Infected by Vesbiz downloader
-
Re: Infected by Vesbiz downloader
No problem with the link this time. Here are the logs. Today no virus, not even ad ware, were detected (scanned by AVG, Spy Sweeper and XoftSpy). I manually check for new files every day in C:, C:\Windows and C:\Windows\system32. I found :
C:\ad.exe 134 KB
C:\iesetup6b.exe 134 KB
C:\Windows\ieuninst.exe 34KB
Nothing in system32 and everything seems to be running fine. I also check for new programs and every day i have to uninstall Media Pass. I think this is the program that kept opening IE and directing it to different pages. This has been stopped by the firewall.
/--------------------------------------------------------------\
| Trend Micro Sysclean Package |
| Copyright 2002, Trend Micro, Inc. |
| http://www.trendmicro.com |
\--------------------------------------------------------------/
2005-03-03, 11:20:48, Auto-clean mode specified.
2005-03-03, 11:20:48, Running scanner "C:\Archivos de programa\Scanner\TSC.BIN"...
2005-03-03, 11:23:12, Scanner "C:\Archivos de programa\Scanner\TSC.BIN" has finished running.
2005-03-03, 11:23:12, TSC Log:
Damage Cleanup Engine (DCE) 3.9(Build 1020)
Windows XP(Build 2600: Service Pack 2)
Start time : jue mar 03 2005 11:20:49
Load Damage Cleanup Template (DCT) "C:\Archivos de programa\Scanner\tsc.ptn" (version 536)
[success]
Complete time : jue mar 03 2005 11:23:12
Execute pattern count(1990), Virus found count(0), Virus clean count(0), Clean failed count(0)
2005-03-03, 11:27:23, An error occurred while scanning file
"C:\WINDOWS\system32\config\system.LOG": Acceso denegado.
2005-03-03, 11:27:23, An error occurred while scanning file
"C:\WINDOWS\system32\config\software.LOG": Acceso denegado.
2005-03-03, 11:27:23, An error occurred while scanning file
"C:\WINDOWS\system32\config\default.LOG": Acceso denegado.
2005-03-03, 11:27:23, An error occurred while scanning file
"C:\WINDOWS\system32\config\SAM.LOG": Acceso denegado.
2005-03-03, 11:27:23, An error occurred while scanning file
"C:\WINDOWS\system32\config\SECURITY.LOG": Acceso denegado.
2005-03-03, 11:27:24, An error occurred while scanning file
"C:\WINDOWS\system32\config\DEFAULT": Acceso denegado.
2005-03-03, 11:27:24, An error occurred while scanning file
"C:\WINDOWS\system32\config\SECURITY": Acceso denegado.
2005-03-03, 11:27:24, An error occurred while scanning file
"C:\WINDOWS\system32\config\SOFTWARE": Acceso denegado.
2005-03-03, 11:27:24, An error occurred while scanning file
"C:\WINDOWS\system32\config\SYSTEM": Acceso denegado.
2005-03-03, 11:27:24, An error occurred while scanning file
"C:\WINDOWS\system32\config\SAM": Acceso denegado.
2005-03-03, 11:39:12, An error occurred while scanning file "C:\Documents and
Settings\NetworkService\ntuser.dat.LOG": Acceso denegado.
2005-03-03, 11:39:12, An error occurred while scanning file "C:\Documents and
Settings\NetworkService\ntuser.dat": Acceso denegado.
2005-03-03, 11:39:13, An error occurred while scanning file "C:\Documents and
Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat":
Acceso denegado.
2005-03-03, 11:39:13, An error occurred while scanning file "C:\Documents and
Settings\NetworkService\Configuración local\Datos de
programa\Microsoft\Windows\UsrClass.dat.LOG": Acceso denegado.
2005-03-03, 11:39:15, An error occurred while scanning file "C:\Documents and
Settings\ULF\ntuser.dat.LOG": Acceso denegado.
2005-03-03, 11:39:15, An error occurred while scanning file "C:\Documents and
Settings\ULF\ntuser.dat": Acceso denegado.
