Help HJT please

[vancek]

I don't have a question, I just thought I'd tell you how things went.

I backed up everything I had on my computer. I had even less than I originally thought, so I went ahead and did the system restore. The restore only took about 10-15 minutes. When it brought the restore system back up, it appears that no files were lost. I gave it a quick once over and everything looked to still be intact. More importantly, IE was now working. I wanted to get the computer updated and secure, so I didn't spend much time looking around. I had about 10 HP upgrades to do before I could do any Windows updates. I had to do 68 Windows Security updates and dowloads before I could download SP2 (I'm not proud of that). I did get SP2 downloaded. As of this morning, I have a PC with updated Windows. I'm going to check to see if the Jave is up-to-date and I'm going to contact Norton to see about getting NAV 2008.

I enabled Windows to download their updates automatically as to not fall this far behind again.

[Gizmokid2005]

That's great news!!! Normally those will restore the computer to it's original working state, it sounds like it did so, but with keeping your documents in tact! That's good to hear. Glad this issue is finally resolved. Let us know if you need any help with anything.

[jholland1964]

I am absolutely THRILLED for you!!!!! I don't mind telling you I was really, really worried that all would become one nightmare after another.

I enabled Windows to download their updates automatically as to not fall this far behind again.

A VERY good idea for you.

my computer literacy isn't going to win me any contests

But look how much you have learned with this problem! See, it really isn't so hard if you take your time, do research and follow instructions.

YOU DID IT! I am so pleased! Pat yourself on the back!

The newest java version is Version 6 Update 2. Check in Add/Remove and you should see other versions there, UNINSTALL all of them first. I know your logs showed at least one way out of date version on the computer. There could be others listed there so be sure to uninstall all of them.

Then go here
to download this latest version. I always recommend the manual install.
Once you have downloaded the latest version then close out your browser and install the new version of java.
Once the install is complete then go here
to verify that the install worked.

THEN, go to this sticky PROTECT YOURSELF FROM MALWARE: Tools & Tips

Be sure to use a Firewall. Either the built in Windows firewall or one of those PP has on the sticky above. Remember though, JUST ONE firewall and JUST ONE anti-virus program.
Download and install SpyBot S & D. Update it and be sure to use the Immunize feature. DON'T use the TeaTimer portion of the program.

I would also recommend using AdAwareSE and most of all be sure to download, install, update and enable SpywareBlaster. This program is a MUST. It doesn't run in the background but offers superb protection against spyware, malware, tracking cookies and has a Restricted Sites portion that should be used also.. It works with both IE and Firefox, which I also believe you were using, continue to use Firefox it is much more secure than IE though of course IE must be used for Windows Updates.
Please keep us posted on how all is working. Can't tell you how pleased that all worked out!!!!

P.S. Just noticed this in your update.....

I'm going to contact Norton to see about getting NAV 2008.

If you don't have an anti-virus program on the computer then this should be priority #1.
I use Norton, have for years without difficulty, though I know some folks don't care for it...I do. If you want to go with a new Norton that is fine, especially since you are comfortable with it, but just go for the Anti-virus program. Don't go with their Norton Internet Security Suite. I only say this because I have seen so many have problems with it. Another option you do have is using one of the Free Anti-virus programs that PP has on his sticky. I have installed AVG on many computers I have worked on for friends and family and it is easy to use and they all have had very good luck with it. But any of those PP recommends are very good and offer extremely good protection. The choice is yours, just get one on there ASAP if you don't have one installed yet.

[jholland1964]

vancek,
I hope you WILL come back and bring us up to date, and when you do please post a new Kaspersky scan log, AVG Anti-spy log and a new HJT log...just to be safe ok?
Judy

[vancek]

Please check these logs.

