A fool such as I.......

Hi, teekay10,

I won't give you a lecture, but do be more careful from now on. If you do any online banking and/or keep any passwords on there, you might want to change them in case this involves anything that could steal such info..
Please print these instructions so you can refer to them easily. You will be working in Safemode, and you will not have the internet until we are finished.

Please download Killbox from:
http://www.bleepingcomputer.com/files/spyware/KillBox.zip
Extract it to your desktop. Do not run it yet.

Boot into Safemode:
Turn on the computer.
Immediately begin tapping the F8 key (or F5 on some computers)
Use the arrow keys to highlight Safe Mode and press the Enter key.

Launch HijackThis and place a checkmark next to this item:

F3 - REG:win.ini: run=c:\windows\system32\dxdll\svchost.exe

Close all windows except HijackThis and click "Fix Checked".
Close HijackThis.

Still working in Safemode....

Open killbox.exe.

First..

Click on Tools>Delete Temp Files

A box will open with a list of all user profiles.

Check the following boxes at a minimum for each profile by clicking on the drop down and checking the boxes that are enabled. Some will not apply and those boxes will not be available to check. Make sure you do this for all the profiles listed.

Temporary Internet Files
Temp Files
XP Prefetch

If you want to clean your cookies, history, and list of recent files run you may check those boxes as well.

Then..

Check on the Button titled "Delete Selected Temp Files"

Exit by clicking the Button titled "Exit(Save Settings)"

Once back into the main killbox program.

Check the following boxes:

Delete on Reboot

Highlight the entry in the bold text below and then Copy it.
c:\windows\system32\dxdll\svchost.exe

Then in killbox click File>>Paste from Clipboard

At this point the "All Files" button should be enabled so you can click it.

Click the "All Files" button.

Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes

A second message will ask to Reboot now? You will need to click Yes to allow the reboot into normal mode.

Note: Killbox will let you know if the file does not exist.

If you have any issues with this method you can copy and paste the line into the killbox top box. Then click the "Single File" button. Then click the Red X ...and for the confirmation message that will appear, you will need to click Yes.
A second message will ask to Reboot now? Click yes to allow the reboot.

Please scan with HijackThis, post a fresh log, and let me know how things are running.

Hi

That's it sorted !!! No more pop ups at start up now, and I'm going to change all my passwords !! I had to do a bit of jiggery-pokery ( as in, the c:\windows\system32\dxdll\svchost.exe didn't exist ), but apart from that, I followed your instructions, and now I'm pop-up free !!! After the pop ups ceased I got new warning messages about the svchost.exe not existing, but I just deleted it from the registry and now everything is just fine ( I've re-booted about 10 times to test it ).

Anyway, thanks very much for all your help here, I really appreciate it, you're doing a great job !! Well done !!

Good work! This is a technical term that I will have to remember: "jiggery-pokery!

After something like this it is a good idea to purge the Restore Points and start fresh.
To flush the XP System Restore Points:
(Using XP, you must be logged in as Administrator to do this.)

Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn Off System Restore.

Reboot. Go back in and turn System Restore ON. A new Restore Point will be created.

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

You may have already taken some of these steps:
1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Adjust your security settings for ActiveX:
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

3. Download and install the following free programs:
a. SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
b. SpywareGuard:
http://www.javacoolsoftware.com/spywareguard.html
Tutorial here: http://www.bleepingcomputer.com/tutorials/tutorial50.html
Periodically check for updates in both programs.

4. Keep your antivirus software and firewall software up to date.
Note: Zone Alarm Firewall (Zone Labs) http://www.zonelabs.com/store/content/home.jsp
Sunbelt Kerio has a free version: http://www.kerio.com/kpf_download.html

5. You might consider installing Mozilla / Firefox.
http://www.mozilla.org/

6. Install spyware detection and removal programs:
You may also want to consider installing either or both of AdAware (free version) and Spybot S&D (freeware). Use these programs to regularly scan your system for and remove many forms of spyware/malware.

a. Ad-aware: http://www.lavasoft.de/software/adaware/

b. SpyBot S&D: http://safer-networking.org/en/news/2005-05-31.html

I would check for updates in SpyBot once a week or so.
Check for updates in Ad-aware frequently.

If you have recently installed ewido, it is a free trial product for 14 days. After that you can purchase it for full features OR you can also keep the free version to use as an on-demand scanner (recommended).
You will still be able to manually update Ewido using the *update* button

7. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List.
Here is the link:
http://www.spywarewarrior.com/rogue_anti-spyware.htm
If you want to know just how effective your anti-spyware program is, or how well any of the "rogue" programs listed at the above link work, check this for an independent comparison of several anti-spyware programs: http://www.spywarewarrior.com/asw-test-guide.htm

8. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbr.

9. If you use Adobe Reader it may need to be updated to be sure that you have a more secure version. If you are using a version prior to v. 6.05, you should update to 6.05, preferably version 7.07. It would be best to update sequentially.
Info here: http://www.adobe.com/support/downloads/product.jsp?product=10&platform=Windows
If you need additional assistance, the Adobe forums are here: http://www.adobe.com/support/forums/main.html

10. Here are so me helpful articles:
"So how did I get infected in the first place?"
http://computercops.biz/postlite7736-.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx


Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!

LOL, yeah, 'jiggery pokery' - a great explanation !! :)

Thanks a lot again for all the advice, and true, I did take some of the other precautions that you recommended, but most of them I didn't, so I'll get cracked on with that.........and I won't be so silly as to open an .exe that I don't know anything about again !!

Keep up the good work mate, you're very much appreciated.

 

You're very welcome! I'm glad we could help!