2005-03-03, 11:42:23, An error occurred while scanning file "C:\Documents and
Settings\ULF\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat": Acceso
denegado.
2005-03-03, 11:42:23, An error occurred while scanning file "C:\Documents and
Settings\ULF\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG":
Acceso denegado.
2005-03-03, 12:27:18, Running scanner "C:\Archivos de programa\Scanner\VSCANTM.BIN"...
2005-03-03, 13:17:54, Files Detected:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 3/3/2005 12:27:21
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 462 (91647 Patterns) (2005/03/02) (246200)
Command Line: C:\Archivos de programa\Scanner\VSCANTM.BIN /NBPM /S /CLEANALL
/LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Archivos de
programa\Scanner
95565 files have been read.
95565 files have been checked.
71250 files have been scanned.
120140 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 3/3/2005 13:17:54
---------*---------*---------*---------*---------*---------*---------*---------*
2005-03-03, 13:17:54, Files Clean:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 3/3/2005 12:27:21
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 462 (91647 Patterns) (2005/03/02) (246200)
Command Line: C:\Archivos de programa\Scanner\VSCANTM.BIN /NBPM /S /CLEANALL
/LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Archivos de
programa\Scanner
95565 files have been read.
95565 files have been checked.
71250 files have been scanned.
120140 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 3/3/2005 13:17:54 50 minutes 27 seconds (3027.26 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2005-03-03, 13:17:54, Clean Fail:
Copyright (c) 1990 - 2004 Trend Micro Inc.
Report Date : 3/3/2005 12:27:21
VSAPI Engine Version : 7.000-1004
VSCANTM Version : 1.1-1001
Virus Pattern Version : 462 (91647 Patterns) (2005/03/02) (246200)
Command Line: C:\Archivos de programa\Scanner\VSCANTM.BIN /NBPM /S /CLEANALL
/LAPPEND /LD /LC /LCF /NM /NB /C /ACTIVEACTION=5 C:\*.* /P=C:\Archivos de
programa\Scanner
95565 files have been read.
95565 files have been checked.
71250 files have been scanned.
120140 files have been scanned. (including files in archived)
0 files containing viruses.
Found 0 viruses totally.
Maybe 0 viruses totally.
Stop At : 3/3/2005 13:17:54 50 minutes 27 seconds (3027.26 seconds) has elapsed.
---------*---------*---------*---------*---------*---------*---------*---------*
2005-03-03, 13:17:54, Scanner "C:\Archivos de programa\Scanner\VSCANTM.BIN" has finished
running.
Logfile of HijackThis v1.99.0
Scan saved at 1:06:03, on 04/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
C:\Archivos de programa\Roxio\GoBack\GBPoll.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\SystemRecovery\OLRegCap.EXE
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\SystemRecovery\OLlaunch.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\HP\hpcoretech\hpcmpmgr.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe
C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\msupdater.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\SystemRecovery\OLSysTray.exe
C:\ARCHIV~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\Microsoft Office\Office10\WINWORD.EXE
C:\Archivos de programa\HijackThis.exe
C:\Program Files\Media Pass\MediaPass.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: Shell=
O1 - Hosts: 62.189.6.85 _sip._tls.sip5.phoneserve.com
O1 - Hosts: 62.189.6.85 _sip._ssl.sip5.phoneserve.com
O1 - Hosts: 62.189.6.86 _sip._tls.sip6.phoneserve.com
O1 - Hosts: 62.189.6.86 _sip._ssl.sip6.phoneserve.com
O1 - Hosts: 62.189.6.93 _sip._tls.sip7.phoneserve.com
O1 - Hosts: 62.189.6.93 _sip._ssl.sip7.phoneserve.com
O1 - Hosts: 62.189.6.78 _sip._tls.sip1.callserve.com
O1 - Hosts: 62.189.6.78 _sip._ssl.sip1.callserve.com
O1 - Hosts: 62.189.6.79 _sip._tls.sip2.callserve.com
O1 - Hosts: 62.189.6.79 _sip._ssl.sip2.callserve.com
O1 - Hosts: 62.189.6.108 _sip._tls.sip8.phoneserve.com
O1 - Hosts: 62.189.6.108 _sip._ssl.sip8.phoneserve.com
O1 - Hosts: 62.189.6.61 _sip._tls.sip17.phoneserve.com
O1 - Hosts: 62.189.6.61 _sip._ssl.sip17.phoneserve.com
O1 - Hosts: 62.189.6.62 _sip._tls.sip18.phoneserve.com
O1 - Hosts: 62.189.6.62 _sip._ssl.sip18.phoneserve.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos
de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Archivos de programa\MSN
Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos
de programa\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos
de programa\MSN Apps\MSN Toolbar\01.02.3000.1001\es\msntb.dll
O2 - BHO: SpoofStick BHO - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE} - C:\Archivos de
programa\CoreStreet\SpoofStick\SpoofStickBHO.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de
programa\MSN Apps\MSN Toolbar\01.02.3000.1001\es\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de
programa\google\googletoolbar1.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Archivos de
programa\CoreStreet\SpoofStick\SpoofStick.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\Hewlett-Packard\HP Software
Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Archivos de
programa\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Archivos de programa\Hewlett-Packard\Digital
Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe"
/WinStart
O4 - HKCU\..\Run: [Skype] "C:\Archivos de programa\Skype\Phone\Skype.exe" /nosplash
/minimized
O4 - HKCU\..\Run: [SpySweeper] "C:\Archivos de programa\Webroot\Spy
Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKCU\..\Run: [Dns Resolver] dnsrslve.exe
O4 - HKCU\..\Run: [MS Unix Binary] Norton2005Update.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe"
/background
O4 - Startup: SystemRecovery.com TaskBar Icon.LNK = C:\Archivos de
programa\SystemRecovery\OLSysTray.exe
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: E&xportar a Microsoft Excel -
res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmbacklinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: CUseeMe Conferencing Companion -
{44EFB53C-C965-43CF-9F45-52242D134187} - C:\Archivos de programa\CUseeMe\Amigo.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de
programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de
programa\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -
http://housecall-beta.trendmicro.com...ll/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.co..._site.cab?1097
416344213
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} -
http://toolbar.google.com/data/es/de.../GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {86698251-D2C0-4D0F-A3E4-95CEF12F9F18} -
http://64.156.188.99/iwasher/internetwasherpro.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
http://photos.msn.es/r/neutral/contr...cab?5,0,1730,0
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
https://www-secure.symantec.com/regi...ActiveData.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Archivos de
programa\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. -
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Servicio del administrador de discos lógicos - Unknown -
C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Registro de sucesos - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Archivos de programa\Roxio\GoBack\GBPoll.exe
O23 - Service: Servicio COM de grabación de CD de IMAPI - Unknown -
C:\WINDOWS\System32\Imapi.exe
O23 - Service: Escritorio remoto compartido de NetMeeting - Unknown -
C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: SystemRecovery.com RegCap - SystemRecovery.com - C:\Archivos de
programa\SystemRecovery\OLRegCap.EXE
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Administrador de sesión de Ayuda de escritorio remoto - Unknown -
C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Tarjeta inteligente - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Registros y alertas de rendimiento - Unknown -
C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: SystemRecovery.com Launcher - SystemRecovery.com - C:\Archivos de
programa\SystemRecovery\OLlaunch.exe
O23 - Service: Telnet - Unknown - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Instantáneas de volumen - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Adaptador de rendimiento de WMI - Unknown -
C:\WINDOWS\System32\wbem\wmiapsrv.exe
-
Download CWShredder, leave it now we'll use it later.
Close all browser windows, restart Hijack This and put a checkmark next to the following entries:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: Shell=
O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKCU\..\Run: [Dns Resolver] dnsrslve.exe
O4 - HKCU\..\Run: [MS Unix Binary] Norton2005Update.exe
Click Fix Checked
Then boot into Safe Mode and ensure that you are showing Hidden Files and Folders.
