[evilfantasy]

Time to do some cleanup and secure the work you have done.

• Click START then RUN
• Now type Combofix /u in the runbox
• Make sure there's a space between Combofix and /u
• Then hit Enter.

• The above procedure will:
• Delete the following:
• ComboFix and its associated files and folders.
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Set a new, clean Restore Point.

----------

Run the Kaspersky Online Scanner

In Microsoft Windows Vista, you must open the Web browser using the Run as Administrator command. From the Desktop right click the icon to open the browser and choose Run as Administrator.

• Click on SCAN NOW
• Click Accept.
• The program will then begin downloading the latest definition files.
• Once the files have been downloaded locate the Scan Settings and have it scan My Computer.
• The scan will take a while, so be patient and let it finish.

When the scan is done, in the Scan is complete window, any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.

To obtain the report:
Click on: Save Report As

• Next, in the Save as prompt, Save in area, select: Desktop.
• In the File name area use KScan, or something similar.
• In Save as type: click the drop arrow and select: Text file [*.txt]
• Then, click: Save

Copy and paste the Kaspersky Online Scanner Report in your next reply.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

[moggyjo]

KASPERSKY ONLINE SCANNER 7 REPORT
Monday, December 22, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, December 22, 2008 15:12:59
Records in database: 1500614
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
Scan statistics:
Files scanned: 94275
Threat name: 1
Infected objects: 1
Suspicious objects: 0
Duration of the scan: 01:48:39

File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5FEC37BF.tmp Infected: Exploit.VBS.Phel.i 1
The selected area was scanned.

I also have a problem with 3 AOL screens that keep coming up when I get into some sites, do you know how I can stop this, they are my provider

[evilfantasy]

* Double-click OTMoveIt3.exe to run it.
* Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)

:Processes
explorer.exe

:files
C:\Documents and Settings\All Users\Application Data\Symantec

:Commands
[emptytemp]
[start explorer]

* Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
* Click the red Moveit! button.
* Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot your computer in order to finish the move process. If asked to reboot, choose Yes.

----------

Originally Posted by moggyjo

I also have a problem with 3 AOL screens that keep coming up when I get into some sites, do you know how I can stop this, they are my provider

I'm not sure I understand. What do the screens have on them?

[moggyjo]

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine moved successfully.
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus moved successfully.
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate moved successfully.
C:\Documents and Settings\All Users\Application Data\Symantec moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\hsperfdata_wendy\2152 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\hsperfdata_wendy\5104 scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\fb_704.lck scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF5B2C.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF5B45.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF6510.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF9D50.tmp scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\wendy\LOCALS~1\Temp\~DFED54.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\mcmsc_7JFHOK6VRZ67hU5 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_Dc3FhDRtZanvfaG scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_deg6dbaRw1ulUSh scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\mcmsc_Xn8tF86d3hdULG4 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_b34.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_b64.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_2mncqkNcDAKK3v2 scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_758pvmVomMb810e scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_FiVfXJzCsKvfLrL scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_LRW3b9Zrx4D3Jhk scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_tKLc2BFe4SshB9k scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_VtlEuZUnzoh5QvS scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\sqlite_WUWT9mCv8mB4VNh scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS\temp\WFV22.tmp scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12222008_230957
Files moved on Reboot...
File C:\DOCUME~1\wendy\LOCALS~1\Temp\hsperfdata_wendy\2152 not found!
File C:\DOCUME~1\wendy\LOCALS~1\Temp\hsperfdata_wendy\5104 not found!
File C:\DOCUME~1\wendy\LOCALS~1\Temp\fb_704.lck not found!
File C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF5B2C.tmp not found!
File C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF5B45.tmp not found!
C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF6510.tmp moved successfully.
C:\DOCUME~1\wendy\LOCALS~1\Temp\~DF9D50.tmp moved successfully.
C:\DOCUME~1\wendy\LOCALS~1\Temp\~DFED54.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\mcmsc_7JFHOK6VRZ67hU5 not found!
File C:\WINDOWS\temp\mcmsc_Dc3FhDRtZanvfaG not found!
C:\WINDOWS\temp\mcmsc_deg6dbaRw1ulUSh moved successfully.
File C:\WINDOWS\temp\mcmsc_Xn8tF86d3hdULG4 not found!
File C:\WINDOWS\temp\Perflib_Perfdata_b34.dat not found!
C:\WINDOWS\temp\Perflib_Perfdata_b64.dat moved successfully.
C:\WINDOWS\temp\sqlite_2mncqkNcDAKK3v2 moved successfully.
C:\WINDOWS\temp\sqlite_758pvmVomMb810e moved successfully.
C:\WINDOWS\temp\sqlite_FiVfXJzCsKvfLrL moved successfully.
C:\WINDOWS\temp\sqlite_LRW3b9Zrx4D3Jhk moved successfully.
C:\WINDOWS\temp\sqlite_tKLc2BFe4SshB9k moved successfully.
C:\WINDOWS\temp\sqlite_VtlEuZUnzoh5QvS moved successfully.
C:\WINDOWS\temp\sqlite_WUWT9mCv8mB4VNh moved successfully.
File C:\WINDOWS\temp\WFV22.tmp not found!

[evilfantasy]

3 AOL screens that keep coming up when I get into some sites,

Can you describe this a little better?

[moggyjo]

Hi a few weeks ago, I used a AOL email address then It said something about did I want to have AOL as my front page I clicked yes, that is when the problem started. I get the full start page for email along the top of the page the rest is blank then there is a smaller, sign in page and then the password box. these come up frequently when I open up applications like Pogo games. I would like to stop this happening.

Are there any more things I have to do regarding "This programme is not responding"

Thankyou for helping and Merry Christmas

[evilfantasy]

Uninstall AOL Registration and see if it goes away.

----------

Reset Settings in Internet Explorer 7

Go to Tools Menu, Internet Options, Advanced Tab and click on Reset… button.

Is the "This programme is not responding" problem still there?

[moggyjo]

I am still getting it also programmes seem to run a bit slow and start up takes forever.

[evilfantasy]

Try resetting your web settings.

Reset settings for Internet Explorer 6

Reset Explorer Settings IE 6

Reset Settings in Internet Explorer 7

Reset Explorer Settings IE 7