need help(RESOLVED) need help(RESOLVED)
can u please check my log http://go.microsoft.com/fwlink/?linkid=39204 http://h30155.www3.hp.com/ediags/dd/...osticsxp2k.cab http://download.bitdefender.com/reso...an8/oscan8.cab http://www.update.microsoft.com/wind...?1188901880687 http://update.microsoft.com/microsof...?1188902392515 http://www.innotive.com/download/cibrowser11.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.adobe.com/products/acrobat/nos/gp.cab
Welcome back,HIJACKTHIS rename and rename it to foolyou.exe , press enterVundoFix.exe Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will reboot your computer, click OK . Please post the contents of C:\vundofix.txt and a new HiJackThis log. Scan for Vundo button." when VundoFix appears at reboot.COMBOFIX
1.this is the hijackthis log after renaming http://go.microsoft.com/fwlink/?linkid=39204 http://h30155.www3.hp.com/ediags/dd/...osticsxp2k.cab http://download.bitdefender.com/reso...an8/oscan8.cab http://www.update.microsoft.com/wind...?1188901880687 http://update.microsoft.com/microsof...?1188902392515 http://www.innotive.com/download/cibrowser11.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.adobe.com/products/acrobat/nos/gp.cab http://www.plal.com/images/brick.jpg http://www.indianchild.com/images/tree_01.gif http://imgi.maps.yahoo.com/mapimage?...pCSirH73a_Sf6p http://cguesthouse.homestead.com/fil...QS_main_bg.jpg http://www.theweathernetwork.com/com...ground1024.gif https://secure4.worldweb.com/Activit...son_tours3.gif http://www.vancouvertrolley.com/images/bg.gif There is nothing found in the vundofix so there is nothing to be deleted. This is the log this is the combofix log http://www.gmer.net
Vundofix ran twice the first time it found and deleted files related to vundo trojan, second time none was found and is good.BitDefender
i got this pop up when i have agreed for the ActiveX Control. i received this error. (look at attachment). should i overwrite it?? 1) this is the online scan. **but i change the settings to scan all files... its okay right..?? instead of just program files. after it detect for virus the 2nd action is supposed to be delete right..?? i'm afraid that i might have messed up the setting on the online scan. Please advice 2) this is the hjt log http://go.microsoft.com/fwlink/?linkid=39204 http://h30155.www3.hp.com/ediags/dd/...osticsxp2k.cab http://download.bitdefender.com/reso...an8/oscan8.cab http://www.update.microsoft.com/wind...?1188901880687 http://update.microsoft.com/microsof...?1188902392515 http://www.innotive.com/download/cibrowser11.cab http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab http://www.adobe.com/products/acrobat/nos/gp.cab http://www.plal.com/images/brick.jpg http://www.indianchild.com/images/tree_01.gif http://imgi.maps.yahoo.com/mapimage?...pCSirH73a_Sf6p http://cguesthouse.homestead.com/fil...QS_main_bg.jpg http://www.theweathernetwork.com/com...ground1024.gif https://secure4.worldweb.com/Activit...son_tours3.gif http://www.vancouvertrolley.com/images/bg.gif
You did it right.scan system only button and put checks next to these:R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about fix checked .
Actually what is my computer's problem?? i dont see any problem and it feels abit faster then before. please tell me what was my computer's problem.?? when i did the hijackthis to delete those programs, it said hijackthis is going to remove a BHO and the corresponding file from the system
that is ok and you had the vundo trojan, I will mark this as resolved and good luck and happy surfing.Congratulations , your log shows that your SYSTEM IS CLEAN There are a few things you must do once you are completely clean: Re-hide your System Files and Folders to prevent any future accidents.Reconfigure Windows XP to hide hidden files: Click Start. Open My Computer. Select the Tools menu and click Folder Options. Select the View Tab. Under the Hidden files and folders heading deselect "Show hidden files and folders". Check the "Hide protected operating system files (recommended) " option. Click Yes to confirm. Click OK. Please download ATF Cleaner by Atribune This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program.Main choose: Select All Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Empty Selected button.NOTE: If you would like to keep your saved passwords, please click No at the prompt. Exit on the Main menu to close the program.Technical Support , double-click the e-mail address located at the bottom of each menu.Reset and Re-enable your System Restore TO DISABLE SYSTEM RESTORE Right-click "My Computer", and then left click "Properties". Left click on "System Restore Tab" Check box beside "Turn Off System Restore" Left click on "Apply" Reboot your System TO ENABLE SYSTEM RESTORE Remove check mark from "Turn Off System Restore" Click on "Apply " Here are some tips to reduce the potential for spyware infection in the future Make sure you keep your Windows OS current Windows update I strongly recommend installing the following applications :Spywareblaster <= SpywareBlaster will prevent spyware from being installed. Spywareguard <= SpywareGuard offers realtime protection from spyware installation attempts. How to use Spybot to remove Spyware <= If you suspect that you have spyware installed on your computer, here are instructions on how to download, install and then use Spybot. Similar to Ad-Aware, I strongly recommend both to catch most spyware. To protect yourself further :Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer Google Toolbar <= Get the free google toolbar to help stop pop up windows. So how did I get infected in the first place?
Elite Member
11 - ComboFix 07-06-27.7 - Service Pack 2 NTFS
