Hi BigMike and welcome to daniweb.
You need to first do the following;
Please download Malwarebytes' Anti-Malware (MBA-M) to your Desktop.
* DoubleClick mbam-setup.exe and follow the prompts to install MBA-M.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Please Run the ESET Online Scanner and attach the ScanLog with your post for assistance.
* You will need to use Internet Explorer to to complete this scan.
* You will need to temporarily Disable your current Anti-virus program.
* Be sure the option to Remove found threats is Un-checked at this time (we may have it clean what it finds at a later time), and the option to Scan unwanted applications is Checked.
* When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.
Finally please do this also. Download HiJackThis Please run a Full System scan with HiJackThis. When it is complete Save the log.
Post back here with all three requested logs and we will decide if other steps should be taken.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
No problem Mike, I will check back here tomorrow.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Looks pretty good Mike.
Did you set the restrictions shown here in your HJT log?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
I would advise that you download and run ATF-Cleaner by atribune to remove all your temp files.
Download it to your desktop for easy access.
-- Click on ATF-Cleaner to run it
-- Where it says Select Files To Delete, Check the Select All Option
-- Click Empty Selected > OK
If you use Firefox browser, do this also:
* Click Firefox at the top and choose Select All from the list.
* Click the Empty Selected button.
* NOTE : If you would like to keep your saved passwords, click No at the prompt.
Your Java is out of date and definitely should be updated.
Download the OFFLINE install from HERE and save it to the desktop.
Once you have it downloaded then go to Add/Remove and Uninstall ALL previous versions of Java found there.
Reboot your computer.
Then click that Java install icon on the desktop to install the newest version.
Once the install is complete then go back to the Java Download page and on the right side you will see Verify Now. Click that to verify that the installation was complete.
I would recommend that you also download and install a MUST have security program called SpywareBlaster from javacoolsoftware. An EXCELLENT and FREE program which will do the following;
* Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.
* Block spyware/tracking cookies in Internet Explorer and Mozilla Firefox.
* Restrict the actions of potentially unwanted sites in Internet Explorer.
Download, install, update and ENABLE all protection. Then CLOSE the program. It DOES NOT run in the background but provides a huge amount of protection.
I would advise also that you KEEP the MBA-M program. Run it at least weekly to remove any nasty items found, though with SpywareBlaster you will probably find few to none.
Be sure to UPDATE MBA-M each time before you run a scan. By the way, for general weekly scanning with it just the Quick Scan setting is probably enough. If you see some problems developing the do the Full Scan.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Ok Mike, there is obviously more working here than shows in any of the logs.
There are a couple "odd" entries, that supposedly are legit listings but I have never seen before in any log that I do question.
Did you place the restrictions shown in this entry? This isn't one of the odd ones, I have seen this before but need to know if YOU did this.
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
Did you reboot the system IMMEDIATELY after running MBA-M?
Where are you located?
Are you familiar with the following;
Tax Administration of the Republic of Slovenia. ?
I DO need the answers to those questions.
Download Smitfraudfix to the desktop.
* Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
* Double-click SmitfraudFix.exe
* Select 2 and hit Enter to delete infect files.
* You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
* The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.
* A reboot may be needed to finish the cleaning process. Go ahead and allow the system to reboot. The report can be found at the root of the system drive, usually at C:\rapport.txt
Please post that log here, just copy/paste do not attach.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
After you run that Smitfraudfix, post me a new HJT scan log too please.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Not a problem we would rather not have to open attachments anyway.
Can you run a new MBA-M scan and fix anything found and then post that log?
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
Mike,
Go into Safe Mode and look for the following;
C:\Program Files\Internet Cleaner\
If you find that entry, delete it.
Reboot to normal mode and then can you run HJT again and put a check mark next to the following entries;
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\Program Files\Internet Cleaner\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\Program Files\Internet Cleaner\ICleaner.exe (HKCU)
O23 - Service: Window Image Worker (windownetpker) - Unknown owner - C:\Program Files\Internet Explorer\svchost.exe (file missing)
Once you have place the check mark click the Fix Checked button.
Exit HJT.
Reboot and run a new HJT scan and post that log here.
Judy
jholland1964
Posting Expert
5,785 posts since Jul 2008
Reputation Points: 725
Solved Threads: 340
