HijackThis log... already did the stuff on the READ ME FIRST post...

[cerebus210]

first of all thanks to everyone involved with this site... the log analyzer is great and saved me some time for sure... could someone please take a look at this log and let me know if they see anything thats not supposed to be there? the computer was heavily infected when i got it but it seems to be running alot better now after following the steps in the READ ME first sticky post (and a couple other cleaners)...... thanks

[jholland1964]

first of all thanks to everyone involved with this site... the log analyzer is great and saved me some time for sure... could someone please take a look at this log and let me know if they see anything thats not supposed to be there? the computer was heavily infected when i got it but it seems to be running alot better now after following the steps in the READ ME first sticky post (and a couple other cleaners)...... thanks

Did you bother to read this thread?
If you did fixes based on what the analyzer told you then you may have done incorrect fixes. The analyzer here has not been updated since June of 2006. HJT is NOT a fixer program, it is a scanner program used AFTER all steps in the sticky are completed, the logs are saved THEN run HJT and there is a newer version available than the one that you used.
If you did the steps as instructed in the sticky then where are the other requested logs?.....what "couple other cleaners"?

Before I can advise with assurance I would like to see those other logs, and get the names of exactly what items were removed, how they were removed and their locations. I would also like to know exactly what symptoms were being shown by the computer.

[cerebus210]

wow......

Did you bother to read this thread? yes

If you did fixes based on what the analyzer told you then you may have done incorrect fixes. between the HJTscan and google searches i made an educated guess at what i did and didnt need

The analyzer here has not been updated since June of 2006. HJT is NOT a fixer program, it is a scanner program used AFTER all steps in the sticky are completed, the logs are saved THEN run HJT i understand that ands this (the readme 1st post) is the process that i followed

and there is a newer version available than the one that you used. the only reason i used that version is because the readme for the analyzer states "this present analyzer is configured to analyze logs from the earlier version of HiJackThis version 1.99.1 " if i need to install the new version and repost that log thats fine just let me know...


If you did the steps as instructed in the sticky then where are the other requested logs?..... i apologize, i forgot... the ESETlog is now attached and the AVG scan wouldnt let me save the report after i clicked apply all actions, so i dont have a log for that scan...

what "couple other cleaners"? ad-aware & spybot s&d

Before I can advise with assurance I would like to see those other logs, and get the names of exactly what items were removed, how they were removed and their locations. I would also like to know exactly what symptoms were being shown by the computer.


The initial symptoms were mostly slowness caused by startup and running processes along with a few random pop-ups... i believe the owner told me NAV found a virus and she thought she got rid of it but NAV would pop-up stating that a virus was quarentined everytime she restarted... she said it was in the file casino setup or something along those lines... hope that helps.... its starts up superfast now and i dont get any popups or notifications that there is spyware/malware/virus on the comp... i just want to make sure its safe to put up on the network again... thanks again for all your help

[jholland1964]

On that EST scan, you did ask it to repair right?
Didn't mean to come across in my first post as mean, sorry if I did. Reason being is mainly because we have no idea what was showing in the first HJT log and you have titled this one AFTER3 so must figure there were at least two others run, so we have no idea if there was something on the computer that requires multiple steps to remove. Many instances of malware look like one thing but end up being something else which require totally different fixes. Since that Analyzer was added there are multiple nasty items out there that it just doesn't even "know" to flag, it flags multiple files which are NOT bad and shouldn't be removed, because it's data base is nearly 2 years old.
Now you say the computer is booting much faster, I am not surprised because with the exception of the Norton program and it's related files there appears to only be 6 entries running at start up.
I don't have a clue what was running before and therefore cannot say if this speedy start is because malware has been removed or just because there were unnecessary start up items.

she said it was in the file casino setup

Well did you remove this casino set up?
See this is where I and others who read these logs are at a great disadvantage, because we don't know what was starting before, we don't know how these items were taken out of auto start, we don't know if the items were just one visible indication of something and we don't know what was removed and how it was removed. Was the Antispyware Shield program noted in the ESET log uninstalled? This is a varient of Spysheriff...Smitfraud infection.

1. Download this file and save to desktop -combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Attach this log back here

Note:

• Do not mouseclick combofix's window while it is running. That may cause it to stall.

[cerebus210]

I personally didnt remove the casino setup file but she did... Going by the note she gave me one of her anti- programs said there were bad files and gave the location.... she did a search and manually deleted these files:

setupcasino.exe
casinotropezsetup.exe
popcaploader.dll

I did not have the ESET automatically fix the errors, per the READ ME orders.....

I've attached the combo fix log... hope this helps & thanks again