| View previous topic :: View next topic |
| Author |
Message |
Lissa
Cadet
Joined: Dec 25, 2003
Posts: 8
Location: USA
|
|
| Back to top |
|
 |
OrphanAnnie
Security Expert
Joined: Dec 04, 2003
Posts: 2278
|
 Posted: Fri Dec 26, 2003 7:03 am Post subject: |
|
|
Welcome to Computer Cops Lissa. Your log looks fine apart from the fact that you have Spykiller installed. I have tested this program and it is a menace. It identified valid registry entries as spyware and had I paid the bucks, it would have trashed my OS. Uninstall it and download Spybot - Search & Destroy from here. My standard instructions for use below:
If you already have Spybot on your PC, make sure that it is the latest version and go online and install the latest updates. If you already have Spybot on your PC, make sure that it is the latest version and go online and make sure that you have installed the latest updates. This is VERY important.
After installing, launch Spybot from the Desktop Icon (Easy Mode),click on the Search For Updates button, search for and install all updates.
Now click on the Check for Problems button and the scan will start. Any Red entries indicate spyware problems that should be fixed to avoid security and/or privacy problems. This is the only kind of problem that is preselected to be fixed. If, after running the scan, Spybot displays red entries, click on the Fix Selected Problems button.
Now click on the Immunize button to protect your PC from known pests and exit.
If you have chosen to install an icon in your Quick Launch bar, Spybot will launch in Advanced Mode. I do not recommend this option for first time users of Spybot.
NOTE: SSD will sometimes not be able to remove all active components in the first 'run'. In that case you will get a dialog asking you to run SSD at next start. Click yes and reboot.
SSD will activate before the system puts these components 'in use', and it will then be able to 'fix' the rest.
Where did Norton say the trojan dropper was (the file path)?
Re port 1024, it is almost impossible to close ports using freeware however it's worth a try. Shut down WinXP's firewall (I assume that you are running XP) and go here and install Sygate and reboot. When you have done this, go here, scroll down and run ShieldsUP! Post back the results.
|
|
| Back to top |
|
|
Lissa
Cadet
Joined: Dec 25, 2003
Posts: 8
Location: USA
|
|
| Back to top |
|
|
Lissa
Cadet
Joined: Dec 25, 2003
Posts: 8
Location: USA
|
| Posted: Fri Dec 26, 2003 8:12 pm Post subject: File infected |
|
|
The file that Norton Antivirus identified as infected was
C:\DocumentsandSettings\Owner\LocalSettings\TemporaryInternetFiles\Content.IE5\KEA4F58L\New[1].hta.
States unable to access.
Thank You
Lissa 
|
|
| Back to top |
|
|
CalamityJane
Security Expert
Microsoft MVP
Joined: Oct 05, 2002
Posts: 4004
|
| Posted: Fri Dec 26, 2003 8:32 pm Post subject: |
|
|
Hi Lissa 
First, you cut off the top part of your log that shows us what Operating System you have and some other details that would help us help you a little better.
First you need to empty your Temporary Internet Files (TIF) and clear your cache. You can also empty your TEMP folder. If you need help with directions on that let us know what your OS is, we can give you step by step instructions. Emptying those will clear out the infected file that Norton is giving you.
As for your Spybot question, I have a tutorial I made for my new users that has screen shots on how to determine what items to fix in the program. Basically, the unchecked items you can right click on them an get a description from the program as to what it is and what it does and also what Spybot can do to correct the problem for you. In fact, if I recall correctly, there is a box you can check after a Spybot Scan that will clear your Cache for you (the files I described above).
Anyhoo....perhaps this will help explain how it works:
My very short Spybot Tutorial to set up and scan the first time
http://forum.gladiator-antivirus.com/index.php?showtopic=8630
And this is a more detailed Tutorial that will help you in using Spybot:
How to Use Spybot
http://spybot.eon.net.au/index.php?lang=en&page=knowledgebase/getstarted
_________________
Microsoft MVP/Windows Security 2003-2008
|
|
| Back to top |
|
|
Lissa
Cadet
Joined: Dec 25, 2003
Posts: 8
Location: USA
|
| Posted: Fri Dec 26, 2003 8:47 pm Post subject: |
|
|
Is this what you need?
