in your System tray.

Do the above before continuing! Okay unplug your cable now.

Make sure you have rebooted in Normal Mode (do not open any other processes)



Run HijackThis. Click the 'Do a system scan only' button.


Once the scan has completed click Config

Click Misc Tools

Click Open Process Manager

Terminate the following processes by selecting them from the list and clicking Kill Process
NOTE: These may not all be running but we need to check

Click back to return to the scan results.

Place a checkmark in the box next to the following lines:

Click on the 'Fix checked' button. Wait for HijackThis to finish; close HijackThis.

Now run Pocket Killbox:

Paste the below filenames into KILL BOX one at a time. Check mark the box that says "Delete on Reboot" and checkmark the box "Unregister DLL" (If available) Click the RED X and it will ask you to confirm the file for deletion say YES and when the next box opens prompting you to reboot now...click NO...and proceed with the next file. Once you get to the last one click YES and it will reboot.

If Killbox does not reboot or you get a Pending Operations type error message just reboot your PC yourself.

Now boot into SAFE MODE

Open Windows Explorer navigate to and DELETE the following: (Some of these may have already been deleted by Pocket Killbox)

If you have Windows XP delete the contents of C:\WINDOWS\Prefetch.


REBOOT to Normal Mode.

Let me know how things are running now

Post a fresh HijackThis log, a fresh newfiles log and a fresh activescan log.

 

Thanks for the help so far. I followed all the posted steps. I am no longer receiving the pop-ups or the messages in the system tray.

The Panda Scan indicated that it found a lot of spyware.

Here are my new logs

 

What activescan found are coookies, killbox backups, and norton protected recycle bin files.

Empty the recycle bin.

fix the following line with HJT

What is orthocad, one of the files there has a name that is often associated with spyware but is probably legitimate.

 

Thanks very much.

OrthoCad is a professional software app. It has a part that I think runs as a service and checks for info downloads nightly.

A friend recommended that I purchase SpySweeper and install it. Should I? Would it find all the cookies that ActiveScan did? Are any of the cookies potentially harmful?

Overall, things are running much better and faster now. I really appreciate the help you have given.

 

OK lets not worry about orthocad then!

Your decision. Personally I say NO. I've never found the need to buy any AV, AS app or Firewall. The free programs out there are just as good if not better.

Please read this thread for the free alternatives and an explanation of cookies

How to Protect yourself from malware!