- Referred by DomHennig -

[JaclynCrummey]

here it is... I'm now going to run the other three scans again. and will post those logs as well.

[JaclynCrummey]

here is the new Malwarebytes Anti-Malware Log. Next, running combofix.

[JaclynCrummey]

here is the last two logs, Combofix and Hijackthis.

If theres anything else I should do, please let me know!

Thanks in advance.

[DomHennig]

Judy,

I already told her about the last post you gave me about my computer:

Things look fine to me.


Ok, ONE anti-virus program, ONE firewall....as noted before any of those that PhilliePhan notes HERE are ALL excellent programs.
As I said, I am using Antivir. I am also using the built in Windows Firewall. Both have worked well for me. But for those doing a lot of downloading, gaming or (heaven forbid) P2P file sharing (which is dangerous in itself) I would go with one of the firewall's that PP notes in his thread. PP's advice is always right on so you CAN trust anything you would choose that he lists.
For anti-spy program I use SpywareBlaster. I DO NOT have any antispy programs that run all the time in the background.
For scanning I use SpyBot S & D and Malwarebytes-Anti-Malware. I use them weekly after manually updating each. I also update SpywareBlaster weekly. Some weeks it has updates, some weeks it doesn't. I use ATF-Cleaner at weekly to keep my temp files cleaned out. I also have my browsers set to accept ONLY 1st party cookies and to block 3rd party cookies. They also allow session cookies, which are the cookies used by a website while you are on it to make surfing on different pages of the website easier and faster. Those do not stay on the computer once you leave the particular website. I use the pop up blocker on both Firefox and Internet Explorer.
My Anti-vir auto updates at least daily, sometimes more than once and I scan with it once a week.

So once your done with her, and tell her what she needs to do after u read all those scans, I'll go over there and get all those going on her computer too. (It's my girlfriend, she lives about 4 miles away )
Edit/Delete Message

[jholland1964]

here is the last two logs, Combofix and Hijackthis.

If theres anything else I should do, please let me know!

Thanks in advance.

Am going through all the logs right now. So far looks like most have been removed. But give me a little bit to be sure.
Judy

[JaclynCrummey]

ok thankss

[jholland1964]

I think things look pretty good. Few things to do first....
Update your Java program, you are running an out of date version.
Go HERE and download the latest version, choose the Offline install and download it to the desktop.
Once it is downloaded then go to Add/Remove and uninstall all old Java versions listed there, a reboot may be required and if so go ahead. Once the old Java versions are uninstalled then install the newest version by double clicking the file on the desktop. A word of precaution, with this newest version they also offer the free program Open Office, it IS a good program, comparable to Microsoft Office BUT if you do not want this also be sure to remove the checkmarks from the areas giving the ok to download it.

Once the new version of Java is installed go back to the download page I gave you above and on the right side of that page you will see Verify. Click that and verify that your new Java was installed correctly.

Next go back to Add/Remove and uninstall AdAware 2007. While AdAwareSE was a good program this newest version just isn't as good as those previous. Plus, it has a guard which runs all the time in the background. I have been recommending that folks just not use it. It isn't a bad program, just not as good as previous versions.

Another comment, I note from your logs that you have installed Limewire which is a P2P file sharing program. Limewire itself is a clean program from what I understand, I don't do P2P file sharing so I cannot speak from experience on that BUT...P2P itself can be quite dangerous. WHY? Because you don't really know who you are sharing the file with and exactly what it contains. I like to use this analogy;
You walk into a restaurant, take a table and there on the table is a turkey sandwich, exactly what you were going to order...looks good, "might be" a very tiny bite taken out of it, but it could just be a little bit of the crust broken off, not a bite... what the heck...it is FREE and it normally would cost you $5.00...would you actually pick up that sandwich and eat it because it is FREE not knowing who had it, who touched it, who might have taken a bite out of it? I doubt it.
P2P file sharing is some what the same...you can get a "shared" version of Adobe Photoshop (or whatever expensive computer program you want to purchase)....normally the full version costs $699 to $999...or a $20.00 music CD... but you can "share" it from somebody for FREE...come on...first of all, think about it...if YOU had purchased this nearly $1000 Photoshop program or the $20 music CD would YOU give them away to somebody you don't know who asked for FREE...doubt it. So more than likely somebody has hacked a copy of Photoshop and is willing to hand it out to anyone who wants it FREE...consider..just like the turkey sandwich...what else might come in with that FREE with those $999 Photoshop or $20.00 music CD? Viruses, trojans...not even mentioning that this is a crime, it is a violation of the copywrite laws. Didn't mean to get "preachy" here but have seen so many posts here and other boards where you can tell for certain the poster has infected his computer by P2P file sharing, something that needn't ever happened.

Now, back to business at hand, and I forgot to tell Dom to do this so Dom if you are reading this you also need to do this;

Uninstall ComboFix.exe And all Backups of files that it deleted

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

When shown the disclaimer, Select "2"

After that then run HJT again and put checkmarks next to the following entries if they still exist;
O2 - BHO: (no name) - {B7D8771B-4627-4EBE-8924-52FC713B1290} - C:\WINDOWS\system32\adsldpm.dll (file missing)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

Once you have placed the checkmarks click the Fix Checked button.
Exit HJT.

I did give Dom instructions and link for CodeStuffStarter or Mike Lin's Startup Control Panel
for use controlling unnecessary starts. The way I listed above is a quick way to do this too but I recommend that you use these programs to control them in the future, since HJT is essentially a scanner program not a fixer. In fact once you have completed the above steps you can actually delete HJT and hopefully you won't need it again. If you do you can always download a new and updated version.
Reboot the computer. Now you will need to set a new, clean System Restore point. To do so Right Click My Computer. Choose Properties. Once System Propterties opens then click the System Restore Tab. Put a checkmark in Turn Off System Restore and click OK. You may get a warning telling your that you are turning it off, click ok and let it go off. Wait a moment and do the reverse and turn it back on.

Since Dom has all ready posted the information I gave him on what to do after you have done all of this I won't post it again. Use that info I gave him and things should be good.
Judy

[DomHennig]

Alright thanks a lot judy,

hey what programs do you think she should not have running at start up by looking at her logs, and i will stop those when i go over later tonight

[jholland1964]

Other than those I noted in my HJT fix for her I don't see any. Think she has that part really pretty well under control. If you want, once you get over there if you want to you can open HJT and click on Misc. Tools. At the top is a button which will give you a list of Start ups. You can do that and post it if you wish, but from what I seen in the regular log it seems as if she doesn't have too many that are not necessary.
Judy

[JaclynCrummey]

Hey Judy,

I just got over here with enough time to sit down. attached is the start up list. Ill work on everything else now