system
January 29, 2010, 7:29am
1
Sorry, I’m really NOT a techy person at all, but I started getting a message yesterday - malware found in C Documents and Settings HP Administrator Local Settings Temp JS Shelcode DL [EXPL] …Not sure what to do as if I click on delete or move to chest it just tells me it cannot process the file…I tried scanning the temp folder itself and nothing was found though. Should I be worried?
any help greatly appreciated!
PS I need any replies in idiot-speak please if I’m to understand them:D Thank you!!!
Pondus
January 29, 2010, 7:47am
2
Hi Bernie
Try this, download and run ATF cleaner http://www.geekstogo.com/forum/ATF-Cleaner-file21.html http://www.tgbcomputing.com/howTo-Info/How%20to%20use%20ATF%20Cleaner.pdf
extra cleaning if you have opera or firefox installed
If you have opera browser
If you have firefox
Pondus
January 29, 2010, 7:54am
3
If this does not work try,
i guesse you have avast 4.8 ? If you have avast 5, boot scan will show just under the scan tab when you click it
Boot time Avast Antivirus Scanninghttp://www.digitalred.com/avast-boot-time.php
MBAM http://filehippo.com/download_malwarebytes_anti_malware/
you may post the scan log here
system
January 29, 2010, 2:19pm
4
Thanks for the replies! Yes, I have 4.8.
Am just d/l the spyware doctor now. I have spyware terminator already on the pooter…is this OK to have both?!
The cleaner…I have CCCleaner which I ran last night and cleaned out all my temp internet files. Is the cleaner you mentioned something similar…should I get the one you mentioned also…?!
TIA!
Bernie x
OK, hopefully here is a jpeg of a screenshot showing the results. Hopefully it can be read! When I try to delete the things found, it takes me to a registration screen and tells me I have to pay for the full version…is this right?!
Pondus
January 29, 2010, 4:20pm
5
OK, hopefully here is a jpeg of a screenshot showing the results. Hopefully it can be read! When I try to delete the things found, it takes me to a registration screen and tells me I have to pay for the full version..is this right?!
That is correct for spyware doctor, you have to pay for removal. so remove it
The program i wanted you to download is Malwarebytes Antimalware and it will remove infections for free, see the link in my second post
You can use CCleaner, go to Options > Advanced > and remove the tic on " only delete files older then 24 hours"
when you have run Malwarebytes post the log here
system
January 29, 2010, 7:35pm
6
sorry i thought the link in the 2nd post MWBAM was the link to that!
bernie x
Pondus
January 29, 2010, 7:48pm
7
sorry second post, this link
MBAM http://filehippo.com/download_malwarebytes_anti_malware/
system
January 29, 2010, 8:32pm
8
well I just d/l the ATF Cleaner anyhow and it cleaned something like 1748.000KBs, which I assume is good!
I see what i did with the MBAM…when you click on the d/l latest version, there’s a d/l button for spyware Dr right in the middle of the screen, which I’d clicked. This time I clicked on the top tiny link for if the d/l doesn’t start, s have got the correct program now I hope!!!
BRB! I do appreciate all your help!
system
January 29, 2010, 8:58pm
9
OK, I’ve run the MBAM and then clicked on remove selected and this log popped up…
system
January 29, 2010, 8:58pm
10
and the rest!!
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) → Quarantined and deleted successfully.
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Thank you!
Pondus
January 29, 2010, 9:13pm
11
Wooooow…that is the biggest MBAM log i have ever seen…you sure had som s… in there
run again and see if the next run comes up clean…
system
January 29, 2010, 9:23pm
12
fame at last!!
DavidR
January 29, 2010, 9:30pm
13
And XP SP2 may be a reason, since SP3 has been out for over 18 months, closing a number of vulnerabilities, etc. etc.
@ Bernie
system
January 29, 2010, 9:33pm
14
here’s the result!
29/01/2010 21:32:00
Scan type: Quick Scan
Memory Processes Infected: 0
Memory Processes Infected:
Memory Modules Infected:
Registry Keys Infected:
Registry Values Infected:
Registry Data Items Infected:
Folders Infected:
Files Infected:
Thanks for that link - will check it out…these new things can’t be automatic then…?!
Bernie x
Pondus
January 29, 2010, 9:44pm
15
MBAM PRO is automatic, it is a one time fee for a liftime license www.malwarebytes.org
you say you have SpywareTerminator ?http://filehippo.com/download_superantispyware/
Update your XP SP2 to SP3 http://technet.microsoft.com/en-us/windows/bb794714.aspx
When you have the time, do a full scan with MBAM and avast just to be sure you are clean
The warning you got from avast earlier is it gone.?
OBS: i see one thing in your MBAM log, the database is 3510…the latest is 3659 so you forgot to update before the scan!
system
January 29, 2010, 10:25pm
16
Thank you so much for all your help!
I’m running a full scan now as it happens - I was just being nosey really, LOL!
I’ll get to work on those other things too.
The avast warning from first thing this morning hasn’t popped up again at all…
Thank you again so much - to have it explained so I could actually understand is fantastic!!!
I’ll be singing your praises for days!!!
Bernie x