Run CWShredder and let it remove your CWS Infection.
Delete the following files and folders:
C:\Program Files\Media Pass
C:\WINDOWS\system32\msupdater.exe
Reboot and post a fresh log
-
I have done everything you said. CWShredder didn' t find any infection. Here is the log.
Logfile of HijackThis v1.99.0
Scan saved at 1:42:05, on 05/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
C:\Archivos de programa\Roxio\GoBack\GBPoll.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\SystemRecovery\OLRegCap.EXE
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\SystemRecovery\OLlaunch.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
C:\Archivos de programa\HP\hpcoretech\hpcmpmgr.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe
C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\SystemRecovery\OLSysTray.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Archivos de programa\MSN Apps\Updater\01.02.3000.1001\es\msnappau.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Archivos de programa\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O1 - Hosts: 62.189.6.85 _sip._tls.sip5.phoneserve.com
O1 - Hosts: 62.189.6.85 _sip._ssl.sip5.phoneserve.com
O1 - Hosts: 62.189.6.86 _sip._tls.sip6.phoneserve.com
O1 - Hosts: 62.189.6.86 _sip._ssl.sip6.phoneserve.com
O1 - Hosts: 62.189.6.93 _sip._tls.sip7.phoneserve.com
O1 - Hosts: 62.189.6.93 _sip._ssl.sip7.phoneserve.com
O1 - Hosts: 62.189.6.78 _sip._tls.sip1.callserve.com
O1 - Hosts: 62.189.6.78 _sip._ssl.sip1.callserve.com
O1 - Hosts: 62.189.6.79 _sip._tls.sip2.callserve.com
O1 - Hosts: 62.189.6.79 _sip._ssl.sip2.callserve.com
O1 - Hosts: 62.189.6.108 _sip._tls.sip8.phoneserve.com
O1 - Hosts: 62.189.6.108 _sip._ssl.sip8.phoneserve.com
O1 - Hosts: 62.189.6.61 _sip._tls.sip17.phoneserve.com
O1 - Hosts: 62.189.6.61 _sip._ssl.sip17.phoneserve.com
O1 - Hosts: 62.189.6.62 _sip._tls.sip18.phoneserve.com
O1 - Hosts: 62.189.6.62 _sip._ssl.sip18.phoneserve.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos
de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Archivos de programa\MSN
Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos
de programa\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos
de programa\MSN Apps\MSN Toolbar\01.02.3000.1001\es\msntb.dll
O2 - BHO: SpoofStick BHO - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE} - C:\Archivos de
programa\CoreStreet\SpoofStick\SpoofStickBHO.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de
programa\MSN Apps\MSN Toolbar\01.02.3000.1001\es\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de
programa\google\googletoolbar1.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Archivos de
programa\CoreStreet\SpoofStick\SpoofStick.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\Hewlett-Packard\HP Software
Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Archivos de
programa\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Archivos de programa\Hewlett-Packard\Digital
Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe"
/WinStart
O4 - HKCU\..\Run: [Skype] "C:\Archivos de programa\Skype\Phone\Skype.exe" /nosplash
/minimized
O4 - HKCU\..\Run: [SpySweeper] "C:\Archivos de programa\Webroot\Spy
Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe"
/background
O4 - Startup: SystemRecovery.com TaskBar Icon.LNK = C:\Archivos de
programa\SystemRecovery\OLSysTray.exe
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: E&xportar a Microsoft Excel -
res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmbacklinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: CUseeMe Conferencing Companion -
{44EFB53C-C965-43CF-9F45-52242D134187} - C:\Archivos de programa\CUseeMe\Amigo.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de
programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de
programa\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -
http://housecall-beta.trendmicro.com...ll/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.co..._site.cab?1097
416344213
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} -
http://toolbar.google.com/data/es/de.../GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {86698251-D2C0-4D0F-A3E4-95CEF12F9F18} -
http://64.156.188.99/iwasher/internetwasherpro.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
http://photos.msn.es/r/neutral/contr...cab?5,0,1730,0
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
