Try uninstalling 'webshots':I am still experiencing these constant intrusion attempts when the parental controls are turned off!
Copies of this program have been created by known malware relating to W32.PassMail, on our users systems. It is possible that this was as a direct result of the user's actions, or may have occured without their knowledge.
Additionally, you have restrictions set with these lines which may be responsible for intrusion detection events. Could try fixing these lines:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
If still no joy, try the following malware scanning tool:
Please download WebRoot SpySweeper from HERE (It's a 14 day trial):
http://www.webroot.com/shoppingcart/...php?bjpc=64011
OR
http://www.webroot.com/consumer/prod...de=af1&rc=3597
- Click the Free Trial link to download the program.
- Double-click the file to install it as follows:
- Click "Next", read the agreement, Click "Next"
- Choose "Custom" click "Next".
- Leave the default installation directory as it is, then click "Next".
- UNcheck "Run SpySweeper at Windows Startup" and "Add Sweep for Spyware to Windows Explorer Context Menu". Click "Next".
- On the following screen you can leave the e-mail address field blank, if you wish. Click "Next".
- Finally, click "Install"
- Once the program is installed, it will open.
- It will prompt you to update to the latest definitions, click Yes.
Once the definitions are installed, click Options on the left side.
Click the Sweep Options tab.
Under What to Sweep please put a check next to the following:
- Sweep Memory
- Sweep Registry
- Sweep Cookies
- Sweep All User Accounts
- Enable Direct Disk Sweeping
- Sweep Contents of Compressed Files
- Sweep for Rootkits
- Please UNCHECK Do not Sweep System Restore Folder.
Disable SpySweeper Shields
- Click Shields on the left.
- Click Internet Explorer and uncheck all items.
- Click Windows System and uncheck all items.
- Click Startup Programs and uncheck all items.
- Once the definitions are installed and shields disabled, click Sweep Now on the left side.
- Click the Start button.
- When it's done scanning, click the Next button.
- Make sure everything has a check next to it, then click the Next button.
- It will remove all of the items found.
- Click Session Log in the upper right corner, copy everything in that window.
- Click the Summary tab and click Finish.
- Paste the contents of the session log you copied into your next reply.
Post the SpySweeper session log here along with a fresh HiJackThis log.
