some quick hjthis help please

I'm trying to help my auntie out. She isnt real computer literate so I have to post her log for her. I went through all your suggested spyware steps with her. So I'm going to post her log. If someone could look it over. She was having major issues with spyware said she figured she had a worm or something because it was hiding files and shit in her folders.

Anyway if someone could look this over that'd be great. Thanks.

 

Do you still use Norton AntiVirus? If not, uninstall it!

First:
Download LSP-Fix

After download is complete, Run LSP-Fix

Check the Box labeled "I know what I'm doing" and then click on the winsflt.dll file (in the “Keep” section) to select it.

Then, Select the >> button to move winsflt.dll into the Remove section.

Now, click the Finish Button. When the Repair Summary box appears, click OK.

(Note: If the file winsflt.dll is already in the remove section, then just click FINISH.)


Second:
Please close ALL browsers while running Hijack This!

C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE
C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

Third:
You did not run the online virus scans, so run these and post your results!

TrendMicro Online Scan
Bitdefender online scan
RavAntivirus online scan <-- select Auto Clean then click Scan My PC
TrojanScan online scan

After doing the above, post a new HJT log.

 

ok give me some time I will have her do that. thanks.

 

Good Luck!

 

Shes having some major issues i might not have this done untill tommorrow. She is saying everytime she tries to go online internet explorer is crashing. She also can't get on msn so I can send her this winsock fix thing. So I don't know what we are going to do but we're calling it a night so hopefully I'll have some info to post tommorow. Talk to you soon. Thanks.

 

Download it and put it on a disk, download it from her machine. Try to follow every step so we can get this thing nailed.

Also, we got more work to do so keep me up-to-date with that you do and the results.

 

she can't get on the internet anymore for any of your programs or anything I think shes right ****ed so i told her to take it to a professional. thanks for the help.

 

We are professionals

So we're not finishing the fix?

 

ok we got her back on the internet and will follow through your steps so i am preparing you for a post.

 

After doing all of the steps I previously mentioned, post me a current HJT log.

 

ok she says she used the lsp fix but that file didnt show up

i read on the net that if you cant get online then to go in delete winsock2 from registry and reinstall the communications tab from the windows components so i had her do that maybe that got rid of it i duno.

she did the first two scans with 0 results and was unable to use the bottom 2 scans.

she says she can't get onto secure sites for some reason liek www.cibc.com

outlook express is asking for a dial up connection

and when they open folders with things in them the windows aren't displaying anything


her log is attached.

thanks

 

Im only going to say this once, if you do not know what your doing, Dont do it!

Deleting that key not only breaks the LSP Chain it removes part of it. Please follow my instructions step by step and dont do anything unless I request it.

Now allow me a moment to check your log and post you a fix.

 

One of the first thing that I see in your log is that your OS and IE are out dated. After we get your system clean I recommend your going to Windows Updates and getting updated!

Now scan with HijackThis and Check the Boxes for the following:

Make sure All Browser Windows are Closed when you Click FIX.

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2CFB52FD-7CF2-479C-BF65-B27F8A834F31} (SecureSession Class) - http://www.samsungtechwin.com/include/pki/SecuiTechIE.cab

NEXT:
Run CCleaner and Spybot S&D and have Spybot fix what it finds.
Note: Dont forget to update Spybot S&D by selecting "Search For Updates"

FINAL STEP

Reset Web Settings & Default Security Settings:


To Reset Web Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK.

If you do not have an Internet Explorer icon on your Desktop, click Start, Control Panel (for some systems it may be Start, Settings, Control Panel), Internet Options, Programs tab and then click "Reset Web Settings". Now go back to the General tab and set your home page address to something useful like www.majorgeeks.com. Click Apply. Click Delete Cookies, Click Delete Files and select Delete all Offline content too, Click OK. When it finishes Click OK


To Default Security Settings:
Right click on your desktop Internet Explorer icon and select Properties. Then click the Security Tab and click Default Level for Internet, Local Intranet, Trusted Sites, and Restricted Sites.

Are you having any further problems? Your log isnt that bad at all.