sandy070403 Posted November 1, 2009 Report Share Posted November 1, 2009 On running a scan, a-squared Anti-Malware Free found the above and indicated I come to this forum for instructions on removing it. Attached are the three logs as instructed (I'm not sure the HiJackFree log is the proper one though). Thanks for any help you can provide! Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted November 2, 2009 Report Share Posted November 2, 2009 Using Add or Remove Programs in the Control Panel; uninstall the following: Java 2 Runtime Environment, SE v1.4.2_03Java 6 Update 7 Multiply Toolbar ----------------------------------------------------------- Copy the contents of the below quote box to Notepad; Save As FixReg.reg to your Desktop; make sure File Type: is set to All Files (*.*). REGEDIT4 [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] [-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\browser helper objects\{A057A204-BACC-4D26-C4DC-6BA49CE16884}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{A057A204-BACC-4D26-C4DC-6BA49CE16884}"=- "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"=- Close Notepad. Locate FixReg.reg on your Desktop. Double-click on it and answer 'Yes' when asked if you want to merge with the registry. ----------------------------------------------------------- Attach fresh logs for: a-squared Free/Anti-Malware HiJackFree Let me know of any problems you may have encountered with the above instructions and also let me know how things are running now! Link to comment Share on other sites More sharing options...
sandy070403 Posted November 2, 2009 Author Report Share Posted November 2, 2009 Thanks! Please don't close this thread - I have to go to work, but will follow your instructions when I get home tonight. Link to comment Share on other sites More sharing options...
Lynx Posted November 2, 2009 Report Share Posted November 2, 2009 Hi sandy070403, Don't worry. 1st the limit of not responding is 72 hours and then if you did not reply and have a reason you always can PM to one of the moderators on order to reopen the case My regards Link to comment Share on other sites More sharing options...
sandy070403 Posted November 3, 2009 Author Report Share Posted November 3, 2009 Thank you, Lynx. I followed ShadowuterDude's instructions and am attaching the new logs (added a 2 to the HiJackFree log title so I could distinguish it). There were no problems at all with the instructions - everything went smoothly, but the Gen.AdWare IK seems to still be there. Thanks again for all the help. I'll await further instructions! Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted November 3, 2009 Report Share Posted November 3, 2009 The Gen.AdWare IK detections are System Restore Points. ----------------------------------------------------------- Antivirus Tools Cannot Clean Infected Files in the System Restore Folder. The System Restore feature in Windows protects all folders and files in the System Restore folder on the Windows partition. This folder and all of its subfolders are the data store that the System Restore feature uses to restore your computer's operating system to a previous state from a previous point in time. Although some antivirus programs may have the ability to work with files that have been compressed or stored in .zip or .cab file format, the System Restore feature does not permit these utilities to manipulate these files within the data store. The data store is protected for data integrity purposes, and the System Restore feature is the only method you can use to obtain access to the data store. Because of this, the antivirus program is unable to remove the virus from the file or files in the data store. The files in the data store are inactive and can be used only by the System Restore feature. ----------------------------------------------------------- Your logs look fine. Unless you are having problems from Malware it is time to do the final steps. If you used ComboFix, uninstall ComboFix: Click START then RUN and enter the below into the run box and then click OK. (Use only the command of the same name as your copy of combofix.) AvoidTDSS /u or combofix /u or Combo-Fix /uNote: The space before /u, must be there. Which command you use depends on if I had you rename ComboFix during download.This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults. Delete the C:\AvoidTDSS or C:\ComboFix folder from combofix.Delete everything in C:\!KillBox Delete the following from your Desktop (If they exist) Avenger.exe Avenger.txt Avenger.zip DisableAutoRuns.reg FixMe.reg FixReg.reg ISeeYouXP.exe ISeeYouXP.lnk ISeeYouXP.txt Anything else I had you use Delete the following: (If they exist) C:\Avenger.txt C:\Avenger C:\ComboFix.txt C:\ComboFix C:\SDFix C:\Qoobox You can delete and uninstall any programs I had you download, that you do not wish to keep on the system. Empty the Recycle Bin Run ATF Cleaner In the ISeeYouXP folder double-click HideIT.bat. Turn off System restore to flush all your restore points then turn system restore back on. To manually turn off System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to select the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. 4 Click Yes when you receive the prompt to the turn off System Restore. To turn on System Restore, follow these steps: 1. Click Start, right-click My Computer, and then click Properties. 2. Click the System Restore tab. 3. Click to clear the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK. Delete C:\ISeeYouXP Run Windows Update and update your Windows Operating System. Run the Secunia Online Software Inspector, this will inspect your system for software that is out-of-date and in need of updating. Update anything program/application detected as being out-dated. That should take care of everything. Safe Surfing! Link to comment Share on other sites More sharing options...
sandy070403 Posted November 6, 2009 Author Report Share Posted November 6, 2009 Thank you! I've done everything except the Secunia Software Inspector and am about to go there. I'll be running another a-squared Free scan tomorrow and am anxious to see the results! Thanks again! Link to comment Share on other sites More sharing options...
ShadowPuterDude Posted November 7, 2009 Report Share Posted November 7, 2009 Thread Closed Reason: Resolved The procedures contained in this thread are for this user and this user only. Attempting to use the instructions in this thread on your system could result in damaging the Operating System beyond repair. Do Not use any of the tools mentioned in this thread without the supervision of a Malware Removal Specialist. All posters requesting Malware Removal assistance are required to follow all procedures in the thread titled START HERE, if you don't we are just going to send you back to this thread Link to comment Share on other sites More sharing options...
Recommended Posts