[blade2buddy]

As added information, while waiting I've turn ON MS Firewall and MS Updates. If I should turn those back off while we're working on this, please let me know.

[evilfantasy]

There is still a few things left to remove.

You can leave them on. We're almost done now.


Download OTM by OldTimer to your desktop.

Note: If you are running on Vista, right-click on OTM.exe and choose Run As Administrator.

* Save it to your Desktop.
* Double-click OTM.exe to run it.
* Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

:Processes
explorer.exe

:files
c:\windows\Tasks\A954ED28918B60EC.job
c:\docume~1\owner\applic~1\adminf~1\Phone Size Link.exe

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

* Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
* Click the red Moveit! button.
* Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.

* Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes. If not, reboot anyway.

[blade2buddy]

All processes killed
========== PROCESSES ==========
Process explorer.exe killed successfully!
========== FILES ==========
c:\windows\Tasks\A954ED28918B60EC.job moved successfully.
c:\docume~1\owner\applic~1\adminf~1\Phone Size Link.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49152 bytes

User: LocalService
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat scheduled to be deleted on reboot.
->Temp folder emptied: 65536 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: Owner
->Temp folder emptied: 222169 bytes
->Temporary Internet Files folder emptied: 1606653 bytes
->Java cache emptied: 25493434 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 120849 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 26.31 mb


OTM by OldTimer - Version 3.0.0.6 log created on 10262009_131728
Files moved on Reboot...
Registry entries deleted on Reboot...

[evilfantasy]

How is the computer running now?

* Click START then RUN - Vista users press the Windows Key and the R keys for the Run box.
* Now type Combofix /u in the runbox
* Make sure there's a space between Combofix and /u
* Then hit Enter

* The above procedure will:
* Delete the following:
* ComboFix and its associated files and folders.
* Reset the clock settings.
* Hide file extensions, if required.
* Hide System/Hidden files, if required.
* Set a new, clean Restore Point.

[blade2buddy]

Much, much, much faster. No &(@OUIO#*) pop-ups . I can get at the Control Panel and set the firewall.

Bless you.

How much of this stuff can I remove before I give the system back to my friend? (e.g. CCleaner, HiJackThis, SUPERAntiSpyware, Malwarebytes, JavaRa, dds, OTM) How much should I leave installed?

I'm only accustomed to using Avira AntiVir and usually use SpyBot on top of that, but can leave one of these if its better (more recommended).

[evilfantasy]

You can uninstall HijackThis.

Leave the others. Update and run them now and then. CCleaner can be used daily to keep the junk to a minimum.

1. Double click OTM to launch it.
Vista users right click and choose Run As Administrator
2. Click on the CleanUp! button.
3. OTM will download a list from the Internet, if your firewall or other defensive programs alerts you, allow it access.
4. Click YES at the next prompt (list downloaded, Do you want to begin cleanup process?)
5. When finished exit out of OTM.

----------

Use the Secunia Software Inspector to check for out of date software.
Out of date software has security vulnerabilities that malware can exploit.

• Click Start Now
• Check the box next to Enable thorough system inspection.
• Click Start
• Allow the scan to finish and scroll down to see if any updates are needed.
• Update anything listed.

----------

Go to Microsoft Windows Update and get all critical updates.

----------

Make sure all of your security programs are up to date and run scans with them regularly.

I suggest using WOT - Web of Trust. WOT is a free Internet security addon for your browser. It will keep you safe from online scams, identity theft, spyware, spam, viruses and unreliable shopping sites. WOT warns you before you interact with a risky website. It's easy and it's free.

SpywareBlaster - Secure your Internet Explorer to make it harder for these ActiveX programs to run on your computer. Also stop certain cookies from being added to your computer when running Mozilla based browsers like Firefox.
* Using SpywareBlaster to protect your computer from Spyware and Malware
* If you don't know what ActiveX controls are, see here

Protect yourself against spyware using the Immunize feature in Spybot - Search & Destroy. Guide: Use Spybot's Immunize Feature to prevent spyware infection in real-time. Note: To ensure you have the latest Immunizations always update Spybot - Search & Destroy before Immunizing. Spybot - Search & Destroy FAQ

Check out Keeping Yourself safe On The Web for tips and free tools to keep you safe in the future.

Also see Slow Computer? It May Not Be Malware for free cleaning/maintenance tools to help keep your computer running smooth.

[blade2buddy]

When I try to run Secunia Software Inspector, it give me a message "Your system does not appear to have Sun Java installed." I click through this because I know I downloaded and installed the most recent this morning. But is this a potential problem?


It also fails to load the Java applet after 50 tries, but allows me to continue anyway. Another problem?

I started the scan anyway and the progress beacon is moving. Its been a couple of minutes so far.



I'm waiting for the

[evilfantasy]

What browser are you using?

[blade2buddy]

IE Version 6.0.2900.2180.xpsp_sp2_gdr.070227-2254

[evilfantasy]

Try here. How do I enable Java in my web browser?