https://www-secure.symantec.com/regi...ActiveData.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Archivos de
programa\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. -
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Servicio del administrador de discos lógicos - Unknown -
C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Registro de sucesos - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Archivos de programa\Roxio\GoBack\GBPoll.exe
O23 - Service: Servicio COM de grabación de CD de IMAPI - Unknown -
C:\WINDOWS\System32\Imapi.exe
O23 - Service: Escritorio remoto compartido de NetMeeting - Unknown -
C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: SystemRecovery.com RegCap - SystemRecovery.com - C:\Archivos de
programa\SystemRecovery\OLRegCap.EXE
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Administrador de sesión de Ayuda de escritorio remoto - Unknown -
C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Tarjeta inteligente - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Registros y alertas de rendimiento - Unknown -
C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: SystemRecovery.com Launcher - SystemRecovery.com - C:\Archivos de
programa\SystemRecovery\OLlaunch.exe
O23 - Service: Telnet - Unknown - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Instantáneas de volumen - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Adaptador de rendimiento de WMI - Unknown -
C:\WINDOWS\System32\wbem\wmiapsrv.exe
-
Hi again. I saw that O4 - HKCU\..\Run: [MS Updating Utility] msupdater.exe was still there in the log so I repeated the operation once again. This time I deleted also C:\Program Files\AdTools Service and C:\Program Files\Prewiew AdService. Latest log follows.
Logfile of HijackThis v1.99.0
Scan saved at 3:12:12, on 05/03/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
C:\Archivos de programa\Roxio\GoBack\GBPoll.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\SystemRecovery\OLRegCap.EXE
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\SystemRecovery\OLlaunch.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\Archivos de programa\HP\hpcoretech\hpcmpmgr.exe
C:\Archivos de programa\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe
C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeper.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\Archivos de programa\SystemRecovery\OLSysTray.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O1 - Hosts: 62.189.6.85 _sip._tls.sip5.phoneserve.com
O1 - Hosts: 62.189.6.85 _sip._ssl.sip5.phoneserve.com
O1 - Hosts: 62.189.6.86 _sip._tls.sip6.phoneserve.com
O1 - Hosts: 62.189.6.86 _sip._ssl.sip6.phoneserve.com
O1 - Hosts: 62.189.6.93 _sip._tls.sip7.phoneserve.com
O1 - Hosts: 62.189.6.93 _sip._ssl.sip7.phoneserve.com
O1 - Hosts: 62.189.6.78 _sip._tls.sip1.callserve.com
O1 - Hosts: 62.189.6.78 _sip._ssl.sip1.callserve.com
O1 - Hosts: 62.189.6.79 _sip._tls.sip2.callserve.com
O1 - Hosts: 62.189.6.79 _sip._ssl.sip2.callserve.com
O1 - Hosts: 62.189.6.108 _sip._tls.sip8.phoneserve.com
O1 - Hosts: 62.189.6.108 _sip._ssl.sip8.phoneserve.com
O1 - Hosts: 62.189.6.61 _sip._tls.sip17.phoneserve.com
O1 - Hosts: 62.189.6.61 _sip._ssl.sip17.phoneserve.com
O1 - Hosts: 62.189.6.62 _sip._tls.sip18.phoneserve.com
O1 - Hosts: 62.189.6.62 _sip._ssl.sip18.phoneserve.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos
de programa\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Archivos de programa\MSN
Apps\ST\01.02.3000.1002\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\archivos
de programa\google\googletoolbar1.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos
de programa\MSN Apps\MSN Toolbar\01.02.3000.1001\es\msntb.dll
O2 - BHO: SpoofStick BHO - {CBA74CDA-DF78-4AD9-954E-3B15D0A993DE} - C:\Archivos de
programa\CoreStreet\SpoofStick\SpoofStickBHO.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de
programa\MSN Apps\MSN Toolbar\01.02.3000.1001\es\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de
programa\google\googletoolbar1.dll
O3 - Toolbar: SpoofStick - {4D46ED77-1429-4CF6-8F63-C84B5D710BAF} - C:\Archivos de
programa\CoreStreet\SpoofStick\SpoofStick.dll
O4 - HKLM\..\Run: [HPDJ Taskbar Utility]
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb0 9.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Archivos de programa\Hewlett-Packard\HP Software
Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Archivos de
programa\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Archivos de programa\Hewlett-Packard\Digital
Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [MessengerPlus2] "C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MessengerPlus2] "C:\Archivos de programa\Messenger Plus! 2\MsgPlus.exe"
/WinStart
O4 - HKCU\..\Run: [Skype] "C:\Archivos de programa\Skype\Phone\Skype.exe" /nosplash
/minimized
O4 - HKCU\..\Run: [SpySweeper] "C:\Archivos de programa\Webroot\Spy
Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\MSN Messenger\msnmsgr.exe"
/background
O4 - Startup: SystemRecovery.com TaskBar Icon.LNK = C:\Archivos de
programa\SystemRecovery\OLSysTray.exe
O8 - Extra context menu item: &Download with &DAP - C:\ARCHIV~1\DAP\dapextie.htm
O8 - Extra context menu item: &Google Search - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: E&xportar a Microsoft Excel -
res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Instantánea de caché de la página - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Páginas similares - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Páginas vinculadas - res://c:\archivos de
programa\google\GoogleToolbar1.dll/cmbacklinks.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java -
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: CUseeMe Conferencing Companion -
{44EFB53C-C965-43CF-9F45-52242D134187} - C:\Archivos de programa\CUseeMe\Amigo.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de
programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de
programa\Messenger\msmsgs.exe
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) -
http://housecall-beta.trendmicro.com...ll/xscan60.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://v5.windowsupdate.microsoft.co..._site.cab?1097
416344213
O16 - DPF: {6CB5E471-C305-11D3-99A8-000086395495} -
http://toolbar.google.com/data/es/de.../GoogleNav.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai.net/7/840/537/2...ll/xscan53.cab
O16 - DPF: {86698251-D2C0-4D0F-A3E4-95CEF12F9F18} -
http://64.156.188.99/iwasher/internetwasherpro.cab
O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) -
http://photos.msn.es/r/neutral/contr...cab?5,0,1730,0
O16 - DPF: {E77C0D62-882A-456F-AD8F-7C6C9569B8C7} (ActiveDataObj Class) -
https://www-secure.symantec.com/regi...ActiveData.cab
O18 - Protocol: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Archivos de
programa\HP\hpcoretech\comp\hpuiprot.dll
O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. -
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Servicio del administrador de discos lógicos - Unknown -
C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Registro de sucesos - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: GBPoll - Roxio, Inc. - C:\Archivos de programa\Roxio\GoBack\GBPoll.exe
O23 - Service: Servicio COM de grabación de CD de IMAPI - Unknown -
C:\WINDOWS\System32\Imapi.exe
O23 - Service: Escritorio remoto compartido de NetMeeting - Unknown -
C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: SystemRecovery.com RegCap - SystemRecovery.com - C:\Archivos de
programa\SystemRecovery\OLRegCap.EXE
O23 - Service: Plug and Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Administrador de sesión de Ayuda de escritorio remoto - Unknown -
C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Tarjeta inteligente - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Registros y alertas de rendimiento - Unknown -
C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: SystemRecovery.com Launcher - SystemRecovery.com - C:\Archivos de
programa\SystemRecovery\OLlaunch.exe
O23 - Service: Telnet - Unknown - C:\WINDOWS\System32\tlntsvr.exe
O23 - Service: Instantáneas de volumen - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Adaptador de rendimiento de WMI - Unknown -
C:\WINDOWS\System32\wbem\wmiapsrv.exe
-
I make that a clean log, how are things running?
-
Everything is fine and things are running perfectly, as far as I can see. What a relief. I don' t know what I would have done without yor help. Thank you very much and best regards.
-
Preventing it returning
After your problem has been resolved on the forum, it is an absoulute MUST to do the following steps to prevent the problem returning. Click on the link to get access to the software or webpage that I'm referring to.
