Please check the logs, I "think" I cleaned it good.

[Mike]

Hi, I followed PhilliePhans do first instructions (Thanks Phillie) and I'm pretty sure it's clean. I had run SpybotSD and AdAware first as they usually take care of my problems... ran Kaspersky that my uncle had installed on this computer and that found a little bit, but I cannot find a log from that program to attach... Here are the requested logs and Thanks in advance for your help.

The only thing I had trouble with was that it seemed that searches (google,yahoo) were "seeded" with junk sites. I believe that is fixed now. Please just give me an A OK so I can return my uncles PC... he gets cranky with no internet.


****update****
It doesn't look like I did a very good job, I just ran SpybotSD again and it found:
BurstMedia
DoubleClick
FastClick
HitBox
MediaPlex
WebTrends live
Zedo

and the 3 windows security center overrides, I won't allow SD to clean it until you guys say it's alright to do so.

[jholland1964]

Sorry I missed this thread somehow Mike. I apologize.
Has that Kaspersky program been paid for and renewed? I really think it probably is out of date. From what I find current version is 8.0
This program listed in the Uninstall list is a rogue program. Uninstall it.
Internet Antivirus (1.1.2.0)

You mention

and the 3 windows security center overrides,

but WHAT overides? I don't see any mention of those anywhere.
As far at the things noted in Spybot scan, sounds like the Browser security is NOT set to only accept 1st party cookies and block 3rd party cookies.

[Mike]

Hello jholland,
No apologies necessary, Thank You very much for coming to my aid. I haven't done too much to this computer as it is not mine, but I will set the browser security higher, upon actually reading what spybot is telling me I realize now that they are only cookies... what is odd is that I've run both CCleaner and ATF cleaner and haven't visited any sites other than this one since.

I attached a pic of Spybot's findings, the overrides seem to just happen when a third party antivirus/firewall solution is in place.

When I try to uninstall Internet Antivirus it says "error, would you like to remove the entry"... I believe Spybot cleaned this up (hopefully well enough).

I'm not sure if kaspersky is paid for and updated, I may put Avast on his machine instead and tell him to stop paying if he is. He's pretty old and can't afford any non necessary things. I've already put Firefox on and will show him how to use it, set the teatimer protection on SpybotSD and I will put Zonealarm on as well.

Otherwise, everything look ok?

Pic attached

[jholland1964]

NO...you DO NOT want TeaTimer. It is more trouble than it is worth. It also interferes with fixes done by other programs by overriding them. Leave it turned OFF.
Before putting another antivirus program on be sure to totally UNINSTALL any other one. There is also a remnant of Norton showing on the HJT log which will need to be fixed.
Also TURN off that AdAware Service...it does absolutely NOTHING UNLESS the program is the paid version.
Go ahead and uninstall that Kaspersky. Download, install, update AVAST or Antivir Free av both are excellent.
If it were my computer I would take the AdAware off all together. It just isn't the program it once was.
Leave on the Spybot but dont' use TeaTimer.
Add this program SpywareBlaster
I wouldn't run my computer without it. It will definitely stop those tracking cookies...it is FREE also.
It will do the following;

• Prevent the installation of ActiveX-based spyware and other potentially unwanted programs.
• Block spying / tracking via cookies.
• Restrict the actions of potentially unwanted or dangerous web sites. Blocks spyware, adware, browser hijackers, and dialers

Download, install, update and enable. Works with IE and Firefox. Be sure to enable Restricted sites portion too.
Do all that, shut down, reboot and then run a new HJT scan and post back and I will give you needed fixes to be done with HJT.
Judy

[Mike]

Hi Judy,

My uncle insists on keeping "pay for" antivirus no matter how much I tell him Avast is a fantastic program (I've had one problem in the past 3 yrs using it, AND it was my own stupidity).

I love having Teatimer on my own computer... can be annoying sometimes, but It's great to see all the registry changes it catches that my antivirus doesn't warn me aboutL. I will take your advice on my uncle's though because he would be calling me every five minutes. I'm reconsidering Zonealarm for that reason too.

I've removed Ad-Aware as per suggestion and installed, enabled and updated SpywareBlaster.

New HJT attached.

[jholland1964]

Frankly, there should be registry changes taking place on a computer if it is well protected, unless you are downloading unknown programs or doing a lot of P2P file sharing. But this is your own choice.
Only fix I see with HJT is this one
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
Judy

[Mike]

Thank You so much Judy, I thought it was pretty clean... since the pop-ups stopped. If I can talk him into removing Kaspersky, is there a good program for removing the remnants or would I have to do this with HJT (with your help of course ).

Also, should I address the leftover Norton that you saw or is it nothing to worry about?

You make the internet a somewhat safer place!!!

Curiosity killed the computer... I'm guilty of downloading any and all unknown programs I can find. No more p2p for me unfortunately, not since the record companies started suing for millions. I always figured that teatimer was a third line of defense catching changes that are made by brand new viruses and/or spyware. I guess it's just another false sense of security for me.

[Mike]

Apparently Firefox doesn't make it too easy to block third party cookies so I won't bother with that either, I'll just tell him to make sure to have a glass of milk ready to have with all his cookies. At least they aren't responsible for browser hijacking or identity theft.

[jholland1964]

Apparently Firefox doesn't make it too easy to block third party cookies so I won't bother with that either, I'll just tell him to make sure to have a glass of milk ready to have with all his cookies. At least they aren't responsible for browser hijacking or identity theft.

Blocking third party cookies in Firefox is very simple. Click Tools, Options,
Privacy. Make sure there is NO check mark in Accept Third Party Cookies and there IS a check mark in Accept Cookies. This will allow the first party cookies. It also allows session cookies which are the cookies loaded from web sites which have various pages you wish to go through. When you close that website the session cookies are automatically deleted.

I always figured that teatimer was a third line of defense catching changes that are made by brand new viruses and/or spyware. I guess it's just another false sense of security for me.

Try SpywareBlaster yourself. You will truly be amazed. I run Spybot scans weekly...it finds NOTHING!