Do you use a web server in Marina Del Rey California?

Well, I use web based email servers for work and for school. The school is in Texas though and work is in Florida. So, I don't believe I do...why?

Because of this entry here:
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.16.2.18:80

The I.P. address references a web server in Marina Del Rey. If you know with certainty that you do not use a Proxy server, then you should delete that entry.

Ok ok ya that is the IP address I use to connect to the network at my college.

I don't see anything in the log that would indicate the reason for the behavior you describe.

You appear to have a symantec driver still running a process from an old installation. Follow these instructions to completely remove the Symantec product.

Next, please download CCleaner. Double click on the set up file and allow it to install to the default location. At the Cclean setup screen & Install options Uncheck the Add Ccleaner Yahoo Tool bar unless you want it.

Run CCleaner

Before first use, check under Options, Settings, and ensure "Only delete files in Windows Temp folder older than 48 hours" is unchecked.
Then open it and select the items you wish to clean up.

In the Windows Tab:
I recommend cleaning all entries in the "Internet Explorer" section except Cookies.
Clean all the entries in the "Windows Explorer" section
Clean all entries in the "System" section
Clean all entries in the "Advanced" section.

In the Applications Tab:
Clean all except cookies in the Firefox/Mozilla section if you use it.
Clean all in the Opera section if you use it.
Clean Sun Java in the Internet Section if you have it.
Clean any others that you choose.

Then click the "Run Cleaner" button. When finished, close the application.

Please download Ewido Security suite.

After download, double click on the file to launch the install process.
During installation, under "Additional Options" uncheck "Install background guard" and "Install scan via context menu".

Launch ewido by double-clicking the "e" icon on your desktop.
The program will prompt you to update - click the "OK" button.
On the left side of the main screen, click on "Update" and then click "Start Update". The update will start and a progress bar will show the updates being installed.

After the updates are installed, you will see "Update Successful" in the lower left corner.

Once the updates are installed do the following:
Click on "Scanner" and choose "Settings".
Under the bottom section "What to Scan?" make sure "Scan every file" is selected.
Select "OK" and you will return to scanning options.

Boot the computer into safe mode.
Once in safe mode, continue with the instructions below:

On the main screen click on "Complete System Scan" to start the scan.
While the scan is in progress, you will be prompted to clean the first infected file it finds. Put a check next to "Perform action on all infections" in the lower left corner.
Then choose "Clean" and click "OK".

When the scan has completed, Ewido will create a report.txt file.
Click the "Save Report" button on the bottom of the screen and save the log to your desktop.
Exit Ewido when done.

Reboot normally. Perform an onlinescan here.

- Once you are at the Panda site click the Scan your PC button
- A new window will open...click the Check Now button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click "send"
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
- When download is complete, click on Local Disks to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location (Your Desktop is fine).

Post back the logs from the Ewido and Panda Scans. Also, please advise if you are still having any issues.

Here is the Log for Panda:

Incident                                                                        Status                        Location                                                                                                                                                                                                                                                       

Spyware:Cookie/Banner                                                           Not disinfected               C:\Documents and Settings\Administrator\Cookies\administrator@banner[2].txt                                                                                                                                                                                    
Spyware:Cookie/Belnk                                                            Not disinfected               C:\Documents and Settings\Administrator\Cookies\administrator@belnk[1].txt                                                                                                                                                                                     
Spyware:Cookie/Belnk                                                            Not disinfected               C:\Documents and Settings\Administrator\Cookies\administrator@dist.belnk[2].txt                                                                                                                                                                                
Spyware:Cookie/Xiti                                                             Not disinfected               C:\Documents and Settings\Administrator\Cookies\administrator@xiti[1].txt                                                                                                                                                                                      
Spyware:Cookie/Linksynergy                                                      Not disinfected               C:\Documents and Settings\Jon Hayes\Cookies\jon hayes@linksynergy[2].txt                                                                                                                                                                                       
Spyware:Cookie/Reliablestats                                                    Not disinfected               C:\Documents and Settings\Jon Hayes\Cookies\jon hayes@stats1.reliablestats[2].txt                                                                                                                                                                              

EWIDO:

---------------------------------------------------------
 ewido anti-malware - Scan report
---------------------------------------------------------

 + Created on:   11:15:05 AM, 6/19/2006
 + Report-Checksum:  ADB7088

 + Scan result:

 C:\WINDOWS\icont.exe -> Adware.AdURL : Cleaned with backup
 C:\WINDOWS\system32\vtsts.dll -> Adware.Virtumonde : Cleaned with backup

::Report End

I haven't had any more issues since I ran the Ewido scan, but sometimes that happens and then they come back. The Panda scan found some stuff also.

 

The Panda scan found spyware cookies that Ewido will remove.
Congratulations, your log looks clean!

Now that your system is clean, let's create a new restore point.
Please click "Start > Programs > Accessories > System Tools > System Restore"
In the new window, check the 'Create a restore point' in the right pane and click "Next".
In the "Restore point description" textbox, name your restore point to something you will easily recognize. I recommend something like yyyymmdd_Clean (ex. 20060101_Clean)
Click "Create" and reboot your computer.


In the future, there are some things you can do to prevent spyware infections:

Install the following freeware programs:
SpywareGuard
Spywareblaster

Keep your anti-virus and spyware definitions up to date. Be sure to scan often.

If you do not have a firewall, here are a couple freeware firewalls you can install:
Kerio Personal Firewall
Zone Alarm


Stay updated with the most recent Windows patches using
Microsoft's Windows Update.

Using an alternate browser can reduce your chance of certain infections installing themselves. We recommend installing Mozilla Firefox from http://www.mozilla.org

If you still wish to use Internet Explorer, please make sure you install SpywareBlaster (from above) to protect you from most ActiveX infections.

Run CCleaner often
or Disk Cleanup ("Start > Programs > Accessories > System Tools > Disk Cleanup") and check off the following:
Downloaded Program Files, Temporary Internet Files, Recycle Bin, and Temporary Files

So how do I get infected in the first place?
Regards, and Happy Surfing!