sometimes when it says that it actually gets them.

Hello Neal.
Just done a KASPERSKY ON-LINE SCANNER REPORT
Wednesday, June 07, 2006 955 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 7/06/2006
Kaspersky Anti-Virus database records: 199048


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics
Total number of scanned objects 50217
Number of viruses found 3
Number of infected objects 7
Number of suspicious objects 0
Duration of the scan process 00:35:27

Infected Object Name Virus Name Last Action
C:\temp\cs_mary.exe/Realtime.dll Infected: Trojan-Spy.Win32.Delf.fk skipped

C:\temp\cs_mary.exe CreateInstall: infected - 1 skipped

C:\temp\setup_ares.exe/data0037 Infected: not-a-virus:AdWare.Win32.NavExcel.i skipped

C:\temp\setup_ares.exe NSIS: infected - 1 skipped

C:\temp\WarezP2P_DLC.exe/stream/data0035 Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\temp\WarezP2P_DLC.exe/stream Infected: not-a-virus:AdWare.Win32.NewDotNet skipped

C:\temp\WarezP2P_DLC.exe NSIS: infected - 2 skipped

Scan process completed.


Any ideas on safely getting these viruses removed.

Doesn't look like CCleaner will do it.
Or the killbox either. know any other way?
or am I stuck with them.

Many thanks

Ok let's break out the big guns,


Download and install AVENGER


Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens, copy,then paste all the text in the quote box below includeing the:files to delete but not quote.

Files to Delete:
C:\temp\cs_mary.exe
C:\temp\setup_ares.exe
C:\temp\WarezP2P_DLC.exe

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.


Should be gone now.

It may have done it.
Thanks for all the expertese and effort you've put in.
I have learnt a lot.
I'll learn about paypal as well soon. and they can wire some over for the u keep of the site.

Many thanks.

Glad it is gone finally,



If you are no longer having any more trouble here is some preventative measures for you.

Here are some preventive measures you can take to keep your computer from getting infected again. also keep all these and Ad-awareSE and SpybotS&D updated.

http://www.d-a-l.com/help/showthread.php?t=32403

Flush your restore points in ME and XP, by turning System Restore off and then back on.
This will create a fresh restore point.

Explained Here:
Windows XP: service1.symantec.com/SUPPORT/tsgen...src=sec_doc_nam

Explained Here
Microsoft ME:
http://service1.symantec.com/SUPPORT...rc=sec_doc_nam


RegProtect

This small registry protection tool will save you hours of heartache by notifying you when some program good or bad is trying to access your registry.

You have the option of allowing(good) items or blocking(bad)items.

http://www.diamondcs.com.au/index.php?page=regprot


To reduce the re-infection potential for malware and protect yourself against spyware, here are a few helpful suggestions:

1. Keep Windows and Internet Explorer current with the latest critical security updates from Microsoft. This will patch many of the security holes through which attackers can gain access to your computer. You CANNOT complete this update using an alternate browser.
http://v5.windowsupdate.microsoft.co....aspx?ln=en-us

http://www.microsoft.com/windows/ie/default.asp


2. Run your antivirus software regularly, and to keep its definitions up-to-date. If you are thinking about switching, there are a some good free Antivirus programs that are decent, including AVG and Avast!.
AVG: http://free.grisoft.com/doc/1

Avast: http://www.avast.com/eng/avast_4_home.html


3. In addtion to using Ad-aware consider using another free malware scanning/removal program:
Windows Defender

http://www.microsoft.com/athome/secu...e/default.mspx


4. Consider using a free firewall if you are not already using one. Some good free ones are:
Kerio
http://www.sunbelt-software.com/Kerio.cfm

OutPost Personal Firewall:
Outpost



5. Consider using an alternate free browser for general web surfing but you must use IE for windows update.
Mozilla Firefox: www.mozilla.org/products/firefox/


6. Consider increasing your browser security by using these programs:
SpywareGuard will protect your homepage from being hijacked: http://www.javacoolsoftware.com/spywareguard.html
SpywareBlaster will increase browser protection by blocking Thousands of known malware sites by adding them to IE's restricted sites zone. Download it here:

http://www.javacoolsoftware.com/spywareblaster.html


If you use SpywareBlaster, you can also use a customblocklist to add even more entries into IE restricted sites zone. Go to this site for the current list and how to use instructions: http://customblockinglist.cjb.net/


IE-SPYAD is similar in that it adds thousands more known malware sites to IE's restricted zone. Download it here:
https://netfiles.uiuc.edu/ehowes/www/resource.htm


Block access to Untrustworthy Sites

You can prevent your computer from visiting a myriad of untrustworthy sites and ad-servers by installing a customised hosts file. One of the best available is the: MVPS Hosts File. Simply follow the instructions to install the file in the correct location. This will not only make surfing safer but will improve website load times and block popups from many of the large ad-servers.


Mcafee SiteAdvisor

Surf the Net safer with SiteAdvisor, SiteAdvisor notifies you of safe sites or dangerous sites before you ever go there with a simple green check or a red x or a yellow caution when you do a Google search. Just put your cursor on the green check or red X or caution and recieve information about the site.

SiteAdvisor works with Internet Explorer and FireFox.

SiteAdvisor

See what it looks like Here


*Remember just like your primary anti-virus software, it is important to keep all of these programs up-to-date and use them on a regular basis. It's Free

Hello Neal, One again thanks for all the help and info,
Downloaded "Regprot" from diamond cs.. The scariest program I've known. Every web page it would pop up, every few seconds, would I like to acceot this reg key, or delete it. After about 25 of them in 3 or 4 mins.
Deleting "Regrot" was the decision,
But it wouldnt delete, "Write protected"
Took it into safe mode.
Tried there, "Cannot delete, Regprot the file directory is corrupted and unreadable"
Clicked on "Killbox"
Entered its location, closed down, rebooted, It then went through some internal file secter checking for 5 mins. Checked location, Its gone.
That particular program is'nt for me. anything that I cant uninstall I'll have to think hard about installing in first place.
Anything up to 500 reg key enteries or more an hour could have to go through "Regprot".
Without expert knowlege as to whether the key is ok to except, and more importantly to Delete.
one could be accepting a bad entery or deleting a good one. The thing itself doesn't work it out.
I deleted everyone of them hoping for no long term consequences and then as I say deleted that program itself. It was scary. certainly not for me.
I suppose any program that doesn't load properly can turn into a nightmare.
Still thanks for helping out over the past few days,
I put your teaching on the "Killbox" program to good use.
Cheario.