Gmanbo fix

Viruses and worms
1

Here is your fix - what problems are you experiencing now ?

Run OTL

[*]Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
FF - prefs.js..browser.search.selectedEngine: "MyWebSearch"
O3 - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.

:Commands
[purity]
[emptytemp]
[Reboot]

[*]Then click the Run Fix button at the top
[*]Let the program run unhindered, reboot the PC when it is done
[*]Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

2

I’m sorry, but did you want me to do the quick scan with the commands posted in the other thread? Or just a regular quick scan? Also, thanks a ton for being so willing to help. Actually, seeing as you said just click quick scan, and it wouldn’t hurt to do so, I’m going to try that.

EDIT: Here is the result of the scan after restarting, now attached.

3

Add the fix to the box then click run fix - once that has completed then just run a quick scan - plus let me know what problems you are having

4

Well, as far as “problems” are concerned, my windows firewall is turning off by itself, and at times when following links, I end up on “about:blank”, which is supposedly a symptom of a virus/ hijacker. On the subject of firewalls, do you reccomend keeping windows firewall (on windows xp) or changing to something else?

5

A third party firewall is recommended for XP although it is a while since I have used one myself

6

The OTL is attached here. I’ll try and find a nice third party firewall after this is taken care of. When this is all said and done, do you know any good third party ones I should use? and will windows firewall be disabled automatically? Or will I have to keep turning it off to keep the system stable? Feel free to ignore the firewall questions if that’s too much to worry about on top of the current problem.

7

I have been told that comodo is quite good but just the firewall not the antivirus element http://personalfirewall.comodo.com/free-download.html most firewalls automatically turn of the XP one

I can see no apparent malware in your log now - does the blank page occur often ?

8

It occurs about 1 out of every 15 links followed (No specific links from specific sites, it’s happened on more than 1 site.) but I don’t recall it ever being my homepage or being directed to it when typing in a specific web address. Any possible reason I found an extras file earlier, but not this time?

9
I'll try and find a nice third party firewall after this is taken care of.
My favorit ...... Outpost Firewall Free http://free.agnitum.com/
10

It will only generate an extra text on the first run - or when I tell it to ;D

When you get the blank page have you tried refresh to see if it brings it back ?

11

I don’t believe I ever tried that, but I’ll go around and click some links leading to things I know are safe until I run into it again, then I’ll try to refresh.

On the other hand, any idea what may be turning off the firewall?

EDIT: I also often get the error of “Problem loading page” VERY often. Way more often than I should.

12

There was no indication of that in your logs

Could you update and re-run MBAM and then post the log

13

It sounds like you still have traces of malware on your system.

As you were compromised by malware and windows FW is not appropriately enabled, please restore default security settings using Microsoft Fixit: http://support.microsoft.com/kb/313222

Please click on “Fix it” and follow the prompts.

Outpost (Agnitum’s product) is a wonderful, free firewall. Comodo is also an excellent firewall, but is very high maintenance/yappy. Another excellent choice many people prefer is OnlineArmor Free: http://www.tallemu.com/ (if you choose OA, please do not “trust all” when you first run the installation wizard, instead choose to run safety wizard and follow its recommendations). Some people like PCTools firewall: http://www.pctools.com/firewall/

14

I updated and here is the new log.

15

Is that with IE or Firefox ? If IE then update to IE8 http://www.microsoft.com/windows/internet-explorer/worldwide-sites.aspx

If FF what version are you using ?

16

I’ve done all I can to remove IE, cause I don’t like using it; I use Firefox version 3.6. I can’t find a way to get rid of IE completely though, so should I update it for security reasons?

17

Well, I do have somewhat good news; I haven’t seen the firewall turn itself off since the malwarebytes, but it didn’t happen too often, so it may be still there, I’m going to keep an eye out for it. One thing about it I forgot to mention, is that it would turn back on by itself too. Could it have been/be avast! turning it off the scan the computer, or possibly updating or something?

18

You can’t remove IE because it is built in with Windows. Removing IE8 will only revert back to the old version.

19

But should I install IE8 to keep it updated even though I don’t use it?

20

Windows Update will do it for you…