Please Help with HJT log

All steps run and cleaned the other day, then I found out that having the pc split into different names can cause problems. Here is the HJT log from a seperate name. Any help would be appreciated. I hope I have done this correctly- if I have not please let me know what I need to correct.

Thanks-

 

I also need the logs from the 2 online scans.

 

Ooops I'm sorry. Bitdefender found nothing. Will attach the Panda Scan. I apologize.

 

Please see the below thread on how to install and run Spy Sweeper. Be sure your run CCleaner before running Spy Sweeper!

Running Spy Sweeper...

 

Thanks for the quick response. Here is the information you requested.

 

Please see the below thread on how to install and run Ewido Security Suite.

Running Ewido Security Suite ...

 

Next steps completed. I had to run Ewido in Normal Mode as personal settings would not load in Safe Mode, but I did unplug DSL. Also, power went out when running scan. (It's just not my day) I restarted once power returned.

:::sigh:::
-Amy

 

Please EXTRACT HijackThis from the ZIP File to a Safer location. Here's how:

To create a new folder:

• Click START > My Computer > Local Disc C: > Program Files
• Now, Right Click on an Empty Area and select New > Folder & name it HijackThis and ENTER

To Extract HijackThis:

• Now, Right Click your HijackThis ZIP File and select Extract All > Next > and browse to your newly created HijackThis Folder
• (C:\Program Files\HJT) and click Next.

The reason HJT needs its own safe folder is so that backups will be safely preserved. That way, if a mistake is made in the removal process, the mistakenly deleted entry can be restored.

After you have completed the above steps to relocate HJT, procede with the fix below...

Now, please look in Add or Remove Programs for the following and Uninstall them if found:

Ewido

Spy Sweeper

Now scan with HijackThis and check the boxes for the following entries:
( Make sure ALL browser windows are closed when you click FIX )

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

O4 - HKCU\..\Run: [kwrr] C:\PROGRA~1\COMMON~1\kwrr\kwrrm.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{34F71AB4-5F38-4882-8804-AE88F885FEBC}: NameServer = 166.102.165.13 166.102.165.11
O17 - HKLM\System\CCS\Services\Tcpip\..\{7DD35BB4-8295-487F-820D-48547AC94434}: NameServer = 205.188.146.145
(Keep this if you know them)

Again, make sure ALL browser windows are closed when you click FIX.

Now, Please boot into Safe Mode, be sure you have the Viewing of Hidden Files & Folders Enabled per the tutorial. Now, navigate to and DELETE the following if they should remain:

C:\Program Files\Common Files\kwrr ← Delete this whole folder if it exist!

Next, run CCleaner to clean up cookies and temp files.

Run full scans with Ad-Aware SE & Spybot S&D and have both programs fix what they find.
Note: Remember to get all updates before doing the scans.

Then, as an added precaution, Go to Start > Run and type: cleanmgr and then click OK. Make sure the boxes for these are checked:

• Temporary Files
• Temporary Internet Files
• Recycle Bin

And Click OK.

Finally, I would like you to flush your System Restore points. Please follow the instructions in the below:

• Disable and Re-enable System Restore
  
  
• Turn OFF System Restore to flush any bad Restore Points.
  
  
• Then, follow the instructions at the bottom of the linked page to Re-enable the Restore Utility which will create a fresh restore point.

Reboot, Scan with HijackThis and attach the new log.
Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now.

 

Computer seems to be running well. I had some problems completing the steps given. I couldn't update the spyware programs as I was unable to connect to the DSL in safe mode. I also was unable to run cleanmgr as it wouldn't allow me to type. Everything else was completed as specified.

Thanks-
Amy

 

Your HJT log is clean, to confirm nothing else is hiding please see the below thread...

Running WinPfind by OldTimer

 

Here's the log. Sure hope it's clean.

 

Download Pocket KillBox

• Save it to your desktop or a place easy to find.
• Do not run it yet

Copy the contents of the below Quote Box to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file fix.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.) Then double-click on the fix.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to Add in to the registry, say yes.

Locate PocketKillbox
(Procede with this step even if they do not show in blue)

Now, Copy and Paste C:\WINDOWS\psc3d into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click NO.

Now, Copy and Paste C:\WINDOWS\system32\batxexps.exe into the box – If it exists, it will show up in Blue. Check the option to Delete on Reboot and Click the Red X and Yes to the confirmation message. A message will ask if you want to reboot now – Click YES and allow your PC to reboot.

• If you get an error message about Pending Operations, just reboot your computer manually.

After you complete the above, let me know how things are running.

 

My desktop loaded at the speed of light! Thank-you, thank-you, thank-you!
One last question. The pc is broken down into 3 names. Did this take care of everything for all 3?

 

For the infections yes, but for temp files, cookies etc; no it doesn't. What you should do is run CCleaner, Ad-Aware & Spybot on each user account and have it fix anything it finds. CCleaner should be ran on each account, the others are up to you.

 

Thanks again for all your help. I figured better safe than sorry and ran Ad-aware, Spybot and CCleaner on all accounts. The only thing found is attached.

 

Those are no biggie, just MRU's. Everytime you open IE you will get these, just run CCleaner or a drive cleaner and you will be ok.

You should see this article on How to Protect yourself from malware!

Surf Safely!