Drive problems

[jholland1964]

Go to C:\Program Files\Java\ and look for those two files. If you find them uninstall from there. If you don't find them don't worry about it, but DO install the new version as directed.
Uninstall VNCfree via Add/Remove
Then do look in for the file folder shown in red and if you find it, delete it. C:\Program Files\RealVNC\

[Pokey86]

Go to C:\Program Files\Java\ and look for those two files. If you find them uninstall from there. If you don't find them don't worry about it, but DO install the new version as directed.
Uninstall VNCfree via Add/Remove
Then do look in for the file folder shown in red and if you find it, delete it. C:\Program Files\RealVNC\

OK i looked for the 2 files but couldn't find them, so i installed the latest java offline then used the link you gave me for verification, i also uninstalled Real VNC & Checked it wasn't in programme files

the Kaspersky & HJT log is attached

[Pokey86]

Any updates on what to do? Or are you still working out a game plan (So to speak) Sorry for the persistency.

[jholland1964]

Pokey I am so sorry, have been tied up with other things for a few days and did not see your post.
Many of the items noted in the Kaspersky scan are located in System Restore and Temporary Internet Files.
Please turn off system restore this way;
Right Click My Computer.
Choose Properties, System Restore.
Place a checkmark in Turn Off System Restore. You will get a warning that you are turning this off. Click OK.

Next do the following; If you have not all ready done so please download
• ATF-Cleaner.exe by Atribune(Windows XP & 2K ONLY) You can put this on your Desktop for easier access.

Update the AVG Anti-spy program. Update your AVG Free Anti-virus program.

Show hidden files and folders.

Disconnect Completely from the Internet and Close ALL Browser Windows!

Now, reboot the computer in SAFE MODE

Using the F8 Method

1. Restart your computer.
2. When the machine first starts again it will generally list some equipment that is installed in your machine, amount of memory, hard drives installed etc. At this point you should gently tap the F8 key repeatedly until you are presented with a Windows XP Advanced Options menu.
3. Select the option for Safe Mode using the arrow keys.
4. Then press enter on your keyboard to boot into Safe Mode.

Now EACH and EVERY scan you have run show problems in your TEMPORARY files, If you had run the ATF-CLEANER properly you shouldn't be showing ANY temporary files, they all should have been erased. But the same ones are showing each and everytime. Please run this program in the exact manner given. BEFORE YOU DO ANYTHING ELSE

RUN ATF-Cleaner.exe.
-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK > EXIT

Now, open ATF-Cleaner.exe again. This time Click Firefox at the top.
Click Select Files to Delete.
Check the Select All Option
You should get a message asking if you also wish to delete Firefox saved passwords. You may choose NO if you wish.
-- Click Empty Selected > OK > EXIT

Now, run your NEWLY installed AVG Free Anti-virus program.
Tell it to fix EVERYTHING found.

– Please Launch AVG Anti-Spyware.
-- Click on the Scanner button and choose the Settings Tab.
---> Under How to act?, click on Recommended action and choose Quarantine to set default action for detected malware.
--->Under Reports make sure Automatically generate report after every scan is selected and UNCHECK the Only if threats were found box.
-- Leave everything else at their default settings and Select the Scan tab and CLICK Complete System Scan to scan your machine.
-- Upon completion of the scan, Click Apply all actions to place any detected baddies in Quarantine.
(you did not do this on the last scan and therefore nothing was fixed or quarantined. You must tell it to fix or quarantine anything found)
-- AFTER clicking Apply all actions, Click on Save Report and select Save the report to your Desktop.

Reboot the computer in NORMAL mode.
Run a new online Kaspersky Scan, save the log.
Run a new HJT scan, save the log.
Post back here with the NEW Kaspersky Scan, and the AVG Anti-spy log and a NEW HJT log.

[Pokey86]

If you had run the ATF-CLEANER properly you shouldn't be showing ANY temporary files,

I did run it exactly as you asked, but i've ran it again. & please don't apologise, you're helping me, i should be grateful, but i'm sure me saying thank you in ever post would probably get annoying


OK, I turned of System restore & updated all scanners. i ran ATF cleaner clearing BOTH parts as requested. I then ran AVG free & then AVG-anti-spy, both revealed nothing. All in safe mode of course.

Please find attached the Kaspersky, AVG & the HJT logs

[jholland1964]

BRAVO!!!!( I know PP won't mind that I have borrowed his dancing bananas for this one!) You said it yourself...

I then ran AVG free & then AVG-anti-spy, both revealed nothing

The Kaspersky log is CLEAN also! This computer is CLEAN!!!
I see nothing in the HJT log either EXCEPT...are you running Windows Firewall? No firewall is showing but the Windows Firewall does not show. If you don't have it on then turn it on.

Now I have a couple other things I want you to do and I am also going to ask PP to take a look at everything just to be sure we got it all and I am leaving on vacation in a couple hours so he will take a look too.
But I want you to download and install SpywareBlaster
Update it and then enable everything, including Restricted Sites. This will help to protect your computer even more and this nice program DOES NOT run in the background. Just enable all and close the program.
Re-enable your System Restore and you should be good to go!
Like I said, I will have PP take a look just to be certain so he could have another step or two. But it sure looks good right now.

[TurcoLoco]

Great Job Judy!! I doubt PP would mind you borrowing his bananas, afterall he is tied up with Baseball games at the moment.

In case if he can't get back promptly, Pokey, I'd suggest that you consider getting rid of the following startup entries as they are far from needed in startup:

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

*** You could also get rid of these ones as well unless you like or need them in the startup (again they are not essential but your call):

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - Global Startup: gwum.lnk = C:\Program Files\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Watch.lnk = C:\Program Files\Mustek 1200 UB Plus\Driver\WATCH.exe

Additionally, if you like, you could run a simple scanner that I created which scans for certain file extensions with certain characteristics, so it is fast and completely pasive. Since it doesn't use a database, it was successful in spotting leftovers on other test subjects. Let me know.

~TL