Logfile of HijackThis v1.97.7
Scan saved at 3:44:13 PM, on 12/26/2003
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
|
|
| Back to top |
|
|
CalamityJane
Security Expert
Microsoft MVP
Joined: Oct 05, 2002
Posts: 4004
|
| Posted: Fri Dec 26, 2003 11:54 pm Post subject: |
|
|
Hi Lissa,
Yep That was the cut off part.
Now, how did you make out with emptying your TIF and TEMP files - do you need help with that?
Or any further questions or need help with Spybot? You could post your Spybot log if so. Mine is located here:
C:\Program Files\Spybot - Search & Destroy 1.1\Logs<---log folder and click on the file in there with the most recent date, copy and paste into your post here.
Once your PC is clean, you'll need to reset your restore points:
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot.
Turn ON System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
More information here:
How to Turn On and Turn Off System Restore in Windows XP
http://support.microsoft.com/default.aspx?scid=kb;en-us;310405
_________________
Microsoft MVP/Windows Security 2003-2008
|
|
| Back to top |
|
|
Lissa
Cadet
Joined: Dec 25, 2003
Posts: 8
Location: USA
|
| Posted: Sat Dec 27, 2003 2:06 am Post subject: |
|
|
Do I turn the restore system off before I run spybot and fix problems.....or do I fix the problems then turn off and reboot and turn on? Sorry I'm so confused....just want to make sure that I don't destroy system....I deleted temp internet files(cookies?)....unsure about folder???I fixed all checked items indicated by Spybot and ran another Trojan TCP scan and access to the port 1024 was denied. However I still have 68 red items in Spybot they were unchecked and I was unsure if I should check and fix.....Should I copy results and paste?
|
|
| Back to top |
|
|
OrphanAnnie
Security Expert
Joined: Dec 04, 2003
Posts: 2278
|
| Posted: Sat Dec 27, 2003 4:34 am Post subject: |
|
|
Anything that Spybot displays in red represents spyware/foistware or malware. You can safely choose to fix these items Lissa. Dont forget to reboot afterwards.
Regarding the file identified as infected in your Temporary Internet files. Close IE and go to Start > Control Panel and click on Internet Options. Click on the General Tab and delete all Temporary Internet Files and Offline Content. Reboot and run your AV again and let us know the results.
Wait until we have finished cleaning up your PC before you disable System Restore.
_________________
Microsoft MVP - Windows Desktop Experience 2004-2008
|
|
| Back to top |
|
|
Lissa
Cadet
Joined: Dec 25, 2003
Posts: 8
Location: USA
|
|
| Back to top |
|
|
OrphanAnnie
Security Expert
Joined: Dec 04, 2003
Posts: 2278
|
| Posted: Sat Dec 27, 2003 10:57 pm Post subject: |
|
|
Glad we could help Lissa. Yep, all you need to do now is to disable and re-enable System Restore (if you havent already dont this). If you wish to use an IM, either are fine to download. You may wish to consider Trillian though. Read about it here and then make up your own mind which you prefer.
As your problem is resolved, I'll close this thread. If you have any further problems and would like this thread re-opened, feel free to PM any of our staff.
_________________
Microsoft MVP - Windows Desktop Experience 2004-2008
|
|
| Back to top |
|
|
|
|
Forum FAQ
Search
Usergroups
Profile
Login to check your private messages
Login
and recieved warning 
but Norton Antivirus(updated) activity log states that it was identified but unable to repair or access. Since the notice have ran several checks with Norton Antivirus and symantec but no virus found. I'm computer illerated so any info would help...When I ran a Trojan TCP Scan at this site was informed that port 1024 was accessible....I ran hijack this and here is the results....Thank you for any assistance. Lissa
I downloaded Spybot and checked for updates. After running a system check several problems were found all in red...yet some were prechecked and others were not. I fixed those prechecked and now I have several that are red left.....do I need to check these and fix? Since I'm computer illerate worried that I may remove something vital 
. Again thank you for you help.