[jholland1964]

Ok vance,
Sorry this has taken so long but I wanted to consult with ~TL and see if he agreed with what I thought was the way to go.
Now you can see by reading the newest Kaspersky log listed are;
Number of viruses found: 4
Number of infected objects: 4

Which is certainly better than your first and second and third Kaspersky logs which showed;

#1.
Number of viruses found: 26
Number of infected objects: 137
Number of suspicious objects: 6
#2.
Number of viruses found: 11
Number of infected objects: 95
#3.
Number of viruses found: 11
Number of infected objects: 97

So obviously things are looking MUCH better. Now two of these entries are shown in your System Restore so you can get rid of those immediately by stopping your System Restore right now and also, until we are certain all is well, changing it's startup type to 'Disabled.
I want you to do this now and do it this way;
Go to Start, Control Panel, Administrative Tools, Services.
Scroll down through that list until you see System Restore. Right Click and choose Properties,
When that opens I want you to click the Stop button. Once it is Stopped then I want you to click the Start Up Type to Disabled. Click OK. Then exit out of there. Then go to My Computer. Right Click and choose Properties. When the System Properties box opens choose the System Restore Tab and be certain that it IS turned off. Once you are certain it is turned off...there should be a checkmark in Turn Off System Restore...then MANUALLY run Disk Cleanup Manager
Do it this way;
Click Start > Run > cleanmgr /d c: > OK > It will scan and then show you what can be cleaned up.... click on "More Options" tab > click "clean up.." button under System Restore section at the bottom
(note* be sure to put a space between cleanmgr and the / and also a space between the d and c:

Now earlier in this thread I had you run ~TL's CleanUpXP+
you are going to need to do this again. If you do not still have it on the computer then you will need to download it again by clicking the link above.
Once you are certain you have CleanUpXP+ on the computer then please REBOOT the computer in SAFE MODE.

Once in Safe Mode double click CleanXP+ to run the program.

It will run a standard cleanup first of all the temp, Temporary Internet Files, Cookies, History and Recent,
Prefetch and Recycle Bin files on the system. After the standard cleanup, the program will prompt the you to see if a specific file/folder is to be removed.

Please choose Option 1. Remove a File:

This is the file you need to have the program remove;

C:\WINDOWS\wjkxdrtA.exe

Run CleanXP+ and then reboot into normal mode

Once all steps are completed successfully, and you have rebooted in normal mode make sure System Restore is not yet enabled.

If for some reason you see that it IS turned back on.. TURN IT OFF.

I will tell you when it is safe to turn it back on.

Now run a new Kaspersky scan and save the log and post it back here.
Judy

[vancek]

I did everything that you told me to. I was getting ready to post my Kaspersky log and decided to look at it out of curiosity. I noticed that file that you had me remove was still showing up as a Trojan. Although I had double checked it when I did it the first time, I rebooted into Safe Mode in order to try to remove it again. This time I double, triple and quadrupled checked it. Then I ran Kaspersky again. I don't know what to tell you, but it is still on there.

[jholland1964]

Ok then we will try another program.
Download Killbox


Killbox – single file delete on reboot
Double-click Killbox.exe to run it.

Select "Delete on Reboot".
Place the following line in bold in the "Full Path of File to Delete" box in Killbox:
C:\WINDOWS\wjkxdrtA.exe
Put a mark next to "Delete on Reboot"
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If your computer does not restart automatically, please restart it manually.

Try that one and then run a new Kaspersky scan and see what shows...this thing is a royal PAIN!!!

[vancek]

Normal or Safe Mode?

[jholland1964]

Well if you can run it in Safe Mode that would be best but I am not certain it will run in Safe Mode. Go that route first and see, if it won't work then do it in normal mode.

If it is STILL showing after Killbox then it is time for a second opinion visit www.virustotal.com

The site uses over 30 different well-known scanners to analyze the submitted file.

Step 1: Submit the file in question by clicking on Browse button to locate the file and select it.

So you will have to browse here and find the file noted;C:\WINDOWS\wjkxdrtA.exe

Step 2: Click Send button to have the file uploaded and queued for processing.

Step 3: Wait for scanning to complete; STATUS should read COMPLETED

You should then be able to go through and get the results for posting here.
Hopefully this will help us...don't know about you but this is driving me crazy! I thought the big problem would be the Recovery and updating of the system...boy was I wrong!!!!