Drive problems

[Pokey86]

OK i ran everything in order & iv'e attached the 4 logs, thanks

[jholland1964]

Did you install WinVNC.4 on the machine? How is this computer connected to the internet?

[Pokey86]

No i haven't installed winvnc? Should i? & it's connected through a Modem. (Tiscali Broadband)

I disconnected it entirely during the cleaning though

[jholland1964]

No you shouldn't install it...it is all ready there and should NOT be there.

Go to Add/Remove and Uninstall RealVNC.

While you are in Add/Remove also uninstall

Java version is 1.4.2.5
Java version is 1.5.0.6

Then go to C:\Program Files\ and make sure that RealVNC is gone. If you find it, delete it. Empty your Recycle Bin.

Then go to this website; http://www.java.com/en/download/manual.jsp

and download the latest version of Java which is Version 5.0 Update 11

Do the MANUAL download and save the file to your desktop.
Once the download is complete close out ALL BROWSERS. Disconnect from the internet.

Click the java file on your desktop to install. Follow the prompts.

Once complete then go back online and go to this link; http://www.java.com/en/download/installed.jsp
to verify the installation.

Reboot and run another online Kaspersky Scan, save the log to your desktop.
Then run a new HJT scan and post that log back here along with the NEW Kaspersky log.
Judy

[Pokey86]

Java version is 1.4.2.5
Java version is 1.5.0.6


I can't find these 2 on add/remove programes & Real VNC is under the name VNCfree

just thought i'd let you know before i continue

[jholland1964]

Go to C:\Program Files\Java\ and look for those two files. If you find them uninstall from there. If you don't find them don't worry about it, but DO install the new version as directed.
Uninstall VNCfree via Add/Remove
Then do look in for the file folder shown in red and if you find it, delete it. C:\Program Files\RealVNC\

[Pokey86]

Go to C:\Program Files\Java\ and look for those two files. If you find them uninstall from there. If you don't find them don't worry about it, but DO install the new version as directed.
Uninstall VNCfree via Add/Remove
Then do look in for the file folder shown in red and if you find it, delete it. C:\Program Files\RealVNC\

OK i looked for the 2 files but couldn't find them, so i installed the latest java offline then used the link you gave me for verification, i also uninstalled Real VNC & Checked it wasn't in programme files

the Kaspersky & HJT log is attached

[Pokey86]

Any updates on what to do? Or are you still working out a game plan (So to speak) Sorry for the persistency.

[jholland1964]

Pokey I am so sorry, have been tied up with other things for a few days and did not see your post.
Many of the items noted in the Kaspersky scan are located in System Restore and Temporary Internet Files.
Please turn off system restore this way;
Right Click My Computer.
Choose Properties, System Restore.
Place a checkmark in Turn Off System Restore. You will get a warning that you are turning this off. Click OK.

Next do the following; If you have not all ready done so please download
• ATF-Cleaner.exe by Atribune(Windows XP & 2K ONLY) You can put this on your Desktop for easier access.

Update the AVG Anti-spy program. Update your AVG Free Anti-virus program.

Show hidden files and folders.

Disconnect Completely from the Internet and Close ALL Browser Windows!

Now, reboot the computer in SAFE MODE

Using the F8 Method

1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
3. Select the option for Safe Mode using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode.

Now EACH and EVERY scan you have run show problems in your TEMPORARY files, If you had run the ATF-CLEANER properly you shouldn't be showing ANY temporary files, they all should have been erased. But the same ones are showing each and everytime. Please run this program in the exact manner given. BEFORE YOU DO ANYTHING ELSE

RUN ATF-Cleaner.exe.
-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK > EXIT

Now, open ATF-Cleaner.exe again. This time Click Firefox at the top.
Click Select Files to Delete.
Check the Select All Option
You should get a message asking if you also wish to delete Firefox saved passwords. You may choose NO if you wish.
-- Click Empty Selected > OK > EXIT

Now, run your NEWLY installed AVG Free Anti-virus program.
Tell it to fix EVERYTHING found.

– Please Launch AVG Anti-Spyware.
-- Click on the Scanner button and choose the Settings Tab.
---> Under How to act?, click on Recommended action and choose Quarantine to set default action for detected malware.
--->Under Reports make sure Automatically generate report after every scan is selected and UNCHECK the Only if threats were found box.
-- Leave everything else at their default settings and Select the Scan tab and CLICK Complete System Scan to scan your machine.
-- Upon completion of the scan, Click Apply all actions to place any detected baddies in Quarantine.
(you did not do this on the last scan and therefore nothing was fixed or quarantined. You must tell it to fix or quarantine anything found)
-- AFTER clicking Apply all actions, Click on Save Report and select Save the report to your Desktop.

Reboot the computer in NORMAL mode.
Run a new online Kaspersky Scan, save the log.
Run a new HJT scan, save the log.
Post back here with the NEW Kaspersky Scan, and the AVG Anti-spy log and a NEW HJT log.

[Pokey86]

If you had run the ATF-CLEANER properly you shouldn't be showing ANY temporary files,

I did run it exactly as you asked, but i've ran it again. & please don't apologise, you're helping me, i should be grateful, but i'm sure me saying thank you in ever post would probably get annoying


OK, I turned of System restore & updated all scanners. i ran ATF cleaner clearing BOTH parts as requested. I then ran AVG free & then AVG-anti-spy, both revealed nothing. All in safe mode of course.

Please find attached the Kaspersky, AVG & the HJT logs