Owned by Spyware!! Please Help?

[scraphog]

May I suggest a "windows update " after it is cleaned, and it seems close, also a java 2 update , so next time you need the online scans your computer will be less likely to not display them. The GDI plug in, java, and updated web components fix security vulnerabilities as they are updated as well. Prevention by frequent updates saves time cleaning "broken" systems later on.

[spyware_victim]

Thanks, but I updated windows already...I also updated Java too...

[jholland1964]

Things look pretty good really. Couple of things here...did you notice that much of the deleting done by BitDefender were emails? You seem to have quite a few...look at the numbers of those worked on...179, 204...That is an awful lot of emails to keep on your system. You really should make it a practice of getting rid of some of these. You really should delete them all the way out of Outlook Express. Those do take up room on the computer and these obviously had some suspicious content.
I clean out my Outlook Express once a week at least, sometimes more. If there are mails you want to keep, print them out and then delete them.
I would also recommend that you go to Add/Remove and uninstall SpyNoMore. Unless you purchased the program, if you purchased it then just leave it, but disable it's autostart feature. This is unknown to me and the only info I could find on it was how to purchase it, not how good it was...here we really recommend that you stick with proven programs, and the ones we highly recommend of course those in this link PROTECT YOURSELF FROM MALWARE: Tools & Tips
Personally I use AdWareSE, Spybot and SpywareBlaster and am quite pleased by all three.

There is one more fix with HiJackThis that you should do...
Close all browsers and open HiJackThis.
Click on Config, then Misc Tools, and then press the Delete an NT service.. button.
When it opens you should then enter RA Server and press OK.
This should remove
O23 - Service: RA Server (Slave) - Unknown owner - C:\WINNT\Slave.exe (file missing)
from your HJT logs.
Then run CCleaner one more time to get rid of anything hanging around in the temp files.

Judy

P.S. By the way scraphog, our poster here is running the most recent version of java.

[spyware_victim]

Thanks Judy , i'll do that now.

Do I need to take any steps to sort out the GRAYWARE that was found with one of the scans?(TSPY_PUPER).

To my knowlededge I didnt install the spyware prog you asked me to uninstall. In any case its not listed in control panel to even remove?

Unfortunately my most important work is in those emails, I deleted all the ones I haven't needed! Is there a programme I can get that lets me store them somewhere?

I've followed your RA Server steps on hjt, but it cant find it. Any other way?

Hope this helps

[jholland1964]

Let me do some more checking on that TSPY_PUPER, thus far I have found no usable info on it.
There are any number of ways you can save needed emails...of course the simplest is printing them. If these are very valuable to you I certainly would not recommend their storage on the computer itself. There is always a risk of losing everything on a computer...hard drive failure, viruses, erasure by mistake, etc. Let me do some checking on this too.
Judy

[spyware_victim]

Heya, I'm still getting explorer error msgs. Some sites im surfing just crash and ask me if i want to send report. Do I need to reinstall internet explorer? I have updated microsoft so I'm noit sure what else I can do? thanks

[jholland1964]

Give me the exact wording of these error messages. If possible give me a print screen of one of them. Don't bother sending error report...I am not even certain they go anywhere...LOL.
When one of these comes up click available buttons, with the exception of the error sending, to get as much info as possible. Are these explorer errors or Internet Explorer errors?

[spyware_victim]

I don't have a screen print, I gathered this info though...

Microsoft internet explorer

Microsoft Internet explorer has encountered a problem and needs to close.

Error signature
AppName: iexplorer.exe AppVer: 6.0.2800.1106 ModName: unknown
ModVer: 0.0.0.0 Offset:ffffffff

Another reads:

AppName: iexplorer AppVerunsure of this number) ModName: wininet.dll ModVer:6.0.2800.1559 Offset:000264c9

[jholland1964]

Could find no info on the first error but the second one I found this on the Microsoft website;

This behavior can occur if the AutoComplete feature for Internet Explorer or Windows Explorer is trying to use corrupted information in the History folder.

RESOLUTION
To resolve this issue:
1. On the Tools menu in Internet Explorer, click Internet Options.
2. Click the Advanced tab.
3. Click to clear the Use inline AutoComplete for Web addresses and Use inline AutoComplete for Windows Explorer check boxes.
4. Click OK.
5. Reboot your computer. Press and hold down F8 while the computer boots to display the Startup menu.
6. Choose Command Prompt Only, and then press ENTER.
7. Type the following items, pressing ENTER after each item:
cd\windows
deltree downlo~1
deltree tempor~1
deltree history
deltree cookies
NOTE: Press Y if you are prompted to confirm any deletion.

8. Reboot your your computer normally.
9. On the Tools menu in Internet Explorer, click Internet Options.
10. Click the Advanced tab.
11. Click to select the Use inline AutoComplete for Web addresses and Use inline AutoComplete for Windows Explorer check boxes.
12. Click OK.
You can test the AutoComplete feature by typing several different addresses in the Address box (one at a time):
1. Type www.msn.com and load the page.
2. Type www.yahoo.com and load the page.
3. Type www.msn and see if the AutoComplete list is displayed.

[spyware_victim]

Could find no info on the first error but the second one I found this on the Microsoft website;

I checked the 'Use inline AutoComplete for Web addresses' box. But there wasn't an option or listing for the other direction.

I got into the command prompts (cmd? i think it said at the top of the black box)
I THEN TYPED cd\windows and pressed enter & it said system cannot find path specified

Then i tryed cd\windows deltree downloa~1 and it gave thwe same error msg as above

I tryed various combinations of the other orders listed but the same error msg was given.


nb - What am I doing wrong? I feel a bit of a melvin here!!!
In startup I held down f8 and it brought me to the same option window as if i just pressed f8..I presume it doesn't make a difference?

Thanks Judy!