Member Panel

Good Evening Team, and Happy New Year

About a coupled days ago, I came home to find that my children had some how had some adware installed on the computer. I believe it was by accident, but when I try to remove it, it is not completely gone I keep getting pop up windows, and it is killing my memory it seems too. I have attached my HIJACKTHIS LOG. Appreciate your time.

Thank You,

Potatopiee

Happy New Year to you too potatopiee!

One of the security team will be along shortly to browse over your HJT Sit tight

Hello potatopiee67.

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Please reboot your computer in Safe Mode by doing the following:

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".


The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

Good Morning Team,
I have done what you asked for, at least I hope I did.

SmitFraudFix v2.132
Scan done at 8:38:38.46, Mon 01/08/2007
Run from C:\Documents and Settings\Lisa S Alexander\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\SharedTaskScheduler]
"{b59f3ba4-98da-4b5f-8a2d-7b56fb11140b}"="buprestidae"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\DOCUME~1\LISASA~1\FAVORI~1\Online Security Test.url Deleted
C:\DOCUME~1\LISASA~1\STARTM~1\Programs\AntiVermins Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\AntiVermins\ Deleted
C:\Program Files\Video ActiveX Object\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Hi Potato

Please be aware that some of our Tech Team operate on different time zones so a situation may occur when it seems you are not being responded to.
As I have explained this is not the case and I would ask you to bear with us for the time being.

Please now run HijackThis and place a checkmark by the following entries:
O2 - BHO: (no name) - {465E08E7-F005-4389-980F-1D8764B3486C} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/noc...up1.0.0.15.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} - http://wdownload.weatherbug.com/mini...ansporter.cab?

Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis and restart the computer.


I notice you have WeatherBug. WeatherBug gives you current weather conditions, your local weather report, and storm alerts, however the free version is ad-supported containing both banner and pop-up ads. In some cases, it installs the My Search toolbar. There are other excellent alternatives to WeatherBug such as WeatherPulse.

It is optional to remove. If you want to uninstall it, make sure the program is not running before uninstalling it. If there is a WeatherBug icon in the system tray (in the lower right hand corner of the screen) you'll need to right-click on it and choose "Exit WeatherBug" or "Terminate Weatherbug".

Once the program is closed, you can remove it easily from the Add/Remove Programs section of the Control Panel by following these steps:

• Click START (lower, left of computer screen)
• Select SETTINGS and CONTROL PANEL
• Double click ADD/REMOVE PROGRAMS
• Select "WeatherBug" (or other programs) from the list of applications
• Click ADD/REMOVE and follow the instructions

If you receive a warning stating that the system could not delete a file, please click on WeatherBug and then ADD/REMOVE again.






After all the above is done:

• Run AVG Anti-Spyware 7.5 and click on the Scanner tab at the top
• Click the "Settings" tab and then change the recommended action to Quarantine and ensure that Automatically generate report after every scan is selected and
  Uncheck "Only if Threats are found"
• Click back to the "Scan" tab and then click on Complete System Scan.
  This scan can take quite a while to run, so be prepared.
• AVG Anti-Spyware 7.5 will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware 7.5 will display "All actions have been applied" on the right hand side.
• Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post it in your next reply, along with a new HijackThis log.