1. Visit Windows Update
Pay a visit to Windows Update and scan for and download ALL Critical Updates and Service Packs. New updates are usually released monthly so check back to Windows Update every month.
2. Clean Up and Speed Up-
It is important that after you have had a spyware/virus infection that you clean up your PC (this includes cleaning out usage tracks, temporary files, emptying the recycle bin, etc). It is so important because during the installation and uninstallation of spyware (and most programs), many temporary or useless files are left behind. If you accidently run one of these files, you could end up with the problem returning. See the link above for lots of information on clearing out your PC and improving your PCs performance and general speed.
3. Consider an alternative browser or tighten IE settings-
Internet Explorer is installed on most systems and used by the majority of people, so of course its going to be a prime target for malware and hackers. To make the matters worse, Internet Explorer is very vulnerable to hijacks and the automatic installation of programs. This is how a lot of spyware enters your PC in the first place. So unless you secure Internet Explorer, you are seriously at risk. There is risk with any Internet browser, but even when IE is secured, there are still risks. IE can still be exploited as long as installed on your system, you don't necessarily have to use it, so this shows the importance of securing it. Here are five steps to take to Secure IE:- Install Sun Java instead of using MS Java VM. Get from www.java.com. Sun Java is much more secure.
- Scroll up and read about Windows Updates (number 1). This is essential to patch newly discovered flaws in Internet Explorer.
- Scroll down and read about Spyware Blaster (number 7. This is important so that nasty sites can't exploit your machine.
- Take a look at the article here. Scroll down to the "If you have to use MSIE" section and have a read of the information about the recommended security settings in IE. A program is also mentioned called IESPYADS, its is worth downloading and installing this.
If you wish to use an alternative browser that is perhaps more secure than IE, consider Mozilla Firefox, Mozilla, Opera or Netscape.
4. Download Antivirus Software-
If you haven't already got Antivirus software, you should download and install AVG Antivirus. It is freeware and is updated nearly every 2 days (sometimes more frequently if there are a lot of new viruses) and in my opinion, is better than some Antivirus software such as Norton. Antivirus software will prevent viruses infecting your system and it is important that you update it every two days or every week at the most.
5. Download a Firewall-
If you haven't already got a firewall, it is Very important that you download one. Firewalls will prevent unauthorised access to your computer and stop data leaking out of your computer. You may think that it won't happen to you, but Hackers don't care who you are, what you do, where you live or what you had for tea last Sunday on your holiday in the Lake District, they want your data. Firewalls will keep these sneaks out and one of the best is Sygate Personal Firewall, which happens to be freeware.
6. Spyware Scanners-
It is important that as well as having real time spyware protection, you have a spyware scanning application. If you have not already been told to download one earlier in this thread, it is a good idea to download Spybot Search And Destroy and Ad-aware. They are both spyware scanners and will search for a remove spyware. It is recommended that you have both, because one will pick up entries that the other misses. It is even a good idea to download these if you have other programs such as ASE, Spysweeper, Pest Patrol, etc, because one spyware scanner will not pick up everything. Please remember to update your spyware scanners weekly/fortnightly.
7. Prevent Spyware slipping through Internet Explorer-
Quite a lot of spyware slips through Internet Explorer if your settings are not tight enough. Spyware Blaster will help you prevent spyware slipping through and installing tracking cookies. Simply run it via Start> Programs> Spyware Blaster and click Enable All Protection and it will protect you. It doesn't even have to be open! Remember to update weekly/fortnightly.
8. Constant Spyware Protection-
It is important to have constant spyware protection. Spyware Guard works like an antivirus program but detects Spyware instead. It will constantly protect your system. Check for updates monthly.
All Of these steps are very important and it is HIGHLY recommended that you download all of the programs mentioned for your own safety. Remember to Update everything (including Windows using Windows Update)! It is also a good idea to perform weekly/fortnightly scans with Spybot S&D, Ad-aware and your antivirus software.
And last of all, please remember, that common sense is your greatest tool. Without it, spyware and other related Malware